Privacy Policy

This policy explains what the Okroh desktop app and okroh.com collect, what leaves your computer, who receives it, and how long it is kept. “Okroh”, “we” and “us” mean Okroh, Inc., a Delaware corporation. Questions go to [email protected].

The short version

• Your chats, memory and documents are stored on your computer in an encrypted database. We can’t read them.
• To answer you, the text of a conversation is sent through Okroh’s gateway to AI models on Amazon Bedrock (Amazon Web Services), or, when Bedrock can’t serve a request, through OpenRouter to a zero-data-retention host in the United States. Okroh’s privacy shield is on by default: before the text leaves your computer, it replaces personal details it detects with stand-ins. You can turn the shield off in Settings, and then the text, including names and addresses, is sent as you wrote it. Images you attach are sent unchanged.
• Sync is optional and end-to-end encrypted. Our servers store only encrypted data plus the small amount of metadata listed below.
• We keep the account and usage records needed to run your account and its limits. We don’t sell data, show ads, or use analytics, telemetry or crash-reporting services in the app.
• A bug report is sent only when you press Send, and contains only what you entered in the form plus your account email. Okroh sends no crash reports or diagnostic data.

What stays on your computer

Chats, memory, project settings and the text Okroh indexes from your files are kept in an encrypted database (SQLCipher) in your home folder. Its key is held in your operating system’s secure storage (the macOS Keychain or Windows Credential Manager). Speech recognition, the personal-detail detector and the memory search model run on your computer.

Some things are stored on your computer without that database encryption, protected only by your operating system’s account security: files Okroh creates for you and exports you save, the working folder used to run code, installed skills, cached web images, and local diagnostic logs (which are written to exclude the content of your chats). Folders you attach to a chat stay where they are; Okroh reads them only when you ask and asks before changing anything.

What is sent when you chat

To generate a reply, Okroh sends the conversation to gateway.okroh.com, a gateway we operate. A request can include your message, earlier messages in the chat, relevant memory, text from files you attached, and results of tools you approved. The gateway doesn’t log prompts or replies, doesn’t cache them, and removes your IP address and browser headers before forwarding the request to the provider that runs the model:

• Amazon Bedrock first. The gateway sends each request to Amazon Bedrock, Amazon Web Services’ AI service, in the United States (US East). Memory upkeep (pulling facts out of a conversation, summaries, and tidying memory) uses Claude Haiku 4.5 on Bedrock. Bedrock doesn’t store prompts or replies or use them to train models, and we keep Bedrock’s request logging turned off. Bedrock automatically screens images in requests and replies for child sexual abuse material; Amazon may store and review flagged content only to confirm what it is, and may report it to the National Center for Missing and Exploited Children or another authority.
• OpenRouter as a fallback. If Bedrock can’t serve a request, for example because a model is busy or not available to us there, the gateway sends it to OpenRouter, a service in the United States that forwards it to another company running the same model. We allow only endpoints in the United States that are on OpenRouter’s zero-data-retention list, every request tells OpenRouter not to use hosts that collect data, and we never use Google Vertex. OpenRouter doesn’t store prompts or replies, and neither it nor those hosts use them to train models. Claude models go only to Amazon Bedrock’s endpoints on OpenRouter; open models can go to Amazon Bedrock, DeepInfra, Together AI, Fireworks AI, Groq, Cerebras, SambaNova, DigitalOcean or Parasail. OpenRouter screens requests for child sexual abuse material and may keep flagged content to review and report it.
• Claude 5.5 models aren’t available on our Bedrock account yet, so they always go through OpenRouter, to its Amazon Bedrock endpoint in US East. Mistral Large 3 runs only on our Bedrock account, with no fallback.

Requests reach these providers from our gateway, not directly from your computer.

Personal details are replaced first. Okroh’s on-device privacy shield is on by default. Before anything is sent, it finds personal details such as names, email addresses, phone numbers, street addresses, card, bank and ID numbers, and anything matching your own data rules, and replaces them with stand-ins. Real values are put back into the reply on your computer. The same applies to the other requests Okroh makes to the gateway, such as naming a chat and maintaining memory. Detection is automatic and can miss things, especially names that appear only inside a file or a tool result.

You can turn the shield off. The Privacy shield switch in Settings turns it off completely. While it’s off, nothing is replaced: the text Okroh sends to the gateway, including names, addresses and the other details above, reaches the AI provider as you wrote it.

Sending a detail once. When an answer truly needs a real detail, for example an address to work out a distance, Okroh asks you first. If you choose Send once, that detail goes to the AI provider as written, for that one message only.

Images are sent unchanged. The shield works on text. If you attach a screenshot or photo, the provider receives the image as it is, including any personal details visible in it.

For each request we record the model, the number of tokens and the cost against your account, so we can apply your plan’s limits. These usage events are kept for 35 days; your running totals are kept while your account exists.

Tools you approve

Some tools reach other services, and they act with your real values, not stand-ins, after you approve them:

• Web search runs from your computer through DuckDuckGo. If that fails, the search query is sent through our server to Tavily, a search provider.
• Reading a web page fetches it directly from your computer, so that site sees the request.

Sync between your devices

Sync is off until you turn it on. Your chats and memory are encrypted on your device before upload, and only your devices hold the keys, so our server stores data it can’t read. To deliver it, the server also keeps: your account ID, an ID and the name you gave each device, the devices’ public keys, the size and time of each encrypted record, and a signed list of your devices. Encrypted records are deleted once every device has received them, and after 72 hours if a device never collects them. So that a new or long-offline device can catch up, the server also keeps the latest encrypted snapshot your devices have agreed on (up to 64 MB); older snapshots are deleted when a newer one is agreed.

Your account and plan

Sign-in runs on auth.okroh.com, our own server running the open-source Supabase software, which stores your email address and a hashed password. Our server keeps your email address, your plan (free during the beta), your usage totals and limits, and the access key the app uses for the gateway. If paid plans start later, it will also keep your subscription status and Stripe customer and subscription IDs. The gateway stores that access key with your email address and its usage, so usage counts against the right account.

Payments

The beta is free, so there are no payments now. If paid plans start later, payments will be processed by Stripe. You enter card details on Stripe’s pages; we never receive or store them. Stripe receives your email address and Okroh account ID, and tells us the status of your subscription and payments.

Bug reports and email

Settings → Help → Report a bug sends only what you enter in the form (your message, and a subject or your operating system where the form asks for them), plus your account email so we can reply. It never includes chats, files, logs, diagnostic data or device identifiers, and Okroh doesn’t send crash reports. It is sent when you press Send and never automatically. It is delivered by email to [email protected] and kept in that mailbox; our server doesn’t store it. The diagnostic info in Help is copied to your clipboard only, never sent. Emails you send us are kept to handle your request.

Downloads and updates

The app checks GitHub for updates and downloads parts it needs: the Python runtime (jsDelivr), the privacy shield’s detection model (from Okroh’s own mirror on GitHub, with Hugging Face as a backup) and the other on-device models (Hugging Face). If you approve code that installs packages, they come from PyPI or npm. Those services see your IP address when you download from them.

okroh.com

The password-reset page holds your sign-in only in memory while the page is open and stores nothing in your browser. The site is hosted on Cloudflare, which processes your IP address and request details to deliver and protect it. Links to other sites lead to services with their own privacy policies.

Waitlist and referrals

If you request beta access, we store your email address, platform, signup date, confirmation and invitation status, and signup source or campaign in a separate Supabase Cloud database in the United States. If you use a referral link, we associate your signup with the person who shared it. They can see their confirmed referral count, but not your address or identity. Resend receives your email address to deliver confirmation and access-link emails.

Referral and campaign codes can be kept in your browser’s session storage while you move between pages. They contain no email address and are used to credit referrals and identify beta campaigns, not for advertising. To limit repeat requests, we keep a daily keyed hash of your IP address in temporary counters that expire after two hours and are removed on a later signup request. Confirmation links expire after 24 hours. Your private waitlist-page link opens your current position and the total pending requests, your share link, and your confirmed referral count. It does not show other members’ names or addresses. Keep it private. We keep waitlist records until you ask us to remove them or the beta invitation process ends. To remove your address and referral records, email [email protected].

Cookies

okroh.com doesn’t set advertising cookies or use third-party analytics or advertising tools. The referral flow uses session storage as described above. Cloudflare, which hosts the site, may set a strictly necessary security cookie if it needs to check that a visitor isn’t a bot. The app doesn’t use cookies or tracking pixels.

Who receives data

• Amazon Web Services (Amazon Bedrock): conversation text (shielded unless you turn the shield off or approve sending a detail) and images, to generate replies and keep memory up to date.
• OpenRouter, in the United States, and the US host it forwards a request to (Amazon Web Services, DeepInfra, Together AI, Fireworks AI, Groq, Cerebras, SambaNova, DigitalOcean or Parasail): conversation and memory text (shielded unless you turn the shield off or approve sending a detail) and images, when Bedrock can’t serve a request, and for every Claude 5.5 request.
• Stripe: payments, only if paid plans start after the beta.
• Tavily: search queries, only when the on-device search fails.
• Google Workspace: our email, including bug reports.
• Cloudflare: website hosting, including your IP address when you visit okroh.com. Resend: waitlist email.
• Supabase Cloud, in the United States: waitlist and referral records.
• OVHcloud (OVH US LLC), in the United States: hosting for our relay, sign-in, account and gateway servers. A retained copy of waitlist signups from before the Supabase Cloud migration remains on the original server as a migration backup.

We don’t sell or rent personal information, and we don’t share it for advertising. We may also disclose information when the law requires it, for example in response to a valid court order, or when it’s needed to protect someone’s safety or our rights; where allowed, we’ll tell you first. If Okroh is merged or acquired, your information may pass to the new owner, who must keep to this policy or tell you before changing it.

These services and our servers are in the United States, so your information is processed there even if you live elsewhere. Your local data stays on your computer.

Keeping and deleting your data

Data on your computer stays until you delete it. Uninstalling Okroh may leave its data folder in place; delete the .okroh folder in your home folder to remove it. To close your account and delete what our servers hold, email [email protected] from your account’s address. Within 30 days we’ll delete your account, sync data and gateway key, and cancel any billing. If you ever paid us, Stripe and our accounting records keep payment records for as long as the law requires.

Email from us

We send account email (sign-up confirmation, password reset) and replies to your messages. We don’t send marketing email from the app. To stop waitlist email, email us and we’ll remove your address.

Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal information, or to object to how we use it. Email us and we’ll respond within 30 days. Most of your data is on your own computer, where you control it directly.

Security

We encrypt data in transit, encrypt your local database and synced data, and keep server-side data to the minimum listed here. No system is perfectly secure; if a breach affects your information, we’ll tell you as the law requires.

Children

Okroh is for adults: you must be 18 or older to create an account. We don’t knowingly collect information from children under 13. If you believe a child has given us information, email us and we’ll delete it.

Changes

If we change what Okroh collects or sends, we’ll update this page and the date above, and tell you in the app or by email before a significant change takes effect.

Contact

Okroh, Inc. Privacy questions and requests: [email protected].