Oktobot is an independent project. There is no Oktobot account, and we operate no server that receives your conversations, files, or usage. Contact: github.com/seko121/oktobot-support/issues.
Oktobot does not include a model. It connects to AI services you choose, using your API key, or a subscription you already hold with that provider, or it runs a model you download onto your phone. Your conversations, memories and settings are stored on your device. Whenever a feature needs a cloud service, your data goes to that company — not to us — and their privacy policy governs what they do with it.
Oktobot contains no analytics SDK and no crash-reporting SDK.
Conversations, saved memories, settings, the list of apps you allow Phone Control to use, files Oktobot creates, the Linux sandbox, downloaded on-device models, and your API keys and provider tokens are stored in Oktobot's private storage on your phone.
API keys and tokens are encrypted using Android's hardware-backed keystore. If a device's keystore cannot encrypt them, Oktobot refuses to save the key rather than storing it unprotected, and tells you so.
Deleting a conversation, deleting a memory, removing a provider, clearing the app's data, or uninstalling Oktobot removes the corresponding data from your device.
Everything in this section happens because you asked for it, either directly or by turning a feature on. Nothing here is sent to us.
| Data | Sent when | Sent to | Optional |
|---|---|---|---|
| Your messages, prompts and attachments | You send a message to a cloud model | The AI provider you configured | Not for cloud models — choose an on-device model to avoid it |
| Saved memories | Included in the prompt so the assistant remembers context | The AI provider you configured | Yes — memory can be turned off, and entries deleted |
| Search queries | The assistant searches the web | Your chosen search provider (DuckDuckGo by default, or Brave, Tavily, Google Custom Search) | Yes |
| Voice audio or transcripts | You use voice input or a voice call | Nothing leaves the device with on-device recognition; a cloud speech provider receives it if you select one | Yes |
| Text to be spoken | The assistant speaks a reply | Your chosen text-to-speech provider | Yes |
| Screen text and screenshots | Phone Control is running a task | The Phone Control model you chose. An on-device model keeps them on your phone | Yes — Phone Control is off by default |
| Contacts, SMS, notifications, clipboard | A task you gave needs them, through a tool | The AI provider you configured | Yes |
| Files you attach | You attach a file to a message | The AI provider you configured | Yes |
| Installed app names | Cached at startup so the assistant can open apps you ask for | The AI provider, when a task needs it | Yes |
| Device information (model, Android version, language) | Included as context | The AI provider you configured | Yes |
| Data an integration needs | You connect and use an MCP server or Composio connector | That service | Yes |
| Messages you send through a chat channel | You link Telegram or Discord | That platform | Yes |
| Web page requests | You browse in the in-app browser | The websites you visit, which receive your IP address | Yes |
| API keys and tokens | Authenticating a request | Only the provider that issued them | Required for cloud providers |
We have no visibility into or control over what these providers do with what they receive. Please read the privacy policy of each service you connect.
Oktobot can carry out tasks by operating apps on your screen through Android's accessibility service. Oktobot is not a general accessibility tool; this exists so the assistant can act for you.
Oktobot includes a browser engine (Mozilla GeckoView) so the assistant can open and read pages. Cookies, cache and browsing history from that browser are stored on your device. Sites you visit receive your IP address and whatever they normally collect. Oktobot does not configure the engine to send crash reports or telemetry to Mozilla.
Oktobot can download and run a small Linux environment, including packages you install, inside its own private storage. It has no access to your personal files.
The Linux runtime, its base system, and on-device AI models are checked against a cryptographic checksum after download and before use; a file that fails this check is deleted, not run.
Oktobot can produce a diagnostic file for troubleshooting. Before it is written, the contents are filtered to remove message text, screen content, and credentials such as authorisation headers and API keys. Nothing is sent anywhere automatically — the file only leaves your device if you choose to share it. Please still review it before sending it to anyone.
Oktobot requests a permission only when you use the feature that needs it, and the app keeps working if you decline.
Oktobot does not request access to all files on your device, your location, your camera, your call log, or the ability to send SMS or install apps.
Oktobot is not directed to children under 16, and we knowingly collect no data from them.
Because we receive none of your data, you exercise most rights directly: delete conversations and memories in the app, remove providers, clear app data, or uninstall. For data already sent to a provider you connected, contact that provider — they are the controller of it. Depending on where you live, data-protection law may give you rights of access, correction, deletion, restriction, portability and objection, and the right to complain to a supervisory authority.
Connections to the AI providers and other services you configure use encrypted transport (TLS). No software can guarantee absolute security. Keep Android updated, use a device lock, install Oktobot only from a trusted source, review what you have allowed in Settings, and remove providers you no longer use.
If this policy changes materially, the app will ask you to accept the new version. The version you accepted and when is recorded on your device.