Local vault
Asset metadata, relationships, captures and proposals stay in encrypted SQLite on your computer. Argon2id derives the password key; XChaCha20-Poly1305 encrypts records. The default idle lock is 15 minutes. The website does not receive your full vault or provide vault sync or master-password recovery.
Model requests
Local inference stays on your device. BYOK sends the current input and necessary context to your chosen provider. Website cloud sends your current input, up to 12 related object names and types, and non-secret relationships, reminders or field names needed for the requested changes. It excludes the full vault, past captures, existing field values and SECRET items. Never include credentials in your input.
Hosted AI uses a separate commercial Alibaba Cloud international API in Singapore. The provider may retain service records under its current data policy. We do not promise zero retention by the provider. Review its data policy before use. Alibaba Cloud ↗
Account, payments and retention
The server stores your sign-in email, OAuth identities, sessions, Stripe customer and subscription IDs, purchase batches and credit ledger. Sign-in uses necessary cookies. Stripe hosts payment details; we do not store card credentials. Credits are tracked by purchase batch.
Successful AI results are encrypted and cached for one hour for retries, then removed. The ledger and request digests remain for deduplication and refunds. The backend stores no raw-input logs or asset database. There is no product-usage telemetry. Network providers may retain access records. The cloud database is backed up encrypted to Sayori daily and retained for 30 days.
Contact and deletion requests
Send account and privacy requests to me@sayori.org. We verify account ownership. Payment records that must be retained are not automatically erased when you delete a local vault.