Legal

Privacy Policy

Last updated: 25 April 2026

    The short version: Aaka is self-hosted software that runs on your own hardware. We do not operate servers that process your personal data. Your calendar, messages, and files never leave your infrastructure.
  

1. Who we are

Aaka ("we", "our", "the software") is an open-source personal assistant application published at github.com/prasadgupte/aaka-life. The software is self-hosted — you run it on your own computer or server. For questions, contact hello@aaka.life.

2. What Aaka is and is not

Aaka is software you install and operate yourself. It is not a cloud service. We do not have access to your data, and we do not operate the infrastructure on which you run Aaka. This privacy policy describes how the software handles data when you run it.

3. Data Aaka accesses via Google APIs

When you configure Aaka, you grant it access to certain Google services using OAuth 2.0. The scopes Aaka may request are:

Google Calendar (calendar.events, calendar.readonly) — to read your calendar events and write new events you request via chat.
Google Tasks (tasks) — to read and create task items.
Gmail (gmail.readonly) — to read emails when you explicitly request a summary or search.

    Key point: All Google API calls are made from your own hardware (the "Home" component) directly to Google's APIs. OAuth tokens are stored only on your machine, in the directory you specify. Aaka's Away component — which runs on a VPS — has no access to your Google credentials or calendar data.
  

4. How your data is used

Data retrieved from Google APIs is used solely to respond to your requests in the messaging app you have configured (WhatsApp or Telegram). Specifically:

Calendar data is read to answer schedule queries and written only when you explicitly confirm an event addition.
Task data is read to list tasks and written only when you create a new task.
Email data is read only when you explicitly request it and is not stored persistently.

Aaka does not use your data to train machine learning models, build advertising profiles, or any other purpose beyond fulfilling your immediate request.

5. Data storage and retention

Aaka stores the following data locally on your hardware:

OAuth tokens — in your configured token directory.
Calendar snapshots — plain-text files used for zero-token schedule reads, updated by a background sync process you control.
A SQLite queue database — containing pending actions, cleared after execution.
Log files — operational logs, stored locally and rotated on a schedule you configure.

No personal data is sent to or stored on any server operated by Aaka's authors.

6. Third-party services

When you send a message that requires natural-language understanding (for example, "add dentist on Friday at 3pm"), Aaka may call a large language model API (currently Google Gemini or a compatible API you configure). Only the text of that specific message is sent — no calendar data, no personal identifiers beyond what is necessary to extract the intent.

The messaging platforms you use (WhatsApp, Telegram) are governed by their own privacy policies. Aaka receives messages via their respective APIs and does not store message content beyond the immediate processing cycle.

7. Children's privacy

Aaka is not directed at children under 13. As a self-hosted tool operated by an adult administrator, any use involving children's data is entirely under the operator's control and responsibility.

8. Your rights

Because Aaka is self-hosted, you have complete control over your data at all times. You can revoke Google OAuth access at any time via your Google Account permissions page. You can delete all local data by removing the Aaka data directory.

9. Changes to this policy

We may update this policy as the software evolves. Material changes will be noted in the GitHub repository changelog. Continued use of the software constitutes acceptance of the updated policy.

10. Contact

Questions about this policy: hello@aaka.life