Ai.ddy turns a phone you already own into a companion for someone who needs one: a child, or an older adult. It runs as that phone's home screen, and it can report to one paired guardian.
Read on the device, stored on the device, transmitted nowhere.
| Data | Purpose | Permission |
|---|---|---|
| App usage events (which app, when) | Learning habits, macro suggestions | Usage access |
| Notification contents | Triage, bill detection, briefings | Notification access |
| Foreground app | Habit learning | Accessibility service |
| Location samples | Home/work places, arrival and departure reminders, weather | Location |
| Contacts (name โ number) | "Call Ayลe" without typing a number | Contacts |
| Calendar events | Saying what is next | Calendar |
| Camera frames | Motion and presence detection | Camera |
| Microphone audio | Voice commands, and the recording macro if you build one | Microphone |
| Reminders, macros, saved notes | The features themselves | โ |
Two deserve detail.
Each frame is compared with the previous one, on the device, to answer one question: did anything move. Frames are not recorded, not stored and not sent. What leaves the analyser is an event โ "movement began", "nothing has moved for twenty minutes" โ never a picture. While the camera is on, the app says so on its own screen: Android 12 and later show a system indicator, Android 8 to 10 show nothing, which is why the app draws its own.
With a local model downloaded, questions are answered on the phone and nothing is sent anywhere. The model file itself is fetched once from its publisher.
Section 2Only where you configure it. Each of these is off until you turn it on.
If you pair a guardian, events โ "reminder done", "no movement since morning" โ travel through a Telegram bot you create with your own token. Ai.ddy encrypts the payload before handing it over, so the message body is not readable in transit or at rest on Telegram's servers. The limit worth knowing: a Telegram bot conversation is not end-to-end encrypted at Telegram's own level, so Telegram can see that two parties exchanged messages, when, and how large they were โ but not what is inside them. No video and no audio is ever sent, only events.
Connect your own key (Gemini, OpenAI-compatible, Anthropic, Qwen, DeepSeek, Groq, OpenRouter, or a custom endpoint) and your questions plus the minimal context needed to answer go directly to that provider, under their privacy policy and your account. Use the on-device model instead and nothing is sent.
Approximate coordinates go to Open-Meteo, a keyless weather API with no account.
Commands go to the address you enter, typically on your own network.
The app fetches the feed URLs you add.
A small HTTP endpoint on your local network, protected by a token generated on the device. Off by default, never reachable from the internet.
Fetches the model file from its publisher.
Section 3Pairing links exactly two phones and both sides take part. Events travel; a live feed does not. Opening the camera for anything beyond motion detection is a separate, deliberate act that the watched phone announces while it happens.
The person holding the watched phone can end the pairing themselves, at any time, without asking the guardian. A link only one side can cut would be surveillance, and that is not what this is.
Section 4Ai.ddy is downloaded and set up by an adult, who then hands the phone to the person it is for. Kid mode is configured by that adult. The app is not directed to children as its audience, and contains no advertising, no in-app purchases and no content feed.
In Kid mode the app reports events to the paired guardian. It does not read browsing history, does not block apps and does not enforce limits: the play window it shows is an agreement within the family, reported by the device rather than policed by it.
Section 5Learned data lives in a local database in the app's private storage. Secrets โ bot tokens, smart-home tokens, AI keys, the pairing key โ are stored with Android's EncryptedSharedPreferences and never logged.
Uninstalling deletes all of it.
Section 7Everything is local: clear the app's storage or uninstall to erase it. Inside the app you can also remove items one by one, end a pairing, disconnect the Telegram bridge, delete your AI key and delete the local model.
Section 8Every permission above is optional. Declining one removes the feature that needs it and leaves the rest working. Each is explained in the app before the system dialog appears.
Section 9Reach out at mk1104@gmail.com
This policy lives in the repository; changes are visible in git history.