Privacy policy
Sahkarmi is a free, open-source desktop app for Windows. It keeps your coworkers, chats and files on your own computer. There is no Sahkarmi account, no Sahkarmi cloud and no analytics in the app. This page explains exactly what is stored, what leaves your computer, and where it goes.
Last updated: 26 October 2026. This policy covers the current Sahkarmi Windows app (version 0.12) and the website sahkarmi.site.
- In short
- Stored on your PC
- What leaves your PC
- AI providers
- What coworkers can do
- Telegram
- This website
- Delete your data
- Changes
- Contact
In short
- Sahkarmi has no account, no cloud service, no telemetry and no analytics. The Sahkarmi Team cannot see your coworkers, chats, files or settings.
- Your data is stored as files on your computer, inside your Windows user profile.
- When a coworker works, the text and files it needs go to the AI provider you chose for it, under that provider's terms.
- The app also talks to GitHub (updates), the npm registry (AI tool downloads), and to the websites and services you or your coworkers use.
- The website counts clicks on Download buttons without cookies or a visitor ID, and does not count at all when your browser asks not to be tracked.
What the app stores on your computer
Everything below stays on your PC. Sahkarmi does not copy it anywhere. The files are ordinary files under your Windows user account, so anyone who can sign in to Windows as you can read them. Sahkarmi does not add its own encryption.
| Folder | What is in it |
|---|---|
%APPDATA%\Sahkarmi | App settings, your coworkers and their instructions, chat history and message queues, approvals, schedules and routines, copies of attachments you add to a chat, the shared browser profile (cookies and website logins), and logs (logs\sahkarmi.log). If you connect Telegram, telegram.json holds your bot token and the paired chat. If you add a Composio key in Marketplace, Apps, the key is saved here too. |
%USERPROFILE%\Sahkarmi\Coworkers | One working folder for each coworker. |
%USERPROFILE%\Sahkarmi\Shared | Files shared by the whole team, including skills and playbooks in Shared\Skills. |
%USERPROFILE%\Sahkarmi\Downloads | Files downloaded in the built-in browser. |
%LOCALAPPDATA%\sahkarmi-updater | Downloaded app updates. |
Attachments copied into Sahkarmi stay in its storage even after you move or delete the original file. All coworkers share one built-in browser profile, so a site you sign in to is signed in for every coworker.
Sahkarmi never copies or manages the logins of the AI tools it uses. %USERPROFILE%\.codex belongs to the Codex CLI and %USERPROFILE%\.claude belongs to Claude Code. Sahkarmi only uses the sign-in those tools already have.
Logs can contain the email address of a connected provider account. Settings, Data & privacy, Export diagnostics makes a redacted bundle with versions and capability states and no conversation content. Remove anything personal before you share a log in public.
What leaves your computer
Sahkarmi does not open a port for other computers to connect to. It does connect out to these places:
| When | Where it goes | What is sent |
|---|---|---|
| A coworker works on a task | The AI provider you chose for that coworker | The messages, instructions and files the coworker needs. See AI providers. |
| Checking for app updates | GitHub Releases (github.com) | A normal download request. Updates are downloaded from GitHub. |
| Installing or updating AI tools | The npm registry (registry.npmjs.org) | Download requests for AI tool runtimes such as OpenCode, Claude Code and Codex, and other agents you choose to connect. |
| Connecting Google Antigravity | Download of Google's Antigravity agent after you accept Google's terms, then Google's own sign-in. | |
| Downloading a voice model (Settings, Voice) | Hugging Face (huggingface.co) | A download request, only when you choose a model. After that, dictation runs on your PC and your voice does not leave it. |
| Using the built-in browser | The websites you or a coworker open | What any browser sends: your IP address, cookies for that site, and what you or the coworker type into the page. |
| Marketplace, Apps (optional) | Composio (composio.dev) | App logos load from logos.composio.dev when you open the Apps tab. If you add your own Composio key, coworker actions on your connected apps go through Composio under its terms. |
| Telegram chat (optional) | Telegram (api.telegram.org) | See Telegram. |
| You click an outside link | That website, in your normal browser | A normal page visit. |
Nothing in this list goes to the Sahkarmi Team. The app sends no usage statistics, crash reports or analytics.
AI providers
Each coworker uses one AI provider: OpenCode's free models (built in), Claude, ChatGPT (Codex), Google Antigravity or Gemini, or another agent you connect. When a coworker thinks, the text and files it needs are sent to that provider. The provider handles them under its own terms and privacy policy, and with your own account where you signed in. Sahkarmi does not control what the provider stores or how long it keeps it. Read the provider's policy before you give a coworker private or customer data.
Usage limits shown in Sahkarmi are read from the provider on your computer. They are not sent to the Sahkarmi Team.
What coworkers can do on your computer
Please read this part carefully. Coworkers are AI agents with real access to your PC. They can:
- read, create, change and delete files on your computer;
- run programs and commands;
- use the internet;
- control the built-in browser, including sites where you are already signed in.
The Permissions page in Settings sets how much they may do on their own. Coworkers are told to stop and ask you before payments, messages to customers, publishing and form submissions. Today that depends on the AI model following its instructions; it is not a hard technical block. Keep backups. Do not give a coworker a task you would not trust a command-line tool to do. Never give card details, passwords or OTPs to a coworker in chat: type them yourself with Take over or in the secure password card.
Telegram (optional)
If you connect Telegram in Settings, Telegram, Sahkarmi talks only to api.telegram.org using the bot you created in @BotFather. Your messages to the bot and the coworker's replies pass through Telegram's servers, under Telegram's privacy policy. Only the one chat you paired is answered. New approvals are announced there, but you still allow or deny them in the app. The bot token and the paired chat are saved in %APPDATA%\Sahkarmi\telegram.json. Disconnect in Settings, Telegram removes the token.
This website (sahkarmi.site)
Hosting
The website is a static site hosted on GitHub Pages. GitHub may log information about visitors, including IP addresses, for security and operation. See the GitHub General Privacy Statement. Installer downloads are also served by GitHub.
No cookies, no analytics
The website sets no cookies and loads no analytics or advertising scripts. Fonts, images and the explainer video are served from sahkarmi.site itself.
Download click count
When you click a Download button, the page sends one small message so the team can see how many people download Sahkarmi. It goes to a Google Apps Script web app run by the Sahkarmi Team, which emails the click to the team. Google handles this under the Google Privacy Policy. The message contains only:
- the installer file name and version, and which button was clicked;
- your operating system, browser and device type, estimated from the browser's user agent (the user agent text is included, shortened);
- the page language, your browser languages, time zone and screen size;
- the website that linked you here (if any) and campaign tags in the page address (
utm_tags andref).
It contains no cookie, no visitor ID and no data taken from your IP address. Country is estimated from the time zone; city is never collected. Nothing is sent when your browser has Global Privacy Control or Do Not Track turned on. The count never delays your download. A click is not a finished download, because browsers do not report that.
Links to other sites
Links to GitHub, LinkedIn, Facebook, Instagram, WhatsApp and AI providers open their own sites, which have their own privacy policies.
Delete your data
- Quit Sahkarmi.
- Uninstall it: Windows Settings, Apps, Installed apps, Sahkarmi, Uninstall. This removes the program only.
- To remove your data, delete
%APPDATA%\Sahkarmi(coworkers, chats, settings, browser cookies and logins, logs, Telegram token),%LOCALAPPDATA%\sahkarmi-updater(downloaded updates) and%USERPROFILE%\Sahkarmi(coworker folders, Shared files and Downloads). - If you connected Telegram, you can also revoke the bot token in @BotFather.
- Data sent to an AI provider, Composio or Telegram is held by that service. Use its own controls to delete it.
Check the folders and keep a backup of anything you need before you delete them. Deleted data cannot be brought back from a Sahkarmi cloud, because there is none. Sahkarmi does not delete .codex or .claude; use each tool's own controls for those.
The download click emails carry no name or visitor ID, so the team cannot find one person's clicks in them.
Changes to this policy
When the app or the website changes what it stores or sends, this page is updated and the date at the top changes. Earlier versions can be seen in the history of this page on GitHub.
Contact
Ask privacy questions in GitHub Discussions. Report security problems privately as described in SECURITY.md. Do not attach passwords, tokens, chats or private files.