Privacy
Chitti's whole design is built around keeping your data on the phone. Here's exactly what that means — what never leaves the device, the only three cases that touch the network, and precisely what the backend can see.
Stays on the phone
The language model, speech recognition, and notification processing all run on the phone.
ID document scanning and parsing happen on-device; the vault is kept behind your fingerprint lock.
Touches the network — only these three cases
Handled via Firebase Authentication.
The phone derives a key from a password you choose (PBKDF2-HMAC-SHA256 → AES-256) and encrypts the backup before it leaves the device. The server stores ciphertext only, in MongoDB GridFS, plus the public KDF parameters (salt, iteration count) needed to re-derive the key. Each account keeps only its latest backup.
Only the link itself is sent, to Google Safe Browsing.
What the backend can actually see
| Category | What is stored |
|---|---|
| Per account | Firebase uid, email address, whether it's verified, display name, sign-in provider, account creation time, and last login time. |
| Per backup (only if you make one) | Its size, the SHA-256 of the ciphertext, upload time, KDF parameters (algorithm, iteration count, salt), and the device name you supplied. |
| Access boundary | Every route acts only on the caller's own token's uid — one account can never reach another account's data. |
| Request logs | Only request id, method, URL, status, and timing — never headers or tokens, bodies, or backup contents. |
If you forget your backup password, the backup can't be recovered.
That's the stated cost of end-to-end encryption — not even the server operator can decrypt it.
Your controls
Any kind of stored data, or all of it, can be cleared from Settings.
App lock can require your fingerprint.
Deleting your account removes the user record and the backup together.
Terms, briefly
Chitti was built by Owl Coders for the iQOO Hackathon 2026 and is provided as-is, with no warranty. The repository does not currently publish a formal software license — check the repo for anything more recent. Questions about privacy or this project can go to chittibot7@gmail.com. Full terms are on the Terms & Conditions page.