What Sakhi records, and for how long

What is stored

Your account

Your phone number, and your name if you give it. You sign in with a code sent to your phone on WhatsApp.

Your emergency contacts

For each person you add: their name, phone number, how they are related to you, and whether they have agreed to receive your alerts.

Your tracking sessions

Where you said you were going and coming from, the kind of vehicle, and — only if you enter them — the registration number and the driver’s name.

Your location while tracking

A position about every twenty seconds while tracking is on, and every few seconds during an alert. This is the most sensitive thing here: together it is a movement history of a named person.

Audio, if you turn it on

Audio is off unless you switch it on before you start tracking. If you do, your phone records for the whole journey — not from the moment you press SOS, because by then the minutes worth having are already past. It records anyone speaking near you, which on a cab ride means the driver. He has no account here and cannot agree to it, so the app shows a card when tracking starts, saying what is happening, for you to show him. While tracking, the audio is also sent live to Sakhi's detection server, where an automated detector listens for calls for help and can raise an SOS on its own.

Ride photos, if you add them

Up to four per tracking session — the number plate, the vehicle, anything. Your contacts see them on the live tracking link, next to the vehicle number. Location details the camera saved inside the photo are removed before upload. They are deleted 24 hours after tracking ends, or after 90 days if you raised an SOS while tracking.

If you become a protector

Your name, whether your identity check passed and when, which kind of ID you used and its last four characters, the checking provider’s reference, whether you are available, your alert area, and your position while you share it from the protector page. Your full ID number, your date of birth and your selfie go to the identity check and are not kept.

Community reviews

The name you type, your rating and your review, shown publicly. Never your phone number. You can edit or delete it.

A record of what was sent

Which message went to which contact and whether it was delivered, so that “your people were told” is something that can be checked rather than assumed.

How long it is kept

Locations recorded during ordinary tracking are deleted after 30 days. Each one is written with its own deletion date and the database removes it on a timer — it is not a job someone has to remember to run, and there is no copy that the timer misses.

Locations recorded during an SOS are the exception: they are kept indefinitely. They are evidence, and a retention policy that destroys the record of the one incident it existed for would be the worst possible outcome of having one.

Audio runs the other way round from locations, and this is the part worth reading twice. A recording is deleted within 60 minutes unless an alert is raised while tracking. The deadline is written when the recording is, so a session you abandon or crash out of still expires. Nobody can listen to any of it in the meantime — not your contacts, not from the tracking link.

If you do raise an alert, that session’s audio is kept for 90 days and your contacts can play it from the tracking link. Marking the alert a false alarm puts it straight back on the 60-minute clock. That window is finite where SOS locations are not, because a recording carries the voice of someone who never agreed to be recorded.

Your account, your contacts and your tracking details are kept until the account is removed. See the last section — removing it is not yet something you can do yourself.

Who else can see it

Anyone holding a tracking link can see the tracking session it belongs to, without signing in. That is the point of it: an emergency contact should not have to create an account while she is frightened. It means the link is the credential, so it is built to be temporary — it stops working 24 hours after tracking ends or the alert is resolved, we store only a keyed hash of it rather than the link itself, search engines are told not to index it, and the page sends no referrer so the link cannot leak to a third party through your browser.

Verified protectors within 3 km can receive your live location, your trip and your vehicle when you choose to alert them during an SOS, or when one of your contacts does. Your contacts can do this unless you turn it off on your contacts page, and changing that setting asks you to confirm. Each protector gets a link of their own that stops working when your alert closes. They never see your audio, your phone number or your contacts. If one accepts, you and your contacts see their name and number.

A mock police test number, shown as Police (mock), receives a copy of every message your contacts receive, including the tracking link. It is a number the Sakhi team uses to check alerts arrive. It is not a police station, and no police are notified.

Nobody becomes an emergency contact silently. Everyone you add is sent one message saying who added them and asking whether they want this. Anyone who opts out receives nothing from then on, including during an SOS.

Depending on how the deployment is configured, two kinds of outside service may be involved: a messaging provider that carries your sign-in codes and the alerts to your contacts’ phones, and a mapping provider that draws the map and finds the nearest police station. Each is optional in the code — with none of them configured the app still runs, the map falls back to a plain drawn route, and messages are written to a log instead of being sent.

What Sakhi does not do

• It does not contact the police, and it does not dial 112.
• It carries no analytics or advertising trackers.
• It does not record video. The camera takes stills only: ride photos, and a protector’s identity-check selfie, which is checked and not kept.
• It does not record audio unless you turn it on before you start tracking, and it never records when tracking is off.
• It does not raise an alarm on its own if your phone goes quiet. A tunnel, a flat battery or a backgrounded tab all look identical to trouble.

What this page cannot tell you yet

Sakhi has no operating entity yet, so this notice cannot name one, cannot name a jurisdiction, and cannot give you a grievance contact — the person the Digital Personal Data Protection Act requires you to be able to write to. It also has no way for you to delete your own account, and no export. Those are not omissions from this page; they do not exist in the product.

Until they do, everything above describes a product that has been built and can be inspected, not a service that has been launched.