Privacy Policy

Esbi is a voice and text assistant for Android, made by StareBrain. You tell it what you want done in plain language — call someone, send a text, set an alarm, open an app, or hand over a whole task in another app — and Esbi does it on your phone. It asks before anything risky, such as sending, paying or deleting, and you can stop it at any time.

Esbi is in early access. This policy covers the Esbi app, your Esbi account and this website. In short: your history and settings are kept on your phone; the words of a command, a short recording of your voice when cloud recognition is used, and a text description of what is on your screen while a task runs pass through our server to AI providers so the command can be understood (sections 04 and 07); and Esbi never reads your photos, videos or documents (section 02).

Esbi never asks Android for access to your photos, videos or documents, and a block list built into the app stops its agent from opening gallery, files and cloud-drive apps. A block list covers the apps it knows about, so we describe it as a strong guard rather than an absolute guarantee.

Esbi does not read, copy, upload or send any of your photos, videos or documents — not to us, not to the AI providers described in section 07, and not to anyone else.

Please note the difference between files and your screen. While a task runs, Esbi reads what is on your screen so it knows what to tap (the “screen log”, section 07). That can include text from other apps, such as messages or emails, including things written by other people. If you type details about a file into a command, that text is treated like any other command text.

To use Esbi you create an account with your email address and a password. You can also add your first and last name, which is used for greetings. If we have switched on invite-only sign-up, you also enter an invite code. Passwords are stored only in hashed form, never as plain text. We use these details to create and secure your account, let you sign in, apply fair-use limits and contact you about your account.

We also keep a simple count of how many requests your account makes each day (for example, how many agent steps), so that free AI capacity is shared fairly. The counts contain no command content.

You can change your name and password, sign out, or permanently delete your account yourself in the app under Settings → Account. Deleting your account removes your account, your usage counts and the feedback you sent from our servers. If you forget your password, contact us (section 16) and we can issue a temporary one.

Access to the app is protected by a sign-in token that expires and is renewed. Your email and password are kept on your phone in Android's encrypted storage so the app can sign you in again. You're responsible for keeping your login details private.

Saying “Esbi” (hands-free mode, which you switch on yourself): a small speech model that runs entirely on your phone listens for the wake word. Nothing is recorded, saved or sent anywhere until it hears “Esbi”. A notification stays visible while it listens. While a task is running it also listens for the word “stop” in the same way, so you can interrupt it.

After the wake word, or when you tap the mic, Esbi listens to your command. It first tries your phone's own speech recognition (provided by Google's speech services on most phones; their terms and privacy policy apply to that audio). If that fails, or if the cloud backup is needed, a short recording of your command is sent to our server and on to a speech-to-text provider (currently Groq or NVIDIA). Along with the recording, the app can send a short list of names — for example your contacts' names, the names of your installed apps and any names you added in Settings — so that names are spelled correctly. We do not keep the recordings after they have been turned into text. The speech providers can see the audio and the name list, and their own terms apply.

Voice lock (optional): if you switch it on, Esbi creates a voice print on your phone so it responds to your voice only. The voice print is stored on your phone only and is never sent to us.

The microphone is not used for anything else, and Esbi does not listen to or record you at other times.

Esbi only uses what you allow in Android's settings. Depending on what you switch on, that includes: your contacts (to find the person you named and to call or text them), your calendar, sending text messages and making calls (only when you ask), the list of installed apps (to open the app you named), and notifications and display-over-other-apps (to show its status card).

To work inside other apps, Esbi uses Android's Accessibility service. With it, Esbi can read the text and buttons on your screen and tap, type and scroll for you while a task runs. It does this only for tasks you start. You can switch the service off at any time in Android settings.

Screen look (off by default): if you switch on “Let Esbi look at the screen”, Esbi may send a picture of the current screen to an AI model for apps that show nothing it can read, never in messaging, email, banking, password, photo or file apps. The picture is not stored by us.

The following is kept on your phone in the app's private storage: your command history and saved answers (deleted automatically after 7 days, or earlier if you use Clear history in Settings), your settings, your name, the corrections Esbi has learned about how your voice is heard, the choices you have made in apps (for example which profile to open), and routines you have taught it. Your voice print, if you use voice lock, is stored there too.

Esbi has no advertising and nothing is sold or shared with advertisers. It has no separate analytics or crash-reporting system in its current design; if we add one, we will update this policy and tell you before it takes effect.

When Esbi needs help understanding a command or working out the next step of a task, the app sends a request to our server, and our server forwards it to third-party AI providers. We currently use Groq, NVIDIA (NVIDIA NIM), OpenRouter, Google Gemini and Ollama Cloud, and we may add or change providers. OpenRouter routes requests on to the underlying model provider it selects, so more than one company may handle a single request.

A request contains the text of your command and, while a task runs in another app, a text description of what appears on your screen (the “screen log”), plus short notes Esbi keeps about the task. It never contains your photos, videos or documents. Because the screen log reflects your screen, it can include whatever is visible there — so avoid having passwords, payment details or other sensitive information on screen while you use the agent.

Simple commands such as calling a contact, setting an alarm, opening an app or changing a setting are handled on your phone and do not need the AI providers.

On our public server we have switched off logging of what you say, type or see: command text, screen content and speech transcripts are blanked out of the server logs, and recordings are not saved. The server still has to read this content to process it, and the AI providers can see it too. We do not control how long they keep it or how they use it; their own terms and privacy policies apply. If you use a test or developer build, its server may log content to help us fix problems.

We run the service with hosting and database providers, currently Render (servers), Neon (account database) and MongoDB Atlas (feedback). They process this data on our behalf.

If you send feedback from Settings, we store your message, the category, an optional star rating, the app version and your phone model. If you leave “include my email” on, we also store your email address and name; if you switch it off, the feedback is stored without them (it is still linked to your account number so we can delete it if you delete your account). Feedback is stored in MongoDB Atlas and is used only to improve Esbi and reply to you.

On your phone: command history and saved answers are deleted after 7 days. Settings, learned corrections and routines stay until you remove them or uninstall Esbi. Deleting data from your phone does not delete what our server has processed or what an AI provider has already received.

On our servers: account details and daily usage counts are kept while your account exists and are removed when you delete it. Feedback is kept until you delete your account or ask us to remove it. Server logs are kept for a limited period needed to run, secure and debug the service, and on the public server they do not contain what you said, typed or saw. Recordings are not kept after transcription.

Website data (waitlist and form submissions) is kept until you ask us to delete it.

This website stores some data on our servers. If you join the waitlist, we store your email address, the role you select (if any), where you signed up (for example, the waitlist page or a pop-up), when you signed up, and your browser's user-agent string. Each person on the waitlist also gets a personal invite code. If you join using a friend's invite link or code, we record which code you used, so we know which member invited you. If you share your link, we can see which of your friends joined with it. If you use the contact or investor forms, we store what you submit (name, email, message, and for investors, firm, role, investor type, and check size) along with your user-agent string.

We use service providers to run the website: hosting (Vercel), a cloud database for form and waitlist data, and an email service to send confirmations. They process this data on our behalf. We send a confirmation email when you join the waitlist or submit a form, and a single email at launch to waitlist members. This data is used only to respond to you and to manage early access. It is not sold.

This website also uses Vercel Analytics and Google Analytics to measure page visits, which may use cookies or similar identifiers. We also run our own simple analytics to see which pages and buttons are used: it records the page you view, which buttons and links you click and roughly where on the page, how far you scroll, how long you actively spend on a page, your device type and browser, the site you came from, and your country (taken from your connection, not stored as an IP address). It uses a random ID kept in your browser's storage rather than cookies, never records what you type, and is switched off if your browser sends Do Not Track. These records are deleted after 180 days. It also keeps a few small items in your browser's own storage — such as your Day/Night choice, whether you've closed the waitlist prompt, and whether you've already joined — purely to make the site behave sensibly. You can clear these in your browser at any time.

Requests between the app and our server, and from our server to AI providers, are protected in transit with TLS. Your sign-in details are kept in Android's encrypted storage on your phone. Passwords are hashed on our server. Sign-in attempts are rate-limited to slow down guessing. Website and account data is stored with our service providers using their standard security measures.

This is standard encryption, not end-to-end encryption: our server and the AI providers have to read the content of a request in order to process it. No system is perfectly secure, and we can't guarantee absolute security.

Everything Esbi can do depends on switches you control in Android's settings and in the app (Settings → Agent settings and the Setup guide). You can revoke any permission at any time; Esbi then stops being able to do that kind of thing. There is no permission that lets Esbi open your photos, videos or documents.

Esbi asks before it sends a text, and the agent always asks before sending, paying or deleting inside other apps. You can switch on “Run commands without asking first” to skip the confirmation card for ordinary commands; it is off by default. A red Stop button on the status card, and saying “stop”, end a running task at any time.

For the data on your phone, you're in control: it's yours to review and delete at any time, and you can delete your account in the app.

For the data we hold — your account details, usage counts, feedback, server logs and website submissions — you can ask us to show you what we have, correct anything inaccurate, delete it, or stop us emailing you. For content that AI providers received, you'd need to contact them under their own policies, though we can tell you which providers we use.

Depending on where you live, you may have additional rights under laws like the GDPR, India's Digital Personal Data Protection Act or the CCPA. We'll honor applicable requests regardless of location where we reasonably can.

Esbi is not intended for children under 13, or under the minimum age required in your country to consent to data processing. We don't knowingly collect personal data from children. If you believe a child has given us data, contact us and we'll delete it.

If this policy changes in a material way, we'll update the date at the top of this page and notify you in the app before the change takes effect. Continued use after that point means you accept the update.

Questions about this policy or your data, including requests to access, correct, or delete your data or to reset a forgotten password, can be sent to starebrain@gmail.com.