Ulak privacy policy
App: Ulak for Android and iOS (dev.ulak.mobile) · Effective: 7 November 2026 · Version: 1
Ulak is a companion app for the self-hosted Ulak workspace. The app connects your phone to an Ulak core that you run on your own computer. This policy covers the app. The core is separate software that you operate, and its own settings decide what it sends where.
Who is responsible
The Ulak project ("we") publishes this app. The Ulak core is operated by you. For the data your core holds, you are the controller; for the crash reports described below, the Ulak project maintains the Sentry project that receives them.
Contact: privacy@ulak-ai.app
What the app stores on your device
- Pairing identity. When you scan a pairing QR code, the app stores the core's identifier, a
device identifier and a device token. The token is kept in the platform secure store — the Android
Keystore or the iOS Keychain with
kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly(no iCloud sync) — and never in a plain file.apps/mobile/src-tauri/src/secure_tokens.rs - App data. Drafts, the outbox, preferences and a cached copy of the core's interface are kept in
the app's private storage. The cache can be refreshed or left alone; it is never uploaded anywhere
except back to your core.
apps/mobile/src-tauri/src/store.rs,apps/mobile/src-tauri/src/offline.rs - App lock. If you enable biometric unlock, the app asks the operating system to authenticate you. It receives only success or failure; it never sees biometric data.
- Notification relay (Android, optional). If you grant the notification-listener permission and
enable relay on your core, the app reads notifications in memory while it is in the foreground and
sends bounded batches to your paired core. It does not write notification text to disk, a journal or
a log, and it drops captures older than two minutes.
apps/mobile/src-tauri/android/UlakNotificationRelay.kt,apps/mobile/src-tauri/src/relay.rs,plugins/phone-relay/server.ts
The app has no account, no advertising SDK, no analytics SDK and no tracking across apps or websites.
What leaves your device, and where it goes
- To your core only. The app connects exclusively to a core you paired, over the routes that core
published (local network, Tailscale or your own relay), and pins the certificate fingerprint from the
pairing QR code. Prompts, files you share, dictation audio and relayed notifications go to that core
and nowhere else from this app.
apps/mobile/src-tauri/src/bridge/ - Dictation. The microphone is used only while you hold the dictation control. The recording is sent to your core for transcription and is not retained by the app.
- Camera. Camera frames are used on-device to read a QR code. They are not stored or transmitted.
- Bluetooth. A proximity session advertises a short-lived session over Bluetooth Low Energy; no location data is collected.
- Your core's own traffic. The core you run may send your prompts and files to the AI providers you configure, and may display web content you ask it to fetch. Those transfers are governed by the core's settings and the providers' policies, not by this app. The app never contacts an AI provider itself.
Crash reports
The app's native shell contains no crash-reporting SDK. The core's web interface, which the app
displays, can send scrubbed error and crash reports and a 10 % sample of performance traces to
Sentry when crash reporting is enabled on the core (it is on by default). Scrubbing removes secrets,
tokens, the bootstrap code, prompt bodies, file contents, home paths and user names before anything
leaves; the reports carry no session replay and no profiling, and sendDefaultPii is off. You can turn
this off at any time in the core's Settings → Privacy & diagnostics; the change applies the next
time the core starts, or set ULAK_SENTRY=0. apps/core/src/telemetry/sentry.json,
apps/core/src/telemetry/sentry.ts, apps/core/src/telemetry/scrub.ts, ADR 004.
Sentry (Functional Software, Inc., USA) processes these reports for us as a service provider. The reports are transmitted over TLS and kept under Sentry's configured retention period.
Legal bases and your rights
Where the GDPR applies, the app's on-device processing is necessary to perform the service you asked for. Crash reports rely on our legitimate interest in keeping the app stable, and you can object at any time by turning crash reporting off. You may ask for access, correction, deletion, restriction or portability of the crash reports we hold, and you may complain to your supervisory authority, by writing to privacy@ulak-ai.app. We cannot access, export or delete data held in your own core; use the core's own export, deletion and backup tools for that.
Retention
App data stays on your device until you forget a core, clear the app's storage or uninstall the app. We hold no account data and no copy of your prompts, files or notifications. Crash reports follow Sentry's configured retention; we do not keep a separate copy.
Children
The app is a tool for operating a self-hosted workspace and is not directed to children under 13 (or the minimum age in your country). We do not knowingly collect data from children.
Changes
If this policy changes materially, we update the version and effective date here and note the change in the app's store listing. The current version is always at https://ulak-ai.app/privacy.