🪔 Welcome to Chitti Vaani — let's set up your device
Three quick screens. After this Chitti will know your name, your device, and your trusted channels — and won't ask again on this phone.
1
2
3
📱 Your device
Helps Chitti tailor instructions for your phone (e.g. Samsung's One UI vs Xiaomi's MIUI handle Silent mode differently).
Don't know? Settings → About phone → Android version.
🔐 Verify you
Lets Chitti greet you by name and reach you via SMS / Gmail. Stored only on this device — never sent to a third party.
🛡️ Permissions Chitti will ask for
You'll be asked in the Android app when each capability is first used. Untick anything you don't want — Chitti will simply not offer that feature. Chitti never unlocks your phone (Android does not allow it).
📞 Calls
"Mom ko call karo" → Chitti dials directly via your SIM (web tier opens the dialer pre-filled).
💬 SMS
"Mom ko SMS karo" → Chitti sends SMS from your SIM. No server-side cost — your carrier rates apply.
📲 WhatsApp
Open WhatsApp chats / calls pre-filled with the message or recipient. Send-tap happens inside WhatsApp.
📧 Gmail
Send mail on your behalf via your own Gmail account — Chitti AI signature auto-appended.
🎬 Media apps
"YouTube par bhajan chala" / "Spotify kholo" — Chitti launches the right media app.
🔒 Device Admin
Required ONLY to lock the phone on your voice command. Chitti can never unlock — Android refuses.
📂 Files & folders
Read documents you point Chitti at (e.g. "read this PDF aloud"). Uses Android's secure file picker — Chitti never browses on its own.
🪔
…
Say haan / yes to confirm, or nahi / no to cancel.
🎙️ Chitti is listening for your answer…
🔐 Keys Vault — 3rd backup
After 1Password + Google Keep · AES-256-GCM · localStorage only · never sent to any server
First time — set a master passphrase (≥8 characters; longer is better). You'll need this passphrase every time you open the vault. It is not stored anywhere — losing it = losing every key in the vault.
Pick a strong passphrase. A 4-digit PIN is brute-forceable in hours even with AES-256. Use a sentence with mixed case, numbers, symbols — e.g. Bharat-AI-2026-loves-chitti!
Enter master passphrase to unlock. 3 attempts available.
No keys yet — switch to "➕ Add".
⚠️ The value is encrypted before it touches localStorage. The plaintext exists in this textarea only while you type it.
No file selected.
📎 The file bytes are base64-encoded then AES-256-GCM encrypted before storage. Ideal for the release keystore (release.jks, ~3 KB). Do not use this for large documents — Health File is the right tool for those.
Export packages the entire encrypted blob as a base64 string. Same passphrase still required to import on another device.
Paste an exported backup below to restore. The passphrase you used to export must match.
🔐 Biometric unlock
Wrap your master passphrase under the device's biometric authenticator. After enrolment, you can unlock with fingerprint / face instead of typing the passphrase — but the passphrase is still always the fallback.
Checking biometric availability…
How it works
Android APK (chitti-vaani-android): a 256-bit AES key is generated inside the Android Keystore (TEE-backed) with setUserAuthenticationRequired(true) + setInvalidatedByBiometricEnrollment(true). The Keystore wraps your passphrase. Every unlock triggers BiometricPrompt → fingerprint touch → unwrap. Enrolling a new fingerprint on the device invalidates the wrap key — you'll be prompted to re-enrol.
Web (Chrome / Edge): uses the WebAuthn PRF extension. The platform authenticator (Touch ID, Windows Hello, Android-Chrome platform key) deterministically returns 32 bytes per (credential, salt) — those 32 bytes become the AES-256 key that wraps your passphrase. Available where browser + OS support PRF; honest skip-with-message otherwise.
iOS Safari: WebAuthn PRF support is partial / new — the page falls back to passphrase-only.
What it costs you
If you lose the device AND have not exported the vault to Google Keep / 1Password, biometric unlock is gone with it. The encrypted blob may survive in browser sync if you're signed into Chrome — but without the wrap-key (held in the device's TEE) you'll fall back to passphrase. So: keep the export current.
⚠️ What this vault DOES and DOES NOT protect against
WHAT IT PROTECTS
Device-loss + casual snooping. Someone who picks up your unlocked phone cannot read the secrets without the passphrase.
localStorage dump via DevTools. The values are AES-256-GCM ciphertext + a random salt + a random IV. PBKDF2-SHA256 600 000 iterations stretches the passphrase before key derivation.
Cross-site scripts in OTHER tabs. localStorage is per-origin; only sahayai.in can read it.
WHAT IT DOES NOT PROTECT
Weak passphrase. A 4-digit numeric PIN ≈ 10 000 combinations → brute-forced in minutes locally. Use a passphrase with mixed case + numbers + symbols, ≥12 chars.
XSS in sahayai.in. If any third-party JS is ever loaded on this origin, it can read localStorage. Today we host no third-party JS; future code must keep it that way.
Malicious browser extension. Extensions with "read on all sites" can dump localStorage. Use a clean browser profile for vault access.
3-strikes lockout is client-side. An attacker with DevTools can clear the lock-until flag from localStorage and retry. It deters casual snoopers, not motivated attackers.
Screenshot block (FLAG_SECURE) only works inside the Chitti Vaani Android APK. On the browser, the OS may screenshot — recommend using the APK on shared devices.
Rooted device / malware. Any code with debugger access can dump memory while the vault is unlocked.
WHY YOU STILL WANT THIS
It is the 3rd backup after 1Password and Google Keep — defense in depth. If 1Password locks you out and Google Keep is unreachable, this is the third door home. Never make it the only door.
BIOMETRIC UNLOCK ADDED 2026-05-23
Android APK path is gold-standard. AES-256-GCM wrapping key lives in Android Keystore inside the secure enclave with setUserAuthenticationRequired(true). Every unwrap requires a fresh fingerprint / face touch via BiometricPrompt. setInvalidatedByBiometricEnrollment(true) means enrolling a new fingerprint on the device wipes the wrap key — preventing an attacker who jailbreaks the device + adds their fingerprint from unlocking the vault.
Web path uses WebAuthn PRF extension. Deterministic 32-byte output per (credential, salt) from the platform authenticator (Touch ID / Windows Hello / Android-Chrome). The wrap key never leaves the authenticator. Available where browser + OS support PRF; honestly refused otherwise (no weaker fallback).
Passphrase is always the fallback. Biometric unlock NEVER bypasses passphrase capability — the passphrase still works on any device, even one without a fingerprint reader.
Loss model: if you lose the device AND have no export backup, biometric unlock is gone with it. The encrypted blob may sync via Chrome account sync — but without the wrap key (held in the device's TEE), you'll need the passphrase. Keep the export current.
KEYSTORE FILE BACKUP ADDED 2026-05-23
Same AES-256-GCM pipeline encrypts file bytes (max 256 KB per file). Ideal for the ~3 KB Android release keystore. The exported backup string includes the file blob, so a fresh laptop + your passphrase = full keystore recovery. Don't use this for arbitrary documents — Health File is the right product for those.
Chitti Vaani — Terms & Conditions
First time using Chitti Vaani? Please read each section. Tap 🔊 to hear it spoken in your language. Then tap I AGREE to start.
Read aloud in:
1What Chitti Vaani is (and is not)
Chitti Vaani is a voice-first AI helper. You speak, Chitti listens, Chitti speaks back. Chitti is not a doctor, lawyer, banker, or government officer. Chitti gives general information only.
2Legal compliance
Chitti Vaani complies with the Digital Personal Data Protection (DPDP) Act 2023, TRAI rules on call recording, and the IT Rules 2021. Your voice never leaves your device unless you tap "Send to Chitti". Recordings are not stored on our servers.
3Permissions required
Microphone — to listen when you tap the green mic.
Read call logs (Phase 2 mobile app only) — to summarise calls you ask about.
Read contacts (Phase 2 mobile app only) — only when you ask "call my doctor".
The web version (this page) only uses the microphone, and only while you hold the mic button.
4Data privacy
Chitti does not sell your data. Chitti does not share your voice or text with advertisers. Your conversation history lives in your browser (localStorage) — clear it any time from Settings.
5Emergency & liability
If this is a medical, fire, or police emergency — call 112 right now. For cyber-fraud call 1930. Chitti cannot guarantee any medical, legal, or financial outcome. Final decisions are always yours, ideally with a qualified professional.
6Grievance redressal
Issue or complaint? Email sire@sahayai.in. We respond within 7 working days as required by the IT Rules 2021.
🎙️ Voice grant — for blind / mute / illiterate users
Instead of reading and tapping, you can say "haan" (or "yes" / "main maan gaya" / "theek hai"). Chitti will mark your consent the same way as a tap. This is the default for users who cannot read.
Tap the green button and say "haan".
🎙️
Chitti Vaani
Voice-first assistant for Bharat · Speak, listen, summarise.
हरे माइक को टैप करें। अपनी भाषा में बोलें। Chitti सुनती है, सोचती है, और उत्तर ज़ोर से पढ़ती है।
Bolne ke liye tap karein.Chitti aapki bhasha mein jawaab degi aur padh ke sunayegi.
🪔 Chitti says
⚡ Quick actionstap to expand
⚡ Quick actions
One tap. Chitti will ask the right follow-up question.
🕘 Recenttap to expand
🕘 Recent
Stays only on this device. Not synced. Tap 🔊 to hear an old answer.
🛡️ Chitti can act for you 📱 some need Android Phase 2
Tap a card. Speak in your language. Chitti drafts, reads it back, then acts only after you say "haan". Every action is logged below — undo within 30 seconds.
👨👩👧 Trusted Circle
People Chitti can contact for you. Built by voice — speak the name, the relation, the number. Inside this circle Chitti acts after one voice "haan". Outside it, Chitti pauses and asks first.
🔔 Reminder channels
Verify the contact methods Chitti is allowed to use for reminders. Verify-then-grant: enter a number / email, Chitti sends a code to that number / inbox, you read the code back. Once verified, Chitti can send a reminder to that channel — and only that channel.
📲
WhatsApp Not verified
Reads back a 6-digit code from WhatsApp — Chitti uses the same number for reminders.
💬
SMS Not verified
Reads back a 6-digit code from the SMS — Chitti uses the same number for reminder texts.
📧
Email Not verified
Reads back a 6-digit code from your inbox — Chitti uses this address for reminder emails.
⚠️ Verification is in honest demo mode — the WhatsApp / SMS / email sender providers are not wired yet (Phase 2.7). Until then, every code Chitti "sends" is the same: 123456. Enter that to complete the flow + see how it'll work once the SMS / WhatsApp Business / Gmail providers are connected. We do not pretend a real message went out.
📁 Chitti Document Vault
Aadhaar · PAN · Passport · Driving Licence · insurance · property papers · contracts. Encrypted on Chitti's server with a key only your phone knows. Chitti never shares any document without asking you first — every share shows "Sahab, aapka [doc] [person] ko bhejna hai — theek hai?"
📭 No documents yet. Tap 📤 Upload document to start. Speak the document's name and category — Chitti will tag and store it encrypted.
🔗 Chitti-to-Chitti emergency pairs
Pair this device with your spouse / children / caregivers' Chittis. When emergency keywords fire here, their Chitti rings — even on silent. Family-only relay. Chitti will never auto-call cops.
📜 What Chitti did for you
Every action — email sent, WhatsApp drafted, UPI opened, voice sample saved — appears here. Tap 🔊 to hear the list. Each row has an UNDO option for 30 seconds.
⚙️सेटिंग्स
🔋Chitti Battery
100%
~500 queries left ·
Est. 30 days
हर सवाल के टोकन Chitti के server पर खर्च होते हैं — Top-up से aage और सवाल पूछ सकते हैं।
📤Chitti Share करें
🛡️Privacy & डेटा
✅Microphone
✅Contacts
✅Storage
⚪Location
🪔सभी Chitti products
Card tap करें → expand · 🔊 = सुनें · ▶ Demo · 👍 = pasand · 👎 = इस card को feedback दें
🔧General
Chitti Vaani · v1.4 · 2026-05-23
🚨 Aapatkaal · Emergency
Tap karein — Chitti aapke parivaar ko ring karega. Phone silent par ho toh bhi.
Chitti family-cascade pehle. Cops ka button hai — par Chitti khud kabhi cops ko nahi karegi.
📱 Open Chitti on phone
Scan with any phone camera — Chitti opens in the browser. No app install needed.
https://sahayai.in/chitti_vaani.html
🪔
Chitti se milye
Aapki bhasha chunein
🎙️Chitti sun nahi payi — dobara bolein
📞 Make a call
Pick a person from your trusted circle, or speak the name. Chitti reads it back, you say "haan", the phone dials. Inside the Android app, Chitti can dial directly without a tap.
On the web, Chitti opens your dialer pre-filled — you tap call. On the Android app (Phase 2), Chitti dials directly with the CALL_PHONE permission. Chitti always announces "I am Chitti AI calling on behalf of [user]" if it speaks during the call.
📲 Send WhatsApp
Speak the recipient and the message. Chitti will read back, you say "haan", WhatsApp opens with everything filled in.
Chitti drafts and opens WhatsApp pre-filled. You tap the green ➤ inside WhatsApp to actually send. (Phase 2 Android: Chitti taps for you.)
💬 Send SMS
Speak the recipient and the message. Chitti reads back, you say "haan", your phone's SMS app opens pre-filled. On Android (Phase 2), Chitti sends directly via the phone's SIM.
Chitti opens your phone's SMS app pre-filled — you tap send. On the Android app (Phase 2), Chitti sends directly via the SIM with the SEND_SMS permission. The SMS goes from your number, not from a server, so no carrier costs to Chitti and no provider sign-up needed.
💸 Send UPI payment
Speak the recipient and the amount. Chitti opens your UPI app (PhonePe / GPay / Paytm) with everything pre-filled. You enter PIN inside the UPI app — NPCI rule, no shortcut.
Chitti will NEVER ask for or store your UPI PIN. PIN entry happens only inside the UPI app's secure keypad. Voice-biometric PIN is a v2 feature, requires bank partnership.
📧 Send email as Chitti AI
Chitti will send from your real Gmail account, on your behalf. Every email carries a footer identifying it as AI-assisted. Connect Gmail once, then voice-command works forever.
⏳ Checking Gmail connection…
Footer auto-appended: "Sent via Chitti Vaani — an AI assistant for [your name]. Replies do not pass through Chitti."
🎬 Play on YouTube
Speak the song / artist / topic. Chitti reads it back, you say "haan", YouTube opens with the search results. (Phase 2 Android: Chitti taps the first result.)
Web → opens youtube.com/results?search_query=…. Android (Phase 2) → opens the YouTube app via Intent.
🎵 Play music
Speak the song or artist. Chitti opens YouTube Music with the search filled in. Inside the Android app, Chitti can hand off to the system music app.
Web → opens music.youtube.com/search?q=…. Native bridge — if Chitti is hosted by an Android app with openMusic(query), that wins.
📺 Play a video
Speak what you want to watch. Same as YouTube but tuned for long-form content — Chitti appends "full video" to the query so you get a real video, not a Shorts clip.
Web → opens youtube.com/results?search_query=…+full+video. Android (Phase 2) → opens the first result automatically.
📞 WhatsApp call
Speak the recipient. Chitti reads back, you say "haan", WhatsApp opens its call screen with that contact. Voice calls work over Wi-Fi (free); video toggle is inside WhatsApp.
Web uses wa.me/{number}?call=1 — opens WhatsApp on the contact, you tap the call icon to start. Phase-2 Android can auto-arm the call icon via the accessibility helper (same 2-second window as the WhatsApp-send card).
🧩 Open any app
Say the app name — "BookMyShow", "Zomato", "Spotify", "Gaana", "JioSaavn", "MakeMyTrip" — Chitti launches the app on Android, or opens its website here.
Native (Android app) calls ChittiNative.openApp(packageName) — if the app isn't installed, Chitti drops you into the Play Store entry so one tap installs it. Web fallback opens the canonical website (no install needed).
🗺️ Directions / Maps
Speak the place — clinic, station, ATM, school, anywhere. Chitti opens Google Maps with the destination filled in.
Web → opens google.com/maps/dir/?destination=…. Android → opens the Maps app via geo: intent.
🔎 Search the web
For anything Chitti can't answer offline. Speak your question — Chitti opens Google with the query.
Web → google.com/search?q=…. Honest: Chitti can't read the result page for you (yet) — that's Phase 2 Android (screen-reader bridge).
🚶♀️ SafeWalk mode
Set a check-in timer. Chitti will ask "Aap theek hain?" on a schedule. If you don't say "haan" within the window, Chitti shares your live location with your Trusted Circle and rings their phone. Never auto-dials cops.
Hold Ctrl / Cmd to pick more than one. Empty = all of Trusted Circle.
Spec §5.3: SafeWalk + Fake call are women's-safety / night-walk tools. Cascade reuses the existing emergency family-fan-out — Chitti NEVER auto-dials 112 / 100 / 102. Stop by saying "main theek hun" or tapping Cancel.
📍 Share my live location
Chitti reads your GPS, packages it as a Google Maps link, and sends it to whoever you pick. Voice consent every time.
Web uses navigator.geolocation — your browser will ask for location permission once. Chitti packages the lat/lng as maps.google.com/?q=<lat>,<lng> and hands it to WhatsApp / SMS app pre-filled. Chitti never stores your location.
🏥 Medical ID
First-responder-facing info. Stored only on this device. Chitti reads it aloud on command + (Android app) surfaces it on the lock screen via the system Emergency Info contract.
Saving is a local-only action — no Golden Rule confirm needed (you're editing your own data, not acting on the world). Reading aloud + sending to another person DO go through Chitti's confirm.
🏪 Nearest hospital / chemist
Chitti opens Maps with a category search, scoped to your location.
Search format: {kind} near me in Google Maps. Add "24 hours" suffix when "open now" is on.
⏱️ Remind me
Tell Chitti what to remind you about, and when. On the Android app, Chitti schedules a phone notification at that time. On the web, Chitti speaks the steps so you can save it yourself. Phase 2.7 adds SMS + WhatsApp + email channels.
SMS / WhatsApp / Email need to be verified in the 🔔 Reminder channels section below first.
Android (today): WorkManager fires a high-priority notification on the lock screen at the scheduled time. Web (today): step-by-step alert + speech walks you through saving it in your calendar / clock app — browsers cannot fire cross-session notifications without persistent permissions you have to grant explicitly. Phase 2.7 brings the SMS / WhatsApp / email channels online once Gmail OAuth + the SMS opt-in flow land.
⏰ Set alarm
Pick a time and a label. On Android (Phase 2), Chitti opens the clock app via Intent with the alarm pre-filled. On the web, Chitti walks you through the steps.
Android intent — android.intent.action.SET_ALARM — opens the clock app with the time + label pre-filled. Web fallback shows step-by-step.
📤 Upload to Document Vault
Snap a photo or pick a PDF. Chitti tags it, sets an expiry, and stores it encrypted. You — and only you — can read it back from your phone.
Encrypted with a key derived from your device — Chitti CANNOT decrypt without your phone in the loop. Expiry reminders fire 30 / 7 / 1 day before the date.
📨 Share document — confirm
Chitti is about to attach the file to a WhatsApp / email draft. You confirm once. Chitti never shares again without asking.
Audit: every share is logged with the doc name, target, and a one-shot 30-minute token. Recipient cannot re-fetch after consumption.
👨👩👧 Add a trusted person
Speak: "Mom — Sushma Devi — phone 9876543210 — UPI sushma at oksbi". Chitti will fill the boxes. Or type each field.
🌐 Teach Chitti your language
Speak in Bangla / Tamil / Telugu / Marathi / Gujarati / Kannada / Malayalam / Punjabi / Odia. Chitti records the sample on your phone (not on the server) and uses it later to train her voice in that language. Federated learning — the audio never leaves your device unless you tap upload.
After 6–12 months of regular samples (1–2 sentences a week per language), Chitti will speak that language back. Today the samples sit in IndexedDB on your phone only.
STAGE 1 / 3 — CONFIRM WITH MASTER
🚨 EMERGENCY DETECTED
Master, are you OK? Say "theek hun" or tap I'M OK.
10
If no response in 10 seconds, Chitti will ring the alarm and call your spouse. Chitti will never call the police automatically.
📤 Your pair code
Read this 6-digit code aloud to your spouse / family member. They enter it in their Chitti. Code expires in 5 minutes.
— — — — — —
📥 Enter partner's code
Type the 6-digit code your partner read out, then a label so you know which Chitti this is (e.g. "Mom", "Spouse").
📱 Open on phone
Scan to open Vaani on your phone. Voice-first. Free. Works in 26 Indian languages.