Probably bad stuff.

This appears related to Quo, since the JSON schemas point there.

They use a broker, a MITM for AI requests, which filters out sensitive data before it goes to OpenAI, but not before it’s at their server.

You can see the URL Android calls here: https://github.com/secondly-com/OpenPhone/blob/83e31fd6ec9da94ba299465fc28ad7c6aa677326/overlay/packages/apps/OpenPhoneAssistant/src/org/openphone/assistant/state/AssistantViewModel.kt#L175

The MITM Python server here: https://github.com/secondly-com/OpenPhone/blob/83e31fd6ec9da94ba299465fc28ad7c6aa677326/services/model-broker/openphone_model_broker.py

The tests of the middleman: https://github.com/secondly-com/OpenPhone/blob/83e31fd6ec9da94ba299465fc28ad7c6aa677326/scripts/smoke-test-model-broker.sh

And the nginx proxy and full deployment, in case you want to do some self-spying: https://github.com/secondly-com/OpenPhone/tree/83e31fd6ec9da94ba299465fc28ad7c6aa677326/services/model-broker/deploy

Edit: Keep in mind this is the public facing version. OTA updates are prebuilt from who knows where, and the broker may have more code than is in the public Python file.