Privacy Policy

1. What JARVOS Does Not Collect

The following data is never sent to JARVOS servers — the one exception is a document you choose to send for remote signature, which reaches our relay end-to-end encrypted (§8). It does reach the services you connect (your mail server, WhatsApp, Google, and a cloud AI provider or the Claude connector if you turn them on — §3, §9) and, as §3a explains, questions that need a web search go to a search engine:

• Email content (subjects, bodies, attachments)
• WhatsApp messages or media
• Contact names, phone numbers, or relationship data
• Documents stored in your local Vault
• IMAP/SMTP passwords (stored encrypted on your computer; the key is in your OS keychain)

2. What We Collect

Account data: When you register, we store your email address, your password hashed with scrypt (never the password itself), your organisation name, and the tier of your subscription. This is necessary to authenticate you and apply the correct feature set to your local application.

Billing data: Subscription and payment processing is handled by Stripe. We store your Stripe customer ID and subscription status. We do not store full card numbers — Stripe holds all payment instrument data on their PCI-DSS compliant infrastructure.

Usage analytics: JARVOS does not send usage analytics. If that changes, they will be off until you turn them on, and this page will say what is sent.

Crash reports: Crash reports are off unless you turn them on in Settings → Security. They are kept on your computer and not sent to us today.

3. Cloud AI Providers

If you configure an Anthropic or OpenAI API key, prompts you send through that path are transmitted to the respective provider and governed by their privacy policies. JARVOS does not proxy or log these requests — they go directly from your machine to the provider's API.

With local AI, the model runs on your machine; only web-search questions leave it (§3a).

3a. Web Search

When a chat question needs current information, JARVOS sends the question to a web search service — Brave if you add a key, otherwise public SearXNG servers or DuckDuckGo — and fetches the result pages. A follow-up is first rewritten to stand on its own, so it can include words from earlier in the chat. For ‘weather here’, your approximate location is looked up from your IP address at ipinfo.io. The AI that writes the answer runs on your machine.

4. WhatsApp Bridge

Personal tier: The whatsapp-web.js bridge connects directly to WhatsApp's servers from your machine — no relay through JARVOS infrastructure. Messages are stored in your local database.

Business tier (coming soon): Meta delivers messages to a JARVOS relay that passes them to your computer without storing them.

5. Data Retention

Your local application data is yours entirely — it lives in a SQLite file on your machine. You can delete it, back it up, or migrate it at any time.

Account data (your email, organisation, plan, devices and referrals) is kept while your account exists. You can download a copy at any time, and delete your account yourself, at jarvos.site/accountunder “Your data”. If you cannot sign in, email support@jarvos.site.

Deleting your account is completed within 30 days.

• When you delete it, you are signed out everywhere and your subscription ends immediately. Any unused portion of it is forfeited and is not refunded.
• For the next 30 days the account is kept but cannot be used. During that time only our support team can restore it, if you ask at support@jarvos.site; you cannot restore it yourself, and a restore does not restart the subscription. You can download your data only before you delete the account.
• After 30 days your account, organisation, plan, devices and referral code are erased from our database, and your Stripe customer record is deleted. If you are a member of a team, only your own account is erased; the team and its plan stay.
• We keep a deletion record with no email address in it: the date, your Stripe customer number, your plan, and when you confirmed the no-refund notice. We use it only to answer payment disputes and for tax records.
• We keep a one-way keyed hash of your email address (lowercased, with any “+tag” removed) for 90 days from the day you delete the account, then erase it. Its only use is to stop the same address getting a second free trial. You can still sign up again and pay.
• Stripe keeps your invoices and payment records, because tax law requires them.
• Copies of our database in server backups are not edited after a deletion. They are kept only to recover from a failure and are overwritten in time.
• Nothing on your computers is touched. Your local data stays until you delete it.

6. Third-Party Services

• Stripe — payment processing
• Crisp — support chat (only loaded on jarvos.site, not in the desktop app)
• jarvos.site — application downloads

7. Security

IMAP/SMTP passwords are encrypted with AES-256-GCM using a key stored in your OS keychain (Windows Credential Manager, macOS Keychain). They are never written to disk in plaintext and sent only to your own mail server when JARVOS signs in.

8. Remote E-Signature (opt-in only)

Sending a Secretary document for signature to an external recipient is off by default. It only works after you explicitly enable Remote Signing in Settings → Security. When enabled, sending a document uploads it to a JARVOS relay so the signer can open it from a link.

The document is end-to-end encrypted before it leaves your machine: the decryption key travels in the link you send the signer and never reaches our servers, so JARVOS cannot read the document even though an encrypted copy transits our relay. That copy is deleted after signing (and at most 48 hours regardless). Documents you do not send for remote signature never leave your machine.

9. Claude Cowork Connector (opt-in only)

The Claude Cowork connector is off by default. It only runs after you explicitly enable it in Settings → Security and configure it. When enabled, it lets Claude (running in Anthropic’s cloud) read your recent mail, contacts and CRM pipeline from your machine on request.

Whatever Claude requests through the connector is sent to Anthropic and governed by Anthropic’s privacy policy. Unlike remote e-signature, this data is notend-to-end encrypted — it is the readable content of the records Claude asked for. JARVOS does not proxy, store, or log connector traffic; the request goes from your machine to Anthropic. It reads by default. If you also allow actions, anything Claude drafts or sends waits for your confirmation in Settings → Security. Turning it off invalidates its access token immediately.

10. Contact

Privacy questions: privacy@jarvos.site

General support: support@jarvos.site