Last updated: May 2026
Short version: JARVOS is a local-first desktop application. Your emails, contacts, and documents are stored on your machine and never transmitted to JARVOS servers. We collect only what is necessary to operate your account and subscription. A few features send data elsewhere only when you turn them on — a cloud AI key (§3), remote e-signature (§8), and the Claude Cowork connector (§9).
The following data never leaves your machine and is never transmitted to JARVOS servers (the opt-in exceptions in §3, §8 and §9 are the only ways any of it is sent anywhere, and only when you enable them):
Account data: When you register, we store your email address, a bcrypt-hashed password, your organisation name, and the tier of your subscription. This is necessary to authenticate you and apply the correct feature set to your local application.
Billing data: Subscription and payment processing is handled by Stripe. We store your Stripe customer ID and subscription status. We do not store full card numbers — Stripe holds all payment instrument data on their PCI-DSS compliant infrastructure.
Anonymous usage analytics (opt-in only): If you opt in to analytics, we relay anonymised event counts (e.g. "email account connected", "upgrade clicked") to a self-hosted Plausible instance. No personal identifiers, no email content. You can opt out at any time in Settings → Privacy.
Crash reports (opt-in only): If you enable error reporting, Sentry captures crash stack traces to help us fix bugs. Stack traces do not contain email content or personal data. Opt out in Settings → Privacy.
If you configure an Anthropic or OpenAI API key, prompts you send through that path are transmitted to the respective provider and governed by their privacy policies. JARVOS does not proxy or log these requests — they go directly from your machine to the provider's API.
When using Ollama (local AI), nothing leaves your machine.
Personal tier: The whatsapp-web.js bridge connects directly to WhatsApp's servers from your machine — no relay through JARVOS infrastructure. Messages are stored in your local database.
Business tier: The Meta Cloud API webhook is received by the JARVOS backend and forwarded to your local application over a secure connection. Message content is not stored or logged on JARVOS servers.
Your local application data is yours entirely — it lives in a SQLite file on your machine. You can delete it, back it up, or migrate it at any time.
Account data (email, subscription status) is retained as long as your account exists. You can request deletion by emailing support@jarvos.site. Deletion is processed within 30 days.
IMAP/SMTP passwords are encrypted with AES-256-GCM using a key stored in your OS keychain (Windows Credential Manager, macOS Keychain). They are never written to disk in plaintext and never transmitted over the network.
Sending a Secretary document for signature to an external recipient is off by default. It only works after you explicitly enable Remote Signing in Settings → Security. When enabled, sending a document uploads it to a JARVOS relay so the signer can open it from a link.
The document is end-to-end encrypted before it leaves your machine: the decryption key travels in the link you send the signer and never reaches our servers, so JARVOS cannot read the document even though an encrypted copy transits our relay. That copy is deleted after signing (and at most 48 hours regardless). Documents you do not send for remote signature never leave your machine.
The Claude Cowork connector is off by default. It only runs after you explicitly enable it in Settings → Security and configure it. When enabled, it lets Claude (running in Anthropic’s cloud) read your recent mail, contacts and CRM pipeline from your machine on request.
Whatever Claude requests through the connector is sent to Anthropic and governed by Anthropic’s privacy policy. Unlike remote e-signature, this data is notend-to-end encrypted — it is the readable content of the records Claude asked for. JARVOS does not proxy, store, or log connector traffic; the request goes from your machine to Anthropic. The connector is read-only and revocable: turning it off invalidates its access token immediately.
Privacy questions: privacy@jarvos.site
General support: support@jarvos.site