Legal and trust
Privacy Policy
Last updated: 26 September 2026 · Version 2026-09-26.5
How we handle website applications, information on your Mac and content sent to connected services.
1. Who is responsible
This policy covers the JARVIS website, beta applications and JARVIS, our AI personal assistant currently available for macOS. They are operated by JARVIS AI LIMITED, a Hong Kong company with limited liability (Company No. 81247037; Business Registration No. 81247037-000-09-26-7). Our registered office is Unit 1806, 18/F., 9 Wing Hong Street, Cheung Sha Wan, Hong Kong.
We are the data user for personal data we collect to operate the website and beta programme. Contact our privacy contact at contact@jarvis-automation.com or write to the registered office, marked “Privacy”. This policy also explains data processed by the desktop application and your chosen providers; local storage and cloud processing are separate.
2. Beta applications and contact requests
When you apply, we collect your email address, any optional role and workflow information you provide, language preference, submission time, application status, and the time and versions of your privacy acknowledgement and terms acceptance. We use these records to review applications, manage invitations, prevent duplicate applications and contact you about participation. An email address and the required acknowledgements are necessary to process an online application; optional answers are not required.
If you email us, we receive your address, message and any attachments you choose to send. We use them to respond, provide support and investigate reported problems. Please do not include passwords, API keys or other people’s private messages unless they are necessary and you are authorised to share them.
Applying does not subscribe you to general marketing. Application, invitation and necessary beta service messages are limited to the programme you requested. You can withdraw your application or ask us to stop these messages by contacting us. Any future unrelated marketing requires a separate choice.
3. Website hosting, storage and analytics
Vercel hosts the website and processes network information, such as your IP address and request details, to deliver and protect it. The form uses your IP address and email address temporarily to limit abuse; the beta application record does not include your IP address or browser user-agent. Beta application records, including the application source and record-format version, are stored in Amazon DynamoDB in the AWS Asia Pacific (Singapore) region, with database backups.
Where application email notifications are enabled, Resend processes email addresses and message content to deliver confirmations and internal application notifications; those notifications also reach our company mailbox. A successful application is saved in the database even if no confirmation email is sent.
The website includes Vercel Web Analytics to understand page traffic. It processes information such as page URL, referrer, approximate location, browser, operating system and device type. Vercel describes this as aggregate analytics without advertising cookies or persistent visitor tracking across websites. We do not send application answers or email addresses as custom analytics events. The website does not set a language-preference cookie or use advertising cookies.
4. Information stored on your Mac
Depending on the features you use, JARVIS stores conversations, tasks, connected-service context, email copies, groups, personal instructions, preferences and confirmed memories in a local SQLite database. API keys and connection credentials are stored using macOS Keychain. Local diagnostic logs may also contain operational details; from version 0.5.1 they no longer record transcribed text or tool content. These local records are not uploaded to a JARVIS cloud workspace, and the current email workspace does not provide cross-device sync.
From version 0.5.1, the local database is encrypted with AES-256 (SQLCipher), its key is kept in macOS Keychain, and its folder can only be opened by your macOS account. Earlier versions stored it without separate application-level encryption; that data is converted the first time you open version 0.5.1. Anyone signed in to your macOS account can still use JARVIS, so your Mac’s account permissions, device security and disk encryption remain important. Data you send to AI or connected services leaves the device as described below. Data you voluntarily send to support is also received by us.
5. Google connections and their permissions
The email workspace requests Gmail read-only access (gmail.readonly) to retrieve your account address, message metadata and email text for local reading, organisation and analysis. From version 0.5.2, each email-workspace account also requests read-only access to its Google Calendar events (calendar.events.readonly), so its events appear on the JARVIS Calendar page next to your main account’s and the general assistant can read them when you ask; the general assistant can also search and read that account’s email. JARVIS cannot change these accounts’ calendars, and you can decline Calendar access on Google’s consent screen and keep the mailbox. Synchronisation runs when you start it and may also run automatically, about every five minutes, while JARVIS is open. It does not send mail or change Gmail labels. Attachments are not downloaded by this workspace. From version 0.5.2, messages you delete, move to the trash or mark as spam in Gmail are also removed from the local copies.
The separate general-assistant Google connection requests Gmail read/modify access (gmail.modify), Calendar access and basic profile information. It supports reading and organising email, saving drafts, calendar operations and displaying your name. While JARVIS is open, this connection syncs recent email and calendar events in the background about every five minutes. This connection has broader permissions than the email workspace. The assistant’s email tool creates a draft in Gmail for you to review; it does not send the draft. Review the Google consent screen for the connection you enable.
6. AI analysis, provider choice and voice
General assistant requests contain your prompt, relevant conversation or connected-service context, and local JARVIS records a request needs, such as email follow-ups and your task list. They go to the AI provider selected in the application. In versions that ask you to choose an AI during setup, you pick one provider: a local Ollama model, OpenAI, Google Gemini, Anthropic Claude, Moonshot AI (Kimi), Alibaba Cloud Model Studio (Qwen), another OpenAI-compatible service whose address you enter, or Amazon Bedrock. Requests then go only to that provider unless you add others in the advanced settings. Earlier beta versions use Google Gemini by default for the general assistant and can add OpenAI or Anthropic as fallbacks when their keys are saved.
Email analysis uses the same provider by default. In its own settings you can instead choose OpenAI, Amazon Bedrock or a local model. If you choose a cloud provider and acknowledge the cloud transfer, the group’s included email text, personal instructions and relevant active memories are sent to that provider using your account. Local Ollama analysis is also supported. Email analysis does not automatically switch to another provider on failure. Memories are created or confirmed by you; analysis does not save them automatically.
The email workspace also offers automatic sorting, which stays off until you turn it on. When it is on, each message not yet sorted is read once. If you have added a TypeSafe key, the sender, recipients, subject and first 1,500 characters, together with your own mailbox addresses, are sent to TypeSafe to classify the message, and messages that need a summary or a dated follow-up are also sent, up to 6,000 characters, to your chosen AI provider. Without a TypeSafe key, the sender, recipients, subject and up to 6,000 characters of each message are sent to your chosen AI provider, which classifies it and writes the summary and follow-ups. To recognise repeated or corrected dates, these requests can also include the titles, dates and email subjects of open follow-ups JARVIS found earlier in email from the same sender. Earlier beta versions send summaries to OpenAI. Once on, sorting runs after every sync, including automatic ones, and usage is charged to your own provider accounts. The resulting categories, summaries and follow-ups are stored on your Mac.
In versions that ask you to choose an AI, recorded voice-command audio is sent to Google for transcription only when Google Gemini is your chosen provider; otherwise a Whisper model you download once transcribes it on your Mac. Earlier versions send the audio to Google whenever a Gemini key is available, with local Whisper as a fallback. MiniMax receives text to be spoken if you select its speech service. macOS speech and a configured local CosyVoice model are local alternatives.
Provider terms, account settings and retention controls apply to content they receive. If you choose a local Ollama model, assistant, analysis and sorting content stays on your Mac, apart from anything sent to TypeSafe or other services you enable. The email workspace requests OpenAI processing with response storage disabled; this does not guarantee zero provider retention, and other providers apply their own retention policies. Gemini’s unpaid-service terms can allow use of submitted content for model improvement and human review. Do not send personal, sensitive, confidential or Google user data through a provider configuration that permits incompatible uses. Review provider settings before connecting work accounts or processing private material.
7. Limited use of Google user data
JARVIS’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements, and the applicable Google Workspace user data policy. Google user data is used to provide the user-facing features you request. Transfers for those features require your consent.
We do not sell Google user data, use it for advertising or credit decisions, or use it to train general-purpose AI models. Our personnel may access specific Google content you provide for support only with your explicit permission, or where necessary for security or legal obligations as permitted by Google’s policy. These restrictions also apply to service providers handling that data on our behalf. The AI provider you choose, and TypeSafe if you add its key, receive content under your own account and their own terms; they are not service providers acting on our behalf. From version 0.5.1, JARVIS sends Gmail content only to AI services whose terms exclude training on it by default: OpenAI, Anthropic Claude, Amazon Bedrock, a local Ollama model on your Mac, or Google Gemini after you confirm that your key has billing enabled, because Gemini’s unpaid tier may use submitted content to improve Google’s models (see section 6). Kimi, Qwen and other compatible services do not receive Gmail content. This statement is not a claim of Google verification or certification.
9. Retention and deletion
We retain website applications and related correspondence only while needed to manage your request or participation, resolve an outstanding issue, or meet a legal obligation. When those purposes end, we delete or de-identify records. A limited record of a withdrawal or consent may be kept where needed to honour your choice or establish how the request was handled. There is no blanket promise that all records disappear immediately: copies in email systems, provider logs and backups may remain under the relevant retention arrangements. You may contact us to request deletion and information about any justified retention.
Desktop records remain on your Mac until you delete them; uninstalling the app alone may leave its data and Keychain entries. In the email workspace, disconnecting an account removes its local connection credential but keeps downloaded emails. Explicitly deleting that account removes its local emails and memories sourced from them, without deleting Gmail originals. Deleting a group removes its memberships and memories, not the underlying local emails. You can also edit or delete individual memories.
Revoking access in your Google Account stops future authorised access but does not itself erase existing local copies. It can affect other JARVIS connections using the same Google authorisation. For help removing remaining local data or credentials, contact us. We cannot remotely erase your Mac or automatically delete records held under your own provider accounts.
10. Your choices, requests and complaints
You may request access to and correction of personal data we hold about you, ask for deletion, or withdraw your beta application and related communications. Send requests to contact@jarvis-automation.com or our registered office, marked “Privacy”. Please identify the email address used and the request; we may ask for proportionate information to verify your identity. Do not send an identity-document copy unless specifically required.
We handle access and correction requests within the applicable statutory period. Under Hong Kong’s Personal Data (Privacy) Ordinance this is generally 40 days, subject to the law’s exceptions and procedures. Where we cannot fulfil a request, we will explain the reason as required. Deletion is subject to any lawful need to retain particular records. You may also contact Hong Kong’s Office of the Privacy Commissioner for Personal Data about a privacy complaint. Mandatory rights under other applicable laws are unaffected.
11. Changes to this policy
We update this page when our handling changes and identify the current version above. Material changes will be brought to affected users’ attention through the website, the application or direct communication as appropriate. New purposes or transfers that require consent will not be authorised merely by publishing an updated policy.