What actually leaves your machine.

1. Who we are

Usejarvis Inc. is a Delaware C corporation. It publishes the Jarvis software, this website, and the managed hosting service described below.

2. What the software collects

Jarvis comes in two shapes and they are genuinely different, so they are described separately. In the self-hosted product, your business context stays on your own hardware and the only thing we receive is an anonymous usage ping. Hosted moves the brain onto our servers, and that is where the guarantee changes.

Self-hosted

Self-hosted Jarvis is free, source-available and runs entirely on machines you control. We run no server in this path. There is no account, no login and no sync.

Your business context stays local. Everything Jarvis learns about you is written to a SQLite database on your own disk, at ~/.jarvis/jarvis.db by default. That includes people, projects, tools, places, concepts and events, the facts and relationships between them, your commitments and tasks, your conversations with Jarvis, its goals and workflows, its audit trail of every tool it executed, and the metadata of its screen captures. None of it is transmitted to us. You can read the schema in the repository.

Screen awareness runs on your machines. With awareness on, which is the default, the desktop sidecar captures your screen roughly every seven seconds. The image files are written to the sidecar's own disk at ~/.jarvis/captures, and the text recognition runs locally in the sidecar using Tesseract, Apple Vision or Windows OCR. The brain receives the recognised text and the metadata, not a stream of pictures, and both stay on your hardware.

Cloud vision is the exception, and it is on by default. When Jarvis detects an error, a struggle or a large change on screen, it can escalate by sending that screenshot to whichever large language model provider you have configured, under your own API key. That is a screenshot of your screen leaving your machine, to your provider and not to us. It is rate limited to one call every thirty seconds by default, and you can switch it off entirely with awareness.cloud_vision_enabled: false, or turn awareness off altogether.

Model providers see what you ask. Jarvis is not a model reseller. Your prompts, conversations and whatever context Jarvis attaches to them go to the provider you configured, using your key, under that provider's terms. We do not sit in that path and we never see it.

Google access, if you connect it, is read-only. Jarvis requests exactly two OAuth scopes, gmail.readonly and calendar.readonly. It can read your unread mail, the detail of a message and your upcoming events. It cannot send mail, delete mail, or create, move or cancel calendar events, because those scopes are not requested. On self-host the resulting tokens are written to ~/.jarvis/google-tokens.json on your own machine with owner-only file permissions, and they are never sent to us.

The two usage pings we do receive

Self-hosted Jarvis sends us anonymous usage metrics. There are two separate streams with separate contents and separate off switches, which is easy to miss, so both are set out in full.

The brain ping sends exactly four fields: an anonymous machine id, the app version, the install method, and the platform and architecture as a single string such as linux/x64. The anonymous id is a SHA-256 hash of a fixed namespace plus your hostname and username, truncated to the first 32 hex characters. The hostname and username themselves never leave your machine and the hash cannot be reversed back to them. It is anonymous rather than secret: hostname and username are low entropy, so someone who already knew a specific machine's values could confirm a match. One ping is sent when the daemon starts and one every hour after that, with a five second timeout, and a failed ping is discarded silently. The collector adds a receipt timestamp on its side. Nothing else is stored.

The sidecar ping is a second, independent stream and it sends more. It has its own anonymous machine id, hashed the same way but under its own namespace, and it also carries the anonymous id of the brain it is enrolled to, so a brain and its devices can be counted together. Alongside that it sends the sidecar version, the platform and architecture, a coarse operating system version such as darwin 14.5 or ubuntu 22.04 (on Windows this is derived from the build number), your UTC offset in minutes, whether the sidecar is currently connected to a brain, whether this is a release or a local build, and which of its capabilities work on this machine and which do not. Cadence is the same, one ping at startup and one an hour.

Neither ping contains your hostname, your username, an IP address placed there by us, your config values, your API keys, file paths, prompts, conversations, screen contents or any feature-usage data. Both are posted to a Supabase table using a public key that is scoped to insert only, so the client can write a ping but can never read anything back.

The first time telemetry runs, the daemon prints a notice explaining all of this and how to turn it off. Every later start prints a one-line reminder.

Hosted

Hosted plans are not open yet. As of 27 August 2026 the plan cards on our pricing page lead to a waitlist, no checkout exists on this site, and we have never taken a card or charged anyone. Everything in this subsection describes how the hosted service is built to work when it opens, not something running today.

On a hosted plan we run the always-on brain on a server we provision for you. The sidecar, the pebble and your screen stay on your machine, and screen capture and text recognition still happen locally. What changes is the vault. The business context described above, the people, projects, decisions, commitments, conversations and audit trail, lives in the brain, so on a hosted plan it lives on our server rather than on your disk. That is the precise point at which "it never leaves your machine" stops being true, and it is the main reason self-host exists.

Two more things are worth naming. During hosted setup the sidecar registers a one-time nonce together with your machine's hostname with our connect server at app.usejarvis.dev, so the hostname does leave your machine on this path, unlike on self-host. And if you connect Google on a hosted plan, our control plane records only the connection metadata, which scopes were granted and whether the connection is live; the tokens themselves are delivered to your instance and are not stored in our database.

The control plane is designed to hold your Clerk user id, your email address, your Stripe customer id, your subscription and payment records, the servers and instance provisioned for you, an administrative audit log, and a log of which service emails were sent to you.

3. What the website collects

usejarvis.dev, including the documentation and the blog, is a fully pre-rendered static site served from Cloudflare. It has no forms, no sign-up and no endpoint of ours that records anything about you. Two small scripts run on each page: one does layout only, the reveal-on-scroll animations and the mobile menu, and the other is the consent banner described below, which decides whether the Meta pixel is allowed to load.

Fonts are the one third party. Every page loads two typefaces from Google Fonts, so Google receives your IP address and browser user agent when a page loads. We do not receive that.

We run the Meta advertising pixel, and we ask first. The pixel tells us how many people who saw one of our ads reached the site and which pages they read. When it runs, Meta receives your IP address, your browser user agent, the page you are on, and a cookie identifier it sets in your browser, and Meta may match that to a Facebook or Instagram account it already holds. We see only the counts, never a name or an individual person.

Nothing loads until you say yes. On your first visit a banner asks. Until you answer it, the pixel script is not in the page and your browser makes no request to Meta at all: it is not loaded and switched off, it is not there. Accept and it loads and reports that page view. Reject, or ignore the banner and keep reading, and it never loads. Accept and Reject are two identical buttons and there is no third option that quietly means yes. Everything on this site works the same whichever you pick. If you have JavaScript switched off, there is nothing to ask with, so nothing loads and you are not tracked.

Changing your mind takes one click. "Cookie settings" at the bottom of every page reopens the banner with your current answer shown, and you can flip it either way. Switching from accept to reject also deletes the _fbp and _fbc cookies from this domain, so the identifier you just revoked does not sit in your browser for another ninety days. You can also block the pixel outright with a content blocker or your browser's tracking protection.

Your answer is stored on your device, not in a cookie. It goes in this site's localStorage, under the key usejarvis.consent, as the answer you gave, the date and time you gave it, and a version number. It never leaves your browser and we never see it. Clearing your browser storage for this site erases it and the banner asks again. So does a change to what we are asking for: the version number bumps and every stored answer stops counting, because an answer to a different question is not consent to this one.

Cloudflare sees your requests. As the host, Cloudflare handles every request and we have request observability enabled on the worker. That means Cloudflare processes connection data, including your IP address, in the ordinary course of serving the site.

The install, star and community figures on the home page are not measured from visitors. They are written into the page at build time from a daily refresh of our own telemetry, GitHub and Discord, so nothing about your visit contributes to them.

Links to GitHub and Discord leave this site. Once you follow one, that service's own privacy practices apply, not ours.

4. Third parties that receive data

Named in full, with what each one gets:

• Supabase. Hosts the collector tables that receive the two anonymous usage pings described above. This is the only place product telemetry goes.
• Cloudflare. Serves this website and therefore handles the requests for it.
• Google Fonts. Serves the two typefaces on every page of this website, and so receives your IP address and user agent.
• Meta, but only if you accept the banner. Receives a page view, your IP address, your user agent and a cookie identifier from the pages you visit after you accept. If you reject, or never answer, Meta receives nothing and is never contacted.
• Your model provider. On self-host, whichever provider you configured receives your prompts and context under your own key, and receives screenshots if cloud vision is left on. We do not choose it and we are not in the path.
• Google. Only if you connect your account, and only for read access to Gmail and Calendar.

For hosted, when it opens, the service is built on Clerk for sign-in, Stripe for payment, Resend for service email and Cloudflare for DNS. Card details would be handled by Stripe and not by us; we would hold a Stripe customer id and the record of a payment, not a card number.

5. How long things are kept

• Your vault, on self-host: until you delete it. Nothing in the product expires your own knowledge base. It is a file on your disk and it is yours to keep or remove.
• Screen captures: one hour, or twenty four hours for a key moment. Those are the defaults. An hourly sweep deletes the expired rows from the database and tells each connected sidecar to delete the corresponding image files from its disk. Both windows are configurable, so your own setting may differ from the default.
• Google tokens, on self-host: until you disconnect. Disconnecting from the dashboard unlinks the token file.

6. How to opt out, and how to delete

The brain ping. Any one of these turns it off completely: set telemetry.enabled: false in ~/.jarvis/config.yaml, run with JARVIS_TELEMETRY=0, or set DO_NOT_TRACK=1, the cross-tool community standard, which we honour and which overrides everything else.

The sidecar ping is separate and needs its own switch. It deliberately does not honour JARVIS_TELEMETRY or DO_NOT_TRACK. Turn it off by unticking Settings, Privacy, "Send anonymous usage metrics" in the sidecar window, which takes effect immediately without a restart, or by setting telemetry.enabled: false in ~/.jarvis/sidecar.yaml, or by running with JARVIS_SIDECAR_TELEMETRY=0. If you want no telemetry at all, you have to do this as well as the above.

Screen awareness. Set awareness.enabled: false to stop capture entirely, or awareness.cloud_vision_enabled: false to keep local awareness while stopping any screenshot from being sent to your model provider. You can also blind Jarvis at any moment by long-pressing the pebble, which switches awareness off on the spot, persists that choice and stops screen capture until you turn it back on. Blinding is a screen switch, not a microphone switch: the microphone is muted separately, from the tray.

Google. Disconnect from the dashboard, and revoke the grant in your Google account security settings.

The Meta pixel on this website. It is off until you accept the banner, so the default already is opted out. If you accepted and want it stopped, open "Cookie settings" at the bottom of any page and choose Reject. That stops it loading on every page from then on and deletes the _fbp and _fbc cookies it set. There is nothing on our side to delete afterwards, because the data went to Meta and not to us; to reach what Meta holds you have to use Meta's own off-Facebook activity controls.

Deleting your data on self-host. Stop the daemon and delete ~/.jarvis. That is the vault, the captures, the secrets store and the Google tokens. Nothing of it was ever sent to us, so there is nothing on our side to delete.

7. Children, international transfers, and changes

Changes. When our practice changes, we update this page and change the date at the top. Substantive changes to what we collect will be described here rather than absorbed quietly.

8. How to contact us

Email team@usejarvis.dev, or write to Usejarvis Inc., 2093 Philadelphia Pike, Claymont, DE 19703, United States. The phone number is +1 762 327 3586.

Because Jarvis is source-available, you do not have to take any of this on trust. The telemetry client, the sidecar telemetry, the vault schema and the awareness pipeline are all readable in the repository. If this page and the code ever disagree, the code is what is happening and we want to hear about it.