Jarvi — Privacy Policy

Written from the code rather than from a template: every claim below corresponds to a table in supabase/migrations/ or a call in api/lib/. If the code changes, this has to change with it — the pairs are noted so a reviewer can check them.

Last updated: 25 August 2026

The short version

• Everything you type, and every image or document you attach, is sent to the AI model you chose in order to answer you.
• Health, location and contacts are off until you turn them on, and are looked up only when a question needs them — never attached to ordinary messages.
• Voice recordings are sent to be turned into text and are never stored — not by us, not by the transcription provider. Only the text is kept, and you see it before it is sent anywhere.
• You can read everything Jarvi remembers about you and delete any of it.
• Deleting your account deletes everything, immediately, with no grace period.
• We do not sell your data, and we do not use your conversations to train models.

1. Who we are

Jarvi is operated by Köknar UG, Prenzlauer Allee 242-247, 10405 Berlin, Germany. Contact: yilmaz.koeknarx@gmail.com.

For users in the EU/EEA and UK, that entity is the data controller.

2. What we collect, and why

2.1 Your account

Your email address, and — if you sign in with Google — the name and email Google returns. Used to identify your account and nothing else.

Legal basis: performance of the contract.

2.2 Your conversations

Messages you send, the answers you receive, which model produced each one, and any images or documents you attach. Stored so your conversations are still there when you reopen the app, and sent to the model vendor to produce a reply.

Code: public.messages, public.threads, public.attachments. Legal basis: performance of the contract.

2.3 What Jarvi remembers

Short factual sentences extracted from your own messages — never from the model's replies — so answers can take account of what you have already said. Every one is readable and deletable in Skills → Memory.

Code: public.memories, api/lib/memory.ts. Legal basis: performance of the contract.

2.4 Projects and saved answers

Project names, the standing instructions you write, files you attach to a project, and answers you save into collections.

Code: public.projects, public.project_files, public.collections, public.saved_messages.

2.5 Health, location and contacts — only if you switch them on

Each is off by default and controlled individually in Skills.

Contact phone numbers and email addresses are encrypted at rest (AES-256-GCM). Names are not, because a lookup has to search on them — a database breach would reveal who you know, but not how to reach them. We think you should know that rather than discover it.

Turning any of these off deletes what was collected under it, immediately.

Code: public.health_days, public.device_location, public.contacts, api/lib/crypto.ts. Legal basis: consent, withdrawable at any time in Skills.

2.6 Connected accounts

If you connect Google, we store access and refresh tokens encrypted at rest and the scopes you granted. Calendar and mail are read only when a question needs them. Jarvi always asks before sending anything on your behalf.

Code: public.connections, api/lib/google.ts, api/lib/gmail.ts. Legal basis: consent.

2.7 Billing

Your plan, your credit balance, and Apple's transaction identifiers. We never see your card. Apple processes payment.

Code: public.credit_ledger, public.entitlements. Legal basis: performance of the contract, and legal obligation for records.

2.8 Product analytics

We measure how the app is used so we can tell a feature that works from one that does not. This is behaviour, never content: which screen you opened, how many models you asked at once, whether you attached a photo, which answer you kept, whether a purchase failed.

No message, answer, document, filename, contact, health figure or location is ever sent to our analytics. The events the app can send are a fixed list in code — there is no call anywhere in the app that can pass free text to it — and the same is true of the events our server sends.

You are identified to our analytics by your Jarvi account identifier, never by your email address. Signing out unlinks the device.

Session recordings. We record how the interface was used — taps, scrolls, and which screens followed which — so we can see where people get stuck. All text and all images are masked before the recording leaves your phone, so a recording shows the shape of a screen, not what was on it. Recordings are held by PostHog in the European Union.

Code: ios/Jarvi/Services/Analytics.swift, api/lib/analytics.ts. Legal basis: legitimate interest in improving the product. You can object — see section 9.

2.9 What we do not collect

No advertising identifiers. No cross-app or cross-site tracking. No data brokers. No browsing history. No contact photos. No background location. No audio.

Tracking, in Apple's sense. Jarvi does not link your data with third-party data for advertising, so no advertising identifier is read and iOS never asks whether Jarvi may track you. The analytics in 2.8 is our own and goes nowhere else; section 2.10 describes the one thing that reaches an advertiser and what is deliberately left out of it. We share nothing with data brokers and target no advertising at you inside the app.

2.10 Advertising measurement

We advertise Jarvi, and we would like to know which advert brought someone who went on to subscribe. That is the whole of it.

Meta is told that the app was installed and opened, that an account registered, that onboarding finished, that the subscription screen was shown, that a purchase was started, and that one completed with its amount and which plan. It is also given your Jarvi account identifier so those events belong together — the same identifier used elsewhere in this policy, and one that means nothing outside Jarvi.

It is not told who you are. No email address, no name, no phone number. Not what you asked, what you were told, what you attached, or what you connected. Nothing from health, location, contacts, calendar or mail.

No advertising identifier, and no tracking prompt. Your device's advertising identifier is never read, so iOS never asks whether Jarvi may track you — there is nothing to ask about. Matching an advert to an install is done by Apple's SKAdNetwork instead, which is aggregated, delayed, and handled by Apple rather than by anything that identifies you. It is a deliberately weaker signal than the industry norm, and it is the reason no permission is needed.

We do not target advertising at you inside Jarvi, and we share nothing with data brokers.

Code: ios/Jarvi/Services/MetaEvents.swift. Legal basis: legitimate interest in measuring our own advertising. You can object — see section 9.

3. Voice

When you record a voice message, the audio is sent to Jarvi's server, turned into text, and discarded. It is never written to storage and never written to a log, by us or by the transcription provider, and the copy on your phone is deleted as soon as the text comes back. Nothing is kept but the words, and you see those in the message box before anything is sent to a model.

Transcription is performed by OpenAI through the Vercel AI Gateway, which does not retain audio submitted through it for training.

This used to run entirely on your phone, using Apple's built-in speech recogniser, and nothing left the device. That was better for privacy and noticeably worse at the job — it misheard names, places and product words often enough that people were retyping what they had just said. We changed it deliberately, and this section changed with it.

Code: ios/Jarvi/Features/Voice/VoiceRecorder.swift, api/lib/transcribe.ts.

4. Who your data is shared with

4.1 AI model vendors

To answer you, your message — along with the conversation so far, and any image or document you attached — is sent through Vercel AI Gateway to the vendor of the model you selected:

Anthropic · OpenAI · Google · xAI · Moonshot AI · DeepSeek · Alibaba · Z.ai · Mistral · MiniMax · NVIDIA

Which vendor receives a given message depends entirely on which model you chose, and the app names that model on every answer it shows you.

Voice is the one exception to "whichever model you chose": a recording always goes to OpenAI to be turned into text, whatever model you have selected for the conversation, because that is the transcription model Jarvi uses. See section 3.

Each vendor's own terms govern what they do with it. We select vendors that contractually do not train on API traffic, but we cannot inspect their systems, and you should treat anything you send as having left our control.

Code: api/lib/models.ts, api/lib/providers.ts, api/lib/transcribe.ts.

4.2 Infrastructure

• Supabase — database, authentication and file storage (EU region).
• Vercel — the API that runs your requests.
• Apple — payments, and push notifications if enabled.
• Google — only if you connect it, and only for calendar and mail.
• Open-Meteo — receives a coordinate to return a forecast, if you have turned Location on. It receives no identifier and nothing about you.
• PostHog — product analytics and masked session recordings, held in the EU. It receives your account identifier and the behavioural events described in section 2.8, and nothing you have written or been told.
• Meta (Facebook) — the install, onboarding, paywall and purchase events described in 2.10, with your Jarvi account identifier and nothing that identifies you outside Jarvi.
• RevenueCat — subscription reporting. It receives your account identifier and the signed App Store transaction for a purchase — which plan, when, and whether it renewed — so we can see revenue and cancellations. It receives nothing about how you use the app and nothing you have written.

4.3 Never

We do not sell your data, share it with advertisers, or use your conversations to train any model of our own. Our analytics is not shared with anyone and is not used for advertising or cross-app tracking.

5. Where it is held

Data is stored in the European Union. Model vendors and Vercel may process requests outside the EU, including in the United States, under Standard Contractual Clauses.

6. How long we keep it

Until you delete it. Conversations, memories and saved answers persist until you remove them or delete your account. Turning off a device capability deletes its data immediately.

There is one exception worth stating plainly: deleting a conversation removes its messages, but a fork you made of it earlier is a separate copy and survives. Deleting a project releases its conversations rather than deleting them.

Two things expire on their own rather than waiting for you: session recordings are kept for 30 days and then deleted by PostHog, and analytics events are kept for as long as the product is being measured. Neither contains anything you wrote.

7. Deleting your account

Skills → Account → Delete account. You type your own email address to confirm.

It deletes: conversations, images, documents, memories, projects, saved answers, connected accounts, tool servers, health, location and contact data, your credit balance, and your login. Files in storage go first, so nothing is left orphaned.

There is no grace period and no undo. Any remaining credits are forfeited.

Verified by an automated test that builds an account with a row in every table, deletes it, and checks each table by name — api/test/deletion-live.mjs.

8. Your rights

If you are in the EU/EEA or UK you have the right to access, correct, delete, restrict and object to processing, and to data portability. Access and deletion are built into the app; for anything else, write to yilmaz.koeknarx@gmail.com and we will respond within one month.

Withdrawing consent. Health, location and contacts are used only because you switched them on. Switch one off in Skills → Device access and the permission is withdrawn and the data already collected for it is deleted immediately — you do not have to ask us. Withdrawal does not affect anything done while the consent was in place.

No automated decisions. Nothing about your account is decided by an automated process that produces a legal or similarly significant effect. The models generate answers; they do not decide anything about you.

You may also complain to your local supervisory authority.

California residents: we do not sell or share personal information as those terms are defined by the CCPA/CPRA.

9. Children

Jarvi is not intended for anyone under 16, and we do not knowingly collect their data.

10. Security

Row-level security on every table, so one account's data is unreachable from another's. OAuth tokens, tool-server credentials and contact details are encrypted at rest with AES-256-GCM. Files are stored privately and reached only through short-lived signed links. All traffic is TLS.

No system is perfectly secure, and we will tell you without delay if a breach affects you.

11. Changes

If we change this materially we will tell you in the app before it takes effect.