What Data Does Jarvis Send Off My Device?

Jarvis (getjarvis.eu) is a screen-aware desktop AI assistant for macOS 12+, Windows 10+, and Linux summoned with Cmd+/ (Ctrl+/ on Windows), and it only sends data off-device when you actually trigger a query. When you summon the floating bar, the text you type, the specific screen region captured, and any data pulled from connected apps like Gmail, Slack or Notion travel over TLS to the GDPR-aligned backend in GDPR-aligned infrastructure, then to whichever model handles the task: frontier models from Anthropic, OpenAI, or Google. Nothing is streamed continuously; there is no always-on screen recording. Your OAuth tokens stay encrypted with AES-256-GCM and are never part of a prompt. Jarvis never trains on your data. At $16/month for Pro, you control which apps are connected and can revoke any of them. Local memory and preferences sit on your disk between queries.

The single most important privacy fact about Jarvis is the trigger boundary. The app does nothing with your screen or your apps until you press Cmd+/ and submit a request. There is no background daemon shipping keystrokes, no continuous screen scrape, no ambient microphone. When you summon the bar and ask a question, Jarvis captures exactly the context that question needs, sends it once, gets an answer, and stops. This is structurally different from always-on overlay assistants that record the screen continuously to build a timeline. Off-device data transfer in Jarvis is bounded to discrete, user-initiated events, which makes the data flow auditable in your own head.

A typical request carries three things: the prompt you typed, the screen context for that moment if screen-awareness is engaged, and any connector data the task requires (an email thread, a Slack channel, a Notion page). That payload goes over TLS to the backend, which routes it to the model best suited to the task. The model returns text; Jarvis renders it. Crucially, your connector authorization tokens are never in that payload. They live encrypted at rest with AES-256-GCM and are decrypted server-side only to make the specific API call you asked for, then the result, not the token, becomes context.

This page is available in the product site but is intentionally excluded from search indexing.

Privacy & data