Privacy Policy for Jarvis
1. Who we are
Jarvis ("the app") is a private, single-user AI assistant built and operated by Mohammed Affan Shaikhsurab ("the operator"), an individual developer based in Belgaum, Karnataka, India. The app home page is agent.affanshaikhsurab.site. Contact: affanshaikhsurabofficial@gmail.com.
The app is used only by the operator, on Google accounts the operator owns. It is not offered to the public, has no sign-up, and is not intended for anyone else. This policy explains what data the app accesses, why, where it is kept and how to remove it.
2. Google user data the app accesses
With the account owner's explicit consent through Google's OAuth screen, the app requests these Google API scopes and no others:
| Scope | Data accessed | Why |
|---|---|---|
gmail.readonly | Email messages, headers, attachments' names, labels and threads | To read new email and write the owner a daily summary, and to find messages that need a reply |
gmail.modify | Labels and archive state of messages | To apply the owner's labels (for example "to respond", "waiting for") and archive handled mail. The app never deletes email |
gmail.compose | Drafts | To save reply drafts in the owner's Drafts folder for him to review and send himself. The app does not send email and does not request the gmail.send scope |
calendar.events | Calendar events on the owner's calendars | To tell the owner what is on his schedule and to propose or add events he asks for |
The app also receives the email address of the signed-in account, used only to confirm that the correct account was connected.
3. How the data is used
- Only to provide the features above to the owner: summaries, labelling, drafts, schedule answers and reminders.
- Email and calendar content is processed by an AI language model to produce summaries and drafts (see section 5).
- The data is never used for advertising, never sold, never used to build profiles of other people, and never used to train or improve general AI or machine-learning models.
- No human reads the data except the owner himself.
4. Where the data is stored and for how long
- OAuth tokens are stored encrypted in AWS Systems Manager Parameter Store (AWS account controlled by the operator, region us-east-1) and loaded into memory on the operator's private server. They are never written to source code or shared.
- Email and calendar content is fetched on demand and processed in memory on the operator's private server (Amazon EC2, us-east-1). Full email bodies are not stored permanently.
- Derived outputs (short summaries, the owner's own task notes and conversation transcripts) are kept in the operator's private GitHub repository and the assistant's private database so the owner can review his history. They are kept until the owner deletes them.
- Server logs never contain message bodies, tokens or keys.
5. Sharing and service providers
Google user data is not sold, rented or shared with anyone for their own purposes. It is transferred only to the service providers needed to run the app for the owner, under their business terms:
- Amazon Web Services (hosting, encrypted secret storage, and Amazon Bedrock AI models that generate summaries and drafts). Amazon Bedrock does not use inputs or outputs to train models.
- Deepgram and Sarvam AI (speech-to-text and text-to-speech), only when the owner uses voice mode. A spoken summary may include text derived from his email or calendar.
Data may be disclosed if required by law.
6. Limited Use disclosure
Jarvis's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
7. Security
- All connections use HTTPS/TLS. Tokens are encrypted at rest.
- The server has no public ports except HTTPS for the owner's own app, which is protected by a login that only the owner holds; sign-ups are disabled.
- Access is limited to the minimum scopes listed above; sending email is not possible.
8. Your choices: revoking access and deleting data
- Access can be revoked at any time at myaccount.google.com/permissions. The app then stops accessing that account immediately.
- On request to the contact email, stored tokens are deleted within 7 days and derived summaries for that account are deleted within 30 days.
9. Children
The app is not directed to anyone under 18 and is used only by its adult operator.
10. Changes
Any change to this policy is published on this page with a new "last updated" date.
11. Contact
Mohammed Affan Shaikhsurab · affanshaikhsurabofficial@gmail.com · Belgaum, Karnataka, India