Privacy Policy

Elson Odejimi operates AskJarvis and is the data controller for the information described here. For any privacy question, or to exercise a right in section 8, email [email protected].

When you create an account: your name, email address, and a password that is stored only as a scrypt hash with a per-account random salt. We never hold your password itself.

What you build: the descriptions you type into the builder, the conversation that follows, and the extension files generated from it. This is stored so your work is there when you come back.

Usage: for each generation we record which model was used, token counts, the computed cost, and a timestamp. This is how billing allowances are enforced and how we understand what the service costs to run.

Billing: your Stripe customer and subscription identifiers, your plan, billing term, and payment status. We never receive or store your card details — those go directly to Stripe.

Technical: a session token in a cookie, and the IP address of sign-in and sign-up attempts, used only to rate limit them.

We do not use analytics, advertising, tracking pixels, or any third-party script. There is no profiling and no automated decision-making that produces legal effects.

• To provide the service — account, projects, generated extensions. Necessary to perform our contract with you.
• To take payment — billing records. Necessary to perform our contract.
• To enforce allowances and prevent abuse — usage records, rate limiting. Our legitimate interest in running a viable service.
• To keep accounts secure — email verification, session handling. Our legitimate interest in security.

These are every third party your data reaches, and what each one gets:

• Anthropic — receives the task descriptions and conversation you type into the builder, in order to generate the extension. See section 5.
• Stripe — receives your name and email to create a customer record, and handles your card details directly.
• Resend — receives your email address in order to deliver verification and invitation emails.
• Fly.io — hosts the application and the database, in the United States.
• Cloudflare — routes traffic to the site and provides TLS and protection against attacks.

We do not sell personal data, and we do not share it for advertising. We would disclose data if legally required to, and we would tell you unless prohibited from doing so.

AskJarvis is operated from Maryland and intended for customers in the United States. Our servers and all of the providers above are located in the United States, so your data stays there.

This deserves its own section, because it is the question a careful customer asks.

Your description of a task is sent to Anthropic's API to generate the extension code. Anthropic does not train its models on data submitted through its API. The generated code is returned to us, stored against your project, and shown to you.

The extension itself then runs entirely in your browser. Whatever data it touches — the pages it reads, the values it copies — never reaches AskJarvis. We have no visibility into what your extensions do once installed.

Practical consequence: do not paste credentials, customer records, or other sensitive material into the builder chat. Describe the task, not the data.

AskJarvis sets one cookie: a session token that keeps you signed in. It is httpOnly, restricted to this site, marked secure in production, and lasts 30 days or until you sign out.

That is a strictly necessary cookie, so there is no consent banner. There are no analytics, advertising or tracking cookies, because there is no analytics, advertising or tracking.

• Account and project data — for as long as your account is open, and deleted within 30 days of closure.
• Billing records — retained for up to 7 years after closure, because tax law requires it. This is limited to transaction records, not your projects.
• Rate limiting records — a few hours.
• Email verification tokens — 24 hours, or until used.

We offer these to every customer, regardless of where you live and regardless of whether a particular law compels us. They are simpler to honour than to argue about.

• See it. Ask for a copy of everything we hold about you.
• Correct it. Your name and email are editable in Settings; ask us about anything else.
• Delete it. Ask us to close your account and erase your data, subject only to the billing records we are required to keep.
• Take it with you. Your extensions are downloadable as files at any time, so your actual work is already portable by design.
• Object. Tell us to stop processing your data for a particular purpose.

Email [email protected]. We respond within 30 days, at no charge. We may ask you to confirm your identity first, so that someone else cannot request your data.

We will never treat you differently, or charge you more, for exercising any of these.

Specifically, rather than a claim to be secure:

• Passwords are stored as scrypt hashes with a per-account random salt.
• All traffic is served over HTTPS, with HSTS enforced.
• Session cookies are httpOnly and secure, so page scripts cannot read them.
• Sign-in attempts are rate limited to make guessing impractical.
• The database sits on an encrypted volume with automated snapshots.
• API keys are held as encrypted secrets and never sent to the browser.

No system is perfectly secure. If we suffer a breach affecting your personal data, we will notify you and the relevant authority without undue delay, and within 72 hours where the law requires it.

AskJarvis is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has created an account, email [email protected] and we will delete it.

If we change this policy in a way that materially affects you, we will email you before it takes effect. The date at the top always reflects the current version.