Privacy Policy

The short version

Jarvis is a Discord application operated by an individual developer based in Romania (Section 2). This policy explains what personal data Jarvis processes, why, how long it is kept, who else processes it, and what you can do about it. It covers the bot, its features, our website, and the web portal. In this policy, "the Service" means all of those, and "we", "us", and "our" mean the operator of the hosted Jarvis service.

The key points:

• We do not sell your personal data or use it for advertising.
• To generate replies, your messages, a short window of recent channel context, and relevant stored memories are sent to third-party AI providers (Section 6).
• Voice is processed only after someone explicitly runs /voice. /play by itself does not put Jarvis into listening mode.
• Conversation memories are stored per account - not per server - encrypted at rest, kept for up to 30 days, and can be erased at any time with /opt mode:out or from the portal's Personal tab.

Abuse-detection notice. Retained memories may be reviewed by automated abuse-prevention systems and by the operator when investigating abuse, misuse, or security incidents. If you do not accept that, run /opt mode:out, which erases your stored memories across every server and stops new ones being stored, and stop using the Service. Removing Jarvis from one server does not delete your account-level memories or stop this processing while you keep using Jarvis elsewhere - only the account-level opt-out does that.

Who we are

The controller of personal data processed by Jarvis is the individual operator of the hosted Jarvis service, based in Romania ("we", "us", "our"). Jarvis is an independent, fan-created application; it is not affiliated with, sponsored by, or endorsed by Marvel, Disney, or Discord Inc. J.A.R.V.I.S., Iron Man, and Tony Stark are trademarks of Marvel Characters, Inc. and The Walt Disney Company.

You can contact us about privacy at dev@jorvis.org or through the support server in Section 13.

Jarvis is for people who meet Discord's minimum age in their country (at least 13) and who accept the Terms of Service. If you are below the age of legal majority where you live, a parent or legal guardian must agree to the Terms before you use Jarvis. We do not knowingly process personal data from anyone below the minimum age.

Depending on the feature and the law that applies to you, we process personal data because it is necessary to provide the Service you ask for; because we have a legitimate interest in operating, securing, debugging, rate-limiting, and improving the reliability of the Service and preventing abuse; because the law requires it; or with your consent where a feature you switch on relies on it. You may object to processing based on legitimate interests, and withdraw consent at any time, without affecting processing that was lawful before withdrawal.

What we collect

What Jarvis processes depends on which features a server enables and how you use the Service. This section describes each category.

• Message content. When you address Jarvis directly - by mentioning it, replying to it, using a wake word, running a command, or using a context-menu action - your message is processed to generate a response. One-to-one AI chat in DMs is disabled to prevent abuse, but some supported commands and context-menu actions may also work in private, group, or user-install contexts. A few opt-in server features an admin can enable read messages or attachments in the channels they are configured for, such as the counting game and voice-message transcription (Section 10). Outside an active chat or an enabled feature, Jarvis does not read surrounding channel messages, and there is no background scan of messages for links or keywords.
• Recent channel context. When channel context is available, Jarvis fetches a small recent window from the same channel - currently up to 7 usable messages before yours - so it can follow the live conversation. If you are replying to a specific message, that message is fetched too and labelled with its author, so Jarvis does not mistake someone else's words (or its own) for yours. Messages from people who have opted out via /opt mode:out are skipped, both in the window and as the replied-to message. This context is fetched fresh each time and is not stored as memory.
• Voice. Live voice chat starts only after someone explicitly runs /voice; /play, or sharing a voice channel with Jarvis, does not start listening. While /voice is active, audio is processed live for commands and speech-to-text. In one-person calls, speech may be processed without a wake word for lower latency; in larger calls, Jarvis normally requires its name as a wake word, though it may process short follow-ups from the active speaker during an ongoing exchange. If a server enables voice-message transcription, a Discord voice message may be downloaded, transcribed, and the transcript posted. Raw audio is not recorded or stored: it is transcribed live and discarded. The resulting text may be sent through the AI flow or posted as a transcript, depending on the feature, and may be stored as a memory. Participants can stop voice processing for their account at any time with /opt mode:out, which applies across all voice sessions.
• Conversation memories. Messages you exchange with Jarvis, its replies, timestamps, and basic identifiers, stored so that context persists between conversations. Memories are tied to your account, not to any one server, and travel with you across every server where you use Jarvis. They are encrypted at rest and kept for up to 30 days (Section 7). When you talk to Jarvis, a local on-host similarity search selects the most relevant remembered exchanges, rather than just the latest ones, and the selected text is included in the prompt used to generate your reply. This is how memory works without loading the full channel into context.
• Tool and audit records. When an AI-selected server tool runs, a limited audit record may be stored: the action, actor and target IDs, its source, outcome, guild ID, and timestamp. Some auditable actions also post a redacted record to a server's configured audit channel. These records do not contain prompts, message bodies, raw errors, tokens, or secrets. Stored tool records are capped at a rolling 100 per server and expire after 30 days; the expiry is applied when that server's records are next read or written, rather than by a background sweep. One exception, stated plainly: the operator's own process log records the name and arguments of each AI-selected tool call, because that is what makes a malfunction diagnosable. Those log lines are held on the operator's host under its own log rotation and are not covered by the redaction above. Copies posted to a server's Discord audit channel are Discord messages, subject to that server's retention controls.
• Cat replies and media. If a message contains cat-related trigger words, Jarvis replies with a random cat photo from The Cat API or, as a fallback, cataas.com. That fetch carries no information about you or the server. Your on/off preference for these replies is stored with your account. GIF features may use Klipy, Tenor, GIPHY, or URLs previously posted by Discord users; a small pool of GIF URLs can be stored so the same link can be reused, and those third-party links can expire or be removed by their hosts.
• Portal login data. If you sign in to the web portal with Discord, we store your Discord user ID, username, display name, avatar hash, OAuth access and refresh tokens (encrypted at rest), token expiry, a session identifier (stored as a one-way hash rather than the raw token), and session timestamps, so the portal can identify you and show the servers you can manage. The portal requests Discord's identify and guilds scopes.
• Server data and safety snapshots. To run server-management and safety features, Jarvis may store server identity, channel and role metadata, permission overwrites, emoji and sticker metadata, webhook and invite metadata, AutoMod configuration, scheduled events, selected rules/system/announcement messages, member metadata, and role memberships. What is stored depends on the bot's permissions and which security features a server enables.
• Usage counters. Per-server and per-user request counts and AI token totals, kept to enforce fair-use limits, keep the Service available for everyone, and support abuse detection. This is counting, not content review. Hourly counters are kept for 48 hours and daily rollups for 31 days.
• Operational data. Service logs, event data, and reliability signals, such as uptime and process health metrics. These are subject to the retention windows in Section 7.
• Member data. Only for status channels, such as member counts, and not retained beyond what the feature needs.

How we use it

We process the data described in Section 3 to:

• Generate replies: your prompt, recent context, and selected memories are sent to the AI provider handling the request, and the generated reply is screened before it is posted.
• Remember context between conversations, so the Service does not start from zero every time.
• Handle voice in real time: speech-to-text for what you say, and text-to-speech for what Jarvis says back.
• Run optional server features, including AutoMod, statistics, engagement tools, and moderation support.
• Keep the Service secure and available: rate limiting, abuse detection, troubleshooting, and audit records.
• Operate the portal: sign-in, session security, and the self-service controls in Section 9.
• Comply with legal obligations and enforce the Terms of Service.

Data protection

Access to data is limited to what the Service needs to operate and what is needed to keep it running securely, including people working on the Service who require it. We use the following safeguards:

• Scoped encryption. We prefer to be precise rather than claim encryption broadly. Your conversation memories and your portal OAuth tokens are encrypted at rest, and your portal session identifier is stored as a one-way hash. The rest - your profile, server settings, experience levels, moderation records, and usage counters - is stored in an ordinary database file that is not encrypted at rest by the Service; protecting that file is part of the operator's responsibility, alongside access controls and backups.
• Limited decryption. Memory contents are decrypted only when they are needed: to generate a reply for you, to show you your data in the portal, or when an abuse investigation requires review.
• Provider boundaries. When a message is sent to a third-party AI provider, it leaves our systems. From that point, the provider's own security and privacy practices apply, under the terms linked in Section 6.
• No training on your content. We do not use your Discord messages to train or fine-tune AI models. Where a provider offers controls to limit retention or training, we configure them accordingly, but we cannot override a provider's published terms.
• Breach notification. If a personal-data breach occurs that is likely to affect you, we will notify you and the competent authority as required by applicable law.
• International transfers. Providers and infrastructure may process data outside your country, including in countries that may not offer the same level of legal protection. Where required, transfers rely on an adequacy decision, approved standard contractual clauses, or another lawful transfer mechanism. Contact us for details of the mechanism relevant to your data.

Third-party services

Jarvis operates on Discord. Your Discord account, server membership, messages, attachments, and interactions are also governed by Discord's Terms of Service, Privacy Policy, Community Guidelines, Developer Terms, and Developer Policy.

AI providers. Depending on availability and the feature, AI requests may be processed by NVIDIA, Mistral AI, Google (Gemini), OpenAI, Anthropic, DeepSeek, Cerebras, Groq, or SambaNova - either directly, through a gateway the operator runs, or, where enabled, through a Cloudflare Worker in the operator's account, in which case the request body and the provider credential pass through Cloudflare's edge in transit. Open-weight models may also run on infrastructure the operator controls (for example, through Ollama); when that happens, no third party receives the request merely because its software is used. Which provider handles a given request depends on configuration and availability, and each provider processes data under its own terms and privacy policy.

Speech. Speech-to-text is handled by NVIDIA NIM (Parakeet) or, as a fallback, by Groq (Whisper) - in which case your raw voice audio is sent to Groq for transcription. Text-to-speech is handled by Fish Audio when it is configured, and by NVIDIA NIM otherwise.

Search and media. When Jarvis searches the web, the query it generates from your message is sent to the configured search providers, which may include Brave Search, DuckDuckGo, Tavily, and Google's YouTube Data API. Track and title lookups may additionally be sent to SoundCloud. GIF features may use Klipy, Tenor, or GIPHY, and cat photos come from The Cat API or cataas.com. These services are separate from the AI providers above and have their own retention practices.

Output moderation. Generated replies are always screened first against a local, on-host word and pattern filter, and may also be submitted to OpenAI's moderation endpoint for classification. That endpoint receives the reply text only - not your message. The local filter is English-only, so a reply that is not in English is sent for external moderation regardless of what the local check found; if external moderation is unavailable and a reply cannot be checked locally, an unreadable reply is withheld rather than posted.

Operator infrastructure. Some processing - abuse review, diagnostics, and an optional event-forwarding endpoint configured by the operator - happens on infrastructure the operator controls. Contact us if you want to know whether event forwarding is active.

Relevant privacy policies: NVIDIA · Mistral AI · Google · OpenAI · Anthropic · DeepSeek · Cerebras · Groq · SambaNova · Ollama · Cloudflare · Klipy · Tenor · GIPHY · Brave Search · DuckDuckGo · Tavily · SoundCloud · Fish Audio · The Cat API · cataas

Retention and deletion

Retention periods are defined in the Service's configuration and enforced by scheduled sweeps; a sweep can take up to a day to run, so data may remain for slightly longer than the window shown.

Why your profile is not on a timer. Preferences, level and opt-out choices are live settings, not a log: deleting them on a schedule would silently reset the choices you made. They are removed when you erase your account in the portal, or when the Service no longer shares a server with you.

Deleting your memories. /opt mode:out purges your stored conversation memories across every server at once and stops new ones being stored, with no support ticket required. If the purge cannot complete, Jarvis says so rather than confirming, and nothing is marked as deleted until it succeeds. /clear performs a full reset of the profile and memories Jarvis has retained about you, not just the current conversation.

Self-service from the portal. In the portal's Personal tab you can view and export your retained data, delete individual memories, clear the memories tied to one server, and schedule an account erasure - with a short cancellation window before it runs. The erasure deletes records tied to your user ID and clears references to it from other records.

Backups. Purge removes data from the live database. It cannot retroactively edit copies already taken for disaster recovery: a small number of recent database snapshots are kept on the same host, so a restore performed within that window can bring back data that was since deleted. Restores are operator-initiated and are not part of normal operation. If you need a deletion to be permanent across backups, say so in your request and the snapshot set will be handled at the same time.

Other records. Operational, safety, and abuse-prevention records expire on the windows above. To delete more than memories - for example, your profile and other records tied to your account - use the portal erasure option or contact us (Section 13).

Website analytics and cookies

The website always uses strictly necessary security and portal-session mechanisms when you sign in: a session cookie and a request-forgery protection token, which are required for authentication and security and cannot be switched off while you are signed in.

Depending on configuration, public pages may also load either Cloudflare Web Analytics or Google Analytics - not both through Jarvis's built-in configuration. These services may receive your IP address, user agent, device and browser information, the referring page, pages visited, and timestamps. Google Analytics may use cookies or similar browser storage; Cloudflare describes its Web Analytics product as privacy-focused and may process request metadata at its network edge.

You can block non-essential analytics through browser or network controls, and the site remains usable without it. If you want to know whether analytics is active and which service is in use on this deployment, contact us.

Your rights

Depending on where you live, you may have the right to ask for access to, correction of, or deletion of your personal data; restriction of processing; data portability; and information about how your data is used and shared. You may object to processing based on legitimate interests and withdraw consent where processing relies on consent. You also have the right to complain to your local data-protection authority. These rights may be limited where an exemption applies, and we may need to verify your identity before acting on a request.

We respond to rights requests within one month. If a request is complex or you have made several requests, the law may allow us longer, in which case we will explain why.

• Erase stored memories and stop new ones being stored: /opt mode:out, which applies across every server at once.
• Reset your profile and memories: /clear.
• View, delete, or export your retained data, or schedule an account erasure: the portal's Personal tab.
• End portal activity: logging out deletes the current session record.
• Stop collection in one server: remove Jarvis from that server. This does not delete your account-level memories - use /opt mode:out for that.
• Delete other retained records or ask a question: contact us in Section 13.

Jarvis does not profile you for decisions that produce legal or similarly significant effects. Automated safeguards may apply the temporary operational restrictions described in the Terms of Service; if you believe one was applied in error, contact us and we will review it. Some permission-gated moderation tools can affect access to a Discord server; if you want a bot action reviewed, contact that server's moderators or us.

Server features

Some optional features store a small amount of data scoped to one server rather than to your account-level memories. A server admin can turn any of them off, and the data is deleted when Jarvis is removed from the server (Section 11). None of it is sold, used for advertising, or shared beyond what the feature needs.

• Leveling. If a server enables it, Jarvis counts how many messages you send in that server and awards activity XP and a level, shown via /rank and /leaderboard. We store your XP, level, and message count per server, plus a one-minute anti-spam timestamp. We do not store the content of those messages. A server admin can reset it at any time.
• Starboard. If a server enables it, messages that collect enough star reactions are reposted to a highlights channel. We store a small mapping - the original message's ID, the starboard copy's ID, and the current star count - so the highlight stays up to date. The highlight is rendered live from the original message; we do not store the message's text in our database.
• Giveaways. If you click "Enter" on a giveaway, we store your user ID on that giveaway's entrant list so a winner can be drawn and duplicate entries prevented. The list is deleted with the giveaway.
• Tickets. If a server uses ticket support, opening one creates a private thread; we store the thread ID, your user ID as the opener, and whether the ticket is open or closed. When a ticket is closed, staff may save a text transcript to a staff-only log channel they configured - that copy is a Discord message controlled by the server. Ticket records are deleted when Jarvis leaves the server.
• Birthdays. Entirely optional. If you run /birthday set, we store the month and day you provide and your user ID - never the year, and use it to post a birthday greeting (and optionally grant a temporary role for the day) in the server where you set it. Remove it at any time with /birthday clear.
• Counting. If a server runs the counting game, we store the current number, the ID of the last person who counted (to stop one person counting twice in a row), and the record. This is one of the few features that reads messages in a normal channel, and it is limited to the single counting channel an admin designates. It requires the operator to enable Discord's Message Content intent.

When Jarvis leaves a server

If Jarvis is removed from a server, we retain removal-scoped server metadata and safety records for 30 days to investigate abuse, support recovery, and protect other servers. This may include name, ID, icon, member count, aggregated request and token counters, server configuration, channel and role metadata, permission overwrites, AutoMod metadata, invite or webhook metadata, scheduled-event metadata, selected rules/system/announcement messages, and member and role metadata. After 30 days this data is deleted, and the server's configuration is no longer active. Your personal memories are account-scoped, so removing the bot from one server does not delete them. To erase your memories everywhere at once, run /opt mode:out.

Changes to this policy

We may update this policy as the Service, its providers, or the law changes. The current version is always on this page, with its effective date and version at the bottom. Where the law requires it, material changes will be announced in the support server before they take effect. If a change significantly affects how your data is processed, we will make that clear.

Contact

Send privacy requests and questions to the operator at the email below or through the support server. Include your Discord user ID and what you want us to do; do not send passwords, tokens, or unnecessary message content. If you are in the EEA, the UK, or another jurisdiction with a data-protection regulator, you may also complain directly to the supervisory authority where you live or work.

Discord: https://discord.com/invite/ksXzuBtmK5

Email: dev@jorvis.org