Privacy policy

This policy describes how the JARVIS personal local assistant uses Google user data when the owner authorizes Gmail access. It applies to the local software and to this informational website at jarvislocal.com.tr.

Effective date: 15 October 2026

1. Who operates JARVIS

JARVIS is a personal application operated by its owner on the owner’s own computer. It is not offered as a public multi-user service. This website does not provide accounts, cloud hosting of the assistant, or a way for the public to connect Gmail.

2. Google permissions requested

When Gmail integration is enabled, the local installation requests these OAuth scopes:

• openid — authenticate the Google account.
• email / userinfo.email — read the account email address to confirm it matches the owner-configured sender address.
• https://www.googleapis.com/auth/gmail.send — send email through the owner’s Gmail account.
• https://www.googleapis.com/auth/gmail.readonly — read Gmail messages needed for bounded job-alert discovery and application-response monitoring.

JARVIS does not request gmail.modify, mail.google.com, or other full-mailbox control scopes. JARVIS does not store the owner’s Google password.

3. Why access is needed

• Identity: confirm that the authorized Google account is the expected owner account before send or mailbox reads.
• Send: deliver owner-authorized job-application messages (and optional CV attachment) via Gmail.
• Read (limited): discover job alerts from known senders (such as LinkedIn or Kariyer.net) and observe employer or ATS replies related to applications, using fixed search queries rather than unrestricted mailbox browsing.

4. What Gmail data is processed

• Account email address and related OpenID / UserInfo identity fields used for verification.
• Message identifiers and raw message content for messages that match the configured search queries, processed to extract job listings or response metadata.
• Outbound message content composed by JARVIS (subject, body, optional CV file) when a send is authorized.

Unrelated mailbox content outside those queries is not a designed target of intake. The Gmail API still technically grants read access consistent with gmail.readonly; JARVIS is built to call list/get only for the bounded queries above.

5. Where data is stored and processed

Processing runs on the owner’s local machine. Derived records (for example job opportunities, application attempt status, short evidence notes about employer responses, and processed Gmail message identifiers) are stored in local application data and a local SQLite database on that machine. OAuth access and refresh tokens are stored in a local token directory under the application’s data folder.

Full Gmail message bodies are used transiently for parsing. JARVIS is not designed to keep a permanent archive of entire mailboxes. Message identifiers and limited derived fields may be retained locally for deduplication and review.

6. Data that leaves the owner’s computer

• Google: OAuth token exchange and Gmail API requests (list, get, send) are sent to Google over HTTPS as required to use those APIs.
• Email recipients: when the owner authorizes a send, message content and any attached CV are delivered through Gmail to the chosen recipients.

JARVIS does not operate a JARVIS cloud backend that receives Google user data from the local installation. This public website does not receive Gmail data, tokens, or local database contents.

7. Sharing with third parties

JARVIS does not sell Google user data and does not share Gmail contents with advertising or analytics vendors. Google receives API traffic as the service provider. Employers or other recipients receive only what is included in emails the owner authorizes JARVIS to send. This informational site loads no advertising or analytics scripts.

8. Limited use

Google user data obtained through these scopes is used only to provide the Gmail-related features described here (identity verification, bounded mailbox reads for job discovery and response monitoring, and authorized sending). It is not used for serving advertisements, and it is not sold.

9. Retention and deletion

• Local OAuth tokens remain until the owner clears them in the local JARVIS Gmail settings, deletes the local token files, or until Google invalidates them.
• Local derived records remain in the owner’s local database and data files until the owner deletes them or removes the local installation data.
• There is no separate JARVIS-hosted copy of Gmail data to erase on a remote server.
• Email already stored in Gmail (including sent mail) remains subject to Google’s retention for that account.

10. How to revoke access

• In JARVIS (local): use the Gmail authorization page to remove stored local OAuth tokens. That stops the local app from calling Gmail until the owner authorizes again.
• In Google Account: open Google Account → Security → Third-party access (or “Your connections to third-party apps”) and revoke access for JARVIS / the OAuth client. This is the authoritative way to withdraw Google’s grant.

Clearing local tokens alone does not always revoke the grant on Google’s side; use Google Account controls for a complete revocation.

11. This website

jarvislocal.com.tr publishes only static informational pages (homepage and this policy). It does not collect Gmail data, does not set tracking cookies for analytics, and does not embed third-party advertising or analytics scripts.

12. Contact

Privacy questions about JARVIS or this site: privacy@jarvislocal.com.tr

13. Changes

If Gmail scopes or data practices change in a material way, this policy will be updated and the effective date revised.