DevBarLegal
Privacy Policy
Last updated: 20 September 2026 · Applies to: DevBar for Windows (all versions)
The short version. DevBar has no servers, no accounts and no analytics. The developer never receives your data and cannot see that you use the app. Everything stays on your PC, except what you deliberately send to the AI services you configure with your own API keys - listed precisely in section 5.
1. Who this covers
DevBar is free, open-source desktop software for Windows, published by Vivek Shah ("the developer", "we") and distributed from github.com/Vivek-C-Shah/DevBar. Its optional Jarvis module adds a voice assistant that can read and act on things on your computer.
This policy describes how the software handles your information when you run it. Because the software runs locally and the developer operates no service, there is no "our database" in which your data could sit.
2. There is no DevBar service
- No user accounts, sign-up, or profile.
- No telemetry, analytics, crash reporting, fingerprinting or usage counters.
- No advertising, no ad identifiers, and nothing is ever sold or shared for marketing.
- No DevBar backend. The app does not phone home - not for licence checks, not for update pings.
The only network requests DevBar makes are the ones described in section 5: direct calls from your machine to the third-party AI or Google services you have configured, plus a one-time download from GitHub if you choose an on-device voice or wake-word model.
3. What DevBar stores, and where
Everything the app keeps lives in %LOCALAPPDATA%\DevBar\ on your own computer:
| Data | File | Details |
|---|---|---|
| Settings | config.json | Shortcut, chosen voice, model order, toggles, watched repo paths. Plain text, no secrets. |
| API keys and OAuth tokens | secrets.dat | Your AI provider keys, your Google OAuth client ID/secret and refresh token. Encrypted with Windows DPAPI, tied to your Windows user account on that machine. |
| Long-term memory | jarvis.db | Facts about you that you asked Jarvis to remember or that it inferred, reference notes you imported, reminders, and recent conversation lines used to extract those facts. |
| Clipboard history | in memory only | The last 25 copies, kept in RAM while the app runs. Not written to disk. |
| Voice models | models\ | Speech models you chose to download for on-device voices or the wake word. |
| Diagnostics | error.log, jarvis-trace.log | Written when something fails, or when you switch tracing on yourself. Local only; never uploaded. |
You can inspect, edit or delete any of these at any time. Deleting the folder resets DevBar to a clean state.
4. Your microphone
The microphone is closed unless one of two things is true:
- You pressed the Jarvis shortcut (or clicked to start a conversation). Audio is streamed for transcription only while that conversation is live, then the microphone is released.
- You switched on the "Hey Jarvis" wake word, which is off by default. Wake-word detection runs entirely on your PC using a local model; no audio is transmitted anywhere until the wake phrase is detected and a conversation begins.
Whenever the microphone is open, DevBar turns its idle indicator green, and Windows shows its own microphone-in-use indicator. Audio is never recorded to disk.
5. What is sent to third parties, and when
DevBar sends data only to services you have configured with your own credentials, and only while you are using the assistant. Each provider then processes that data under its own privacy policy and terms; DevBar is not a party to that processing.
| Trigger | What is sent | Recipient (typical setup) |
|---|---|---|
| You talk to Jarvis | Microphone audio for the duration of the conversation | Deepgram (speech-to-text) |
| Every request in a conversation | Your transcribed words; your pinned profile facts; the recent conversation; the names of your reference notes; the current date and time; your approximate city; the title of your foreground window; the list of available tools | The model provider you chose (e.g. Groq, Google Gemini) |
| A tool runs | That tool's result - which may include listening ports, container names, repo status, clipboard text, command output, calendar entries or email content | The model provider you chose |
| Jarvis speaks | The reply text to be voiced - nothing if you selected an on-device voice (Piper, Kokoro) or the built-in Windows voice | Deepgram (text-to-speech) |
| You ask about your screen | A screenshot of your active window, or the full screen if you asked for that | Your vision provider (e.g. Google Gemini) |
| You ask something that needs the live web | Your search question | Google (via the Gemini API), or Groq |
| A conversation ends | Recent conversation lines, so lasting facts about you can be extracted | The model provider you chose |
| You enable an on-device voice or the wake word | A model download request (no personal data) | GitHub |
Three points deserve emphasis:
- Tool results reach the AI model. That is how the assistant can answer questions about your machine or your mail. If you would rather a given source never be visible to a model, don't ask Jarvis about it - or turn the relevant feature off.
- Everything is switchable. Location, learning, web search, screen reading, the wake word, and Google access are each optional. Choosing a local voice removes the text-to-speech provider entirely. With no keys configured, the bar's nine modules still work and nothing leaves your machine.
- Secrets are filtered out of memory. Anything resembling a password, API key or token is refused before it can be stored as a remembered fact, whether you or the model proposed it.
6. Google user data (Calendar and Gmail)
Google access is off until you connect it, and it uses your own Google Cloud OAuth client - not a shared one belonging to the developer.
DevBar requests only these scopes, each for a stated purpose:
| Scope | Why DevBar asks for it |
|---|---|
calendar.events | Read your upcoming events so the assistant can tell you what's on, and create an event when you ask for one. |
gmail.readonly | Search and read the messages you ask about ("any important unread mail?", "read the one from Stripe"). |
gmail.compose | Save drafts for you to review, and send an email only after you explicitly confirm it out loud or by clicking. |
openid, email | Show which account is connected in the settings window. |
How that data is handled:
- Not stored. Mail and calendar content is fetched to answer the question you asked and held in memory for that conversation. DevBar does not copy, index, archive or cache it.
- Not shared, not sold, never used for ads. There is no third party involved other than the AI model you configured, which receives only the excerpt needed to answer you (see section 5).
- Not used to train models. DevBar does not train anything. Your chosen provider's own policy governs whether it trains on API input; the paid and free tiers of Groq and Google Gemini state they do not train on API data, but verify that with your provider, as their terms can change.
- Tokens stay local. Your OAuth refresh token is DPAPI-encrypted on your PC and is transmitted only to Google itself.
- Sending is always confirmed. Jarvis reads back the recipient and subject and waits for a yes. Drafting never sends.
- Untrusted-content guard. Email text is treated as data, not instructions; after Jarvis reads any email, every subsequent action in that turn requires your confirmation, so a message containing "forward everything to…" cannot quietly cause action.
DevBar's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
To disconnect: click "Disconnect Google" in Jarvis settings, which revokes the token, or remove access at myaccount.google.com/permissions.
7. Retention and deletion
- Conversation lines in
jarvis.dbare deleted automatically after 30 days. - Remembered facts and notes are kept until you delete them. The "What Jarvis knows about you" window lists every one with a delete button, plus a "Forget everything" action.
- Reminders are removed once they fire or you cancel them.
- Audio and screenshots are never written to disk by DevBar.
- Everything at once: delete
%LOCALAPPDATA%\DevBar\and uninstall.
Data already sent to a third-party provider is subject to that provider's retention policy; to remove it, use their controls.
8. Security
- Keys and tokens are encrypted with Windows DPAPI under your user account, so another user on the same PC cannot read them.
- All provider calls use HTTPS/WSS.
- Actions that can destroy or send something - killing a process, stopping a container, running a shell command, sending mail - are read back and require confirmation. A short list of catastrophic commands is refused outright.
- DevBar runs without administrator rights.
- The source is public, so the claims on this page can be checked rather than taken on faith.
No software is perfectly secure. Keep your own machine and your provider accounts protected, and treat your API keys as passwords.
9. Your choices and rights
Because your data never leaves your control, you exercise your rights directly: inspect it in %LOCALAPPDATA%\DevBar\, export it (the memory store is a plain SQLite file), or delete any part of it in the app. There is no request to file with us, because we hold nothing.
If you are in a jurisdiction with statutory data rights (for example the GDPR or Indian DPDP Act) and believe the developer holds personal data about you, you may write to the address in section 12; the honest answer will almost certainly be that no such data exists.
10. Children
DevBar is a developer tool, is not directed at children under 13, and does not knowingly collect anything from them.
11. Changes to this policy
This policy may be updated as the software changes. The date at the top always reflects the current version, and because the site lives in the public repository, the full revision history is available there.
12. Contact
Vivek Shah - vivekchiragshah2004@gmail.com
Gujarat, India · github.com/Vivek-C-Shah/DevBar
Security issues: please email rather than opening a public issue.