Privacy Policy
Last updated: 15 October 2026
This policy explains how Joss handles your information. Joss is a mobile app for iPhone and Android operated by Harbourfront Capital Management Pte Ltd (UEN 202122787C), 18 Robinson Road, Singapore 048547 ("we", "us").
1. The short version
- Joss is designed to keep your data on your phone. You don't create an account with us.
- When you ask Joss to do something, the parts needed for that request are sent to an AI model to work out the answer.
- We don't store the content of your conversations on our servers. We don't sell your data, and we don't show ads.
2. Information kept on your phone
Your conversations, the things Joss remembers about your preferences, your settings, files you create, and logins to websites you visit inside Joss are stored on your device. You can delete them in the app at any time. Deleting the app removes them from the device.
3. Information you let Joss use
Joss asks for permission the first time it needs each of these, and you can turn any of them off in your phone's settings.
- Phone data: calendar, reminders, contacts, location, photos, camera, microphone and speech recognition, and health and motion data (such as steps).
- Wallet: card and passport details you choose to save are stored on your device and protected with Face ID or your phone's biometric lock.
- Calls: if you start a call recording or live captions, the audio is turned into text to make notes. Caller labels and blocked numbers you add are stored on your device. Please follow the recording laws where you are and tell the other person when required.
- Home and device: smart home accessories, music, Bluetooth devices nearby, and sensors such as the barometer and motion.
- Health notes you add: records such as medication, mood or meals that you ask Joss to keep are stored on your device.
- Connected accounts and folders: if you sign in with Google, Joss can read and work with your Gmail (including drafts), Calendar, Drive, Docs, Sheets, Slides, Tasks, Contacts, Chat, Forms and Meet. You can also connect other services such as Notion, Slack, PayPal, Asana or Zapier, and folders such as iCloud Drive, Google Drive or Dropbox. Joss uses only the accounts and folders you connect, and you can disconnect them at any time.
4. How AI processing works
To answer a request, Joss sends the relevant text, and any photo or file you ask about, to an AI model. Joss checks images on your device first and does not send images that contain a card number or a passport page.
Joss AI (default). Requests go through our relay server, hosted on Google Cloud in Tokyo, to OpenRouter, which routes them to model providers that are set to keep no copy of your data (zero data retention) and not to use it for training. Our relay does not store or log the content of your requests. It records only technical information: time, status, response time, number of tokens, cost, and a hashed version of a random installation ID. We use this to prevent abuse and to apply the free monthly allowance.
Your own AI key. If you enter your own API key, requests go directly from your phone to that provider and are governed by that provider's terms and privacy policy.
To make sure requests to our relay come from a genuine copy of Joss, we use Firebase App Check, provided by Google, which relies on the phone's built-in integrity check (App Attest on iPhone, Play Integrity on Android).
5. Websites Joss uses for you
When you ask Joss to book or buy something, it uses websites in a browser inside the app. You sign in to websites yourself. Joss stops and asks you before anything that can't easily be undone, such as sending, buying, deleting or changing a booking. Your purchases and bookings are made with those websites, and their own terms and privacy policies apply.
6. Google user data
Joss's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google data only to carry out what you ask Joss to do. We do not use it for advertising, do not sell it, and do not use it to train AI models. People at our company do not read it.
7. Who we share information with
We do not sell personal data. Information is processed by these service providers only to run Joss:
| Google Cloud and Firebase | Relay hosting and app verification |
|---|---|
| OpenRouter | Routing AI requests |
| AI model providers | Generating answers (zero data retention) |
| Services you connect | The providers of the accounts you connect (for example Google, Notion or Slack), under their own terms |
| Apple and Google Play | App distribution and device verification |
We may also disclose information when the law requires it.
8. Transfers outside your country
Our relay runs in Japan, and AI model providers may process requests in the United States and other countries. We choose providers that protect data to a standard comparable to Singapore's Personal Data Protection Act.
9. How long we keep information
Content stays on your device until you delete it. Our relay keeps only the technical records described in section 4, for as long as needed for security, abuse prevention and usage limits.
10. Your rights
Under Singapore's Personal Data Protection Act, Japan's Act on the Protection of Personal Information and other applicable laws, you can ask to access or correct personal data we hold about you, or withdraw your consent. Because most data stays on your device, you can usually do this directly in the app. To disconnect Google, visit your Google Account permissions.
11. Children
Joss is not intended for children under 13.
12. Changes
If we change this policy, we will update the date above and, for important changes, let you know in the app.
13. Contact
Questions or requests, including for our Data Protection Officer: support@heyjoss.ai