Jenny

Privacy

Every outbound connection Jenny can make

Not "we promise not to look" — there is nowhere for us to look from. No account, no sign-up, no sync, no telemetry, no analytics SDK, no crash reporter. The claim is checkable: no phone-home in the code.

  1. Your configured LLM provider. Messages, session history, tool results, and any workspace file the agent reads — plus your last-known location, on every turn, if location sharing and the Android permission are both on.
  2. Bing. Your web_search queries, only when the agent actually calls the tool. The engine is fixed to Bing — there's no picker.
  3. Sites reached by web_fetch / download_file. Whatever a normal visit reveals: a real, hidden WebView with the phone's own IP, user-agent and cookies.
  4. api.telegram.org. Only if you paired a bot. Off by default. Your conversation transits Telegram's servers under Telegram's terms.

The one caveat we won't hide

android:allowBackup="true" is set on purpose — losing your agent's memory when you change phones would be worse than the alternative. The consequence is real: with Google's automatic backup enabled, the app's private storage — including config.json, which holds API keys in plain text — is eligible for backup to your Google account. Turn app backup off for Jenny if you don't want that, and use the app's own encrypted export instead.

Full privacy model, with every gating condition → · Security model →