Privacy policy

In short

• Jastra reads your notes to work for you, and for nothing else. Nothing is sold, and nothing trains a model.
• Jastra is software alone: no one at Jastra reads your notes unless you ask for support and allow it.
• Your data is kept on Jastra's server in Singapore, and its encrypted backups in the EU.
• To work for you, Jastra sends your notes to three AI companies, mostly in the United States. Voyage turns them into search data and deletes them once processed, Anthropic (Claude) reads them to answer you, and Google (Gemini) reads your images if you turn image reading on. Your questions go only to Anthropic and Voyage, never to Google. Anthropic keeps what it gets 30 days, or up to 2 years if flagged as abuse; Google keeps images 55 days. None of them trains on your notes.
• Jastra shows you each time it reads your notes, and you can disconnect at any time. If Apple stops letting Jastra read them, Jastra deletes your iCloud sign-in at once and tells you, and deletes what it read 14 days later unless you sign in again and Apple lets it read.
• Delete a note and it leaves Jastra's server at the next sync, and its backups within 14 days. Delete your account and Jastra deletes your session and stops reading at once; you have 14 days to change your mind, and within 30 days of asking it holds none of your notes or your session, backups included. If something goes wrong with Jastra's backups, that can take up to 45 days, and backups can hold your data for up to 30 days instead of 14, unless the problem keeps happening. The AI providers keep their copies on their own terms, which can run longer. The detail below has the limits.
• Jastra keeps your conversations with it so you can come back to them, until you delete them. Deleting a note also deletes every conversation that drew on it.
• You sign in to Jastra with Apple, Google, or your email and a password. Apple and Google tell Jastra only that it's you, with your name and email; they never see your notes. If you sign in with Apple or Google, Jastra keeps a token from them that only shows your name and email, so it can cut off its own access when you leave. If you sign in with email, Jastra stores your password only as a one-way hash, and refuses a password already leaked elsewhere.

In detail

1. What Jastra holds: your notes and their attachments (photos, screenshots, drawings, and other files), the text a vision model makes from those images, the index and wiki built from all of it, your conversations with Jastra, your sign-in methods and devices, and the iCloud session above.
2. Use: only to serve you. Your data is never sold and never used to train any model; the model providers never train on it.
3. People: Jastra is software alone. No one at Jastra reads your content unless you ask for support and allow it, and that access is logged. If that is later changed so that people may read content, the change covers only content you send after agreeing to it. Until that log exists, no one has support access at all.
4. Model providers: your content leaves Jastra's server for three AI companies, through their APIs and under terms that do not train on it: Voyage, which makes search data from it and deletes it once processed, with Jastra's account opted out of training; Anthropic (Claude), which reads it to answer you and keeps it 30 days; and Google (Gemini, paid tier only), which reads your images if you turn on image reading, and keeps them 55 days. Your questions go under the same terms: Anthropic gets each question, with your earlier turns and the passages it draws on, and Voyage embeds each question. They handle it mostly in the United States, not Singapore. Content one of them flags as abuse can be kept longer: Anthropic up to 2 years.
5. Where: Jastra's server, in Singapore, and its nightly backups, encrypted before they leave it, at a backup provider in the EU that cannot decrypt them, plus what the model providers process, above. Your data reaches Jastra's server encrypted, and nothing on the way can read it. Jastra also keeps a spare copy of the key that unlocks your iCloud sign-in, apart from its server.
6. Signing in: Sign in with Apple and Sign in with Google give Jastra your name, your email (with Apple, a private relay address if you choose), and an identifier for your account; they learn that you signed in to Jastra, and see nothing you keep in it. When you sign in with Apple or Google, Jastra keeps a token from that company, encrypted as soon as it arrives so that only the part of Jastra that fetches your notes from iCloud can open it. The token shows your name, email, and an account identifier, and reaches nothing else of yours at Apple or Google. Jastra uses it only to end its own access: when you remove that way of signing in, or when your account's deletion runs at the end of the 14 days. Until then, signing in again cancels the deletion without granting Jastra anything new.
7. Passwords: Jastra stores your password only as a one-way hash, never the password itself. When you choose one, Jastra checks it against Have I Been Pwned's list of passwords leaked from other sites by sending only the first five characters of a one-way hash of it, which hundreds of other passwords share, so Have I Been Pwned never sees your password, your email, or your notes, or learns whose it is. Jastra refuses a password that has leaked; if the check can't be reached, it lets you use the password and warns you.
8. Email: Scaleway sends Jastra's emails to you. It sees your address and each email's text, never your notes; it handles them in France, deletes the text within 7 days of delivery, or 22 days if it is never delivered, and keeps your address and each subject line while Jastra sends with Scaleway.
9. Your iCloud sign-in: the app encrypts your iCloud sign-in before it leaves your device, so that only the part of Jastra that fetches your notes from iCloud can open it; the part the app talks to over the internet only passes it on. That does not hold against someone who takes control of Jastra's server, as below.
10. Seeing and stopping: Jastra shows you each time it reads your notes. You can disconnect at any time: Jastra stops reading at once and deletes your iCloud session, and what it read waits 14 days and is then deleted from Jastra's server within 24 hours, and from its backups within 14 days of that, as under Backups below, unless you reconnect and Apple lets Jastra read. If Apple stops letting Jastra read your notes, as it does once Advanced Data Protection is on or iCloud data access on the web is off, Jastra deletes your session at once and tells you in the app. What it read before then is kept 14 days, so you can put the setting right, and then deleted from Jastra's server within 24 hours and from its backups as under Backups below, unless you sign in again and Apple lets Jastra read; you can delete it sooner.
11. Deleting your account: when you ask to delete your Jastra account, Jastra deletes your session from its server and stops reading at once. Your notes, index, and wiki wait 14 days, so you can cancel and find everything as you left it; signing in by any method still reaches your account during the 14 days, to cancel. After those 14 days, everything, your sign-in methods, devices, and conversations included, is deleted from Jastra's server within 24 hours, and from its backups as under Backups below, and Jastra ends its access at Apple and Google. So none of your notes or your session remains at Jastra 30 days after you ask, backups included, or 45 days if something goes wrong with its backups.
12. Deleting a note or a conversation: a note you delete in Apple Notes leaves Jastra's server at the next sync, and its backups within 14 days of that sync, as under Backups below. When a note leaves Jastra's server, every conversation whose answers drew on it is deleted with it; editing a note leaves earlier answers as they were. Your conversations are kept until you delete them, one or all at any time, or delete your account, and deleted ones leave Jastra's backups the same way as your notes.
13. Backups: backups are encrypted before they leave Jastra's server, and no backup holds any of your data, even encrypted pieces a deletion leaves behind, more than 14 days after it leaves Jastra's server. If something goes wrong with Jastra's backups, they can hold your data for up to 30 days after it leaves Jastra's server instead of 14, unless the problem keeps happening.
14. What Jastra keeps, and for how long: server logs, which can hold your IP address and details of your requests but never your notes, what you search for or ask, or anything you send, are kept 30 days and then deleted. Jastra's record of when it read your notes, and of any support access, is kept as long as your account and deleted with it, so you can check both for as long as you use Jastra. The model providers keep their copies on their own terms, as above: Voyage none, Anthropic 30 days, up to 2 years if flagged as abuse, and Google 55 days.
15. Breaches: if Jastra learns your data has been exposed, it tells you within 72 hours, in the app and by email. Some breaches it may not learn of, as below.

What it cannot cover: encrypting sessions protects dumps and backups, not against someone in control of the running server, and Jastra's log of its own reads lives on that same server, as does the log of any support access. Someone in control of the server could read sessions and content and alter both logs, so a breach of that kind may go unseen. Nor does it promise that removing Jastra from your Apple Account cuts it off, which is untested.