What Jimmy keeps, and what it never does

Stored and never stored

Everything Jimmy stores is in one data folder on your PC: the one you picked on first start, or data inside the Jimmy folder for a source install. These rules are absent code paths, not settings that happen to be off.

Faces

• Blurred before anything is written. The clean frame exists only inside one capture tick, in memory. The code only ever passes the blurred frame to the function that saves a screenshot.
• Checked against the detector, not by eye. An early blur fooled the eye but not the face detector. The strength was set by sweeping it against the detector after the JPEG round-trip, and a test re-runs detection on the saved file and requires zero hits.
• Found at full size. Faces are looked for at the full 1280-pixel screenshot size, so small ones are caught too.

Excluded windows and the mic

• Never captured: password managers, banking and payment sites, private or incognito browser windows, and Jimmy's own windows. This list shipped before the first run. Add your own in data\exclusions.txt.
• The mic pauses on sensitive screens, so a one-time code read aloud never reaches a transcript. The exception: if another app such as Teams or Zoom is using the mic, recording continues so a meeting isn't lost.
• System audio is never captured. The other side of a call is a consent problem, not a feature flag.
• While paused, the mic listens only for the name. Nothing is stored until you say "Jimmy, resume".
• Your own commands are not captured speech. What you say to Jimmy is stored as a command and kept out of search, so a question can't answer itself.

The webcam

The webcam exists for the privacy curtain: when you leave, capture and listening stop. By default it only finds a face and follows where you sit. After you say "remember my face", it compares a new face with your encrypted template once, not on every frame. Every other face's vector exists for one comparison and is dropped.

For your face only, it notes whether you're looking at the screen and whether your lips are moving, as yes/no values kept in memory for two minutes, so you can ask without saying the name. No webcam frame is ever kept. "Forget my face" deletes the template.

What leaves your PC

Capture, storage, search, card decisions and meaning search all run on your PC. With a model key set, these go to the provider you chose (NVIDIA, Google or OpenAI), under that provider's own privacy policy:

• The evidence shown with an answer, at most 6,000 characters, with your question.
• The rare card candidate that the cloud double-checks before a RECALL card. Set JIMMY_RECALL_VERIFY=none to keep cards fully local.
• For a question about your screen, or a task that needs a look: that window's latest picture, with faces already blurred and never from an excluded window. Set VISION_SCREEN = False for text-only screen answers.
• The names of the window's buttons and boxes while Jimmy works out what you asked it to do.
• Once a day, what it needs to keep your wiki (what Jimmy knows about you): your lists, your questions to it, and window titles.

Without a key, none of this is sent. If you connect the MCP server, what its recall tool returns goes to that assistant. During setup, packages and models download from their usual sources (Python packages, npm, Ollama's library and Hugging Face for Whisper). The installed app (from 1.0.1) also asks GitHub every six hours whether a newer release exists, and downloads it if so; Settings turns that off. Jimmy has no telemetry and no account, and its author receives nothing.

Actions on your screen

Jimmy acts on other apps only through Windows' accessibility interface (UI Automation), never by moving your mouse. Its own cursor shows each action before it happens. Every proposed action passes a policy layer in code, whatever model proposed it, which returns one of four answers:

The one key Jimmy ever sends is Enter, and only after UI Automation focused that box and the focus was checked. It never acts in excluded windows. After each action, code checks that it worked (the box holds the text, the page changed) and stops at the first surprise.

Text on screen is data, not instructions

A web page saying "ignore previous instructions" is exactly the kind of thing that gets captured. Captured text reaches the model only inside a context block, below a rule to ignore any instructions found there. The rules for actions don't depend on the model obeying that: they live in the policy layer above. Cards are written by code from words in your own data, never by a model.

The local connection

The Python program and the overlay talk over a small web interface bound to 127.0.0.1, on a port Windows picks, so it can't be reached from other machines. Every request needs a random token made fresh for each run. Only one Jimmy can run at a time.

What is not done yet

We would rather you know:

• Jimmy has not had an independent security audit. The code and every design decision are public for anyone to review.
• Captures are not encrypted on disk. Anyone or any program with access to your Windows account can read the data folder.
• Keys from a source install are plain text in .env or your user environment. Keys typed into the installed app's setup are encrypted with Windows DPAPI.
• A source install has no retention limit. The installed app keeps 30 days and 20 GB by default, which you can change in Settings.
• The setup isn't code-signed yet. Check its SHA-256 against the published value before running it.
• The face-matching threshold is OpenCV's reference value, not yet tuned on real webcam footage.
• A face embedding is biometric data under India's DPDP Act even if it is never stored. This design shrinks that exposure a lot; it does not take it to zero.
• The mic hears the room. Anyone speaking near it is transcribed. Tell the people around you that Jimmy is running.