Jo Privacy Policy

Jo Privacy Policy

1. Introduction

Jo, Inc. (“Jo,” “we,” “our,” and/or “us”), located in San Francisco, California, values the privacy of individuals who use our macOS application, Telegram bot, WhatsApp bot, websites, and related services (collectively, our “Services”). This privacy policy (the “Privacy Policy”) explains how we collect, use, and disclose information from users of our Services (“Users”). By using our Services, you agree to the collection, use, disclosure, and procedures this Privacy Policy describes. Beyond the Privacy Policy, your use of our Services is also subject to our Terms of Service.

2. Notice at Collection

The following table describes the categories of personal information we collect, the purposes for which each category is used, whether the information is sold or shared, and our retention periods, as required by the California Privacy Rights Act (CPRA) §1798.100(a).

Category of Personal Information	Purpose(s)	Sold or Shared	Retention Period
Identifiers (name, email address, user ID, device identifiers, IP address)	Provide and improve Services; communicate with you	Not sold or shared	Duration of account + 30 days
Communications content (text messages, photos, voice messages, videos, attachments sent to bot)	Provide AI assistant services; improve Services	Not sold	Duration of account + 30 days
Email and calendar data (accessed on-demand via Google APIs)	Provide briefings and summaries as requested by you	Not sold or shared	Temporarily during request processing; not stored long-term
Active window content (text and images from macOS frontmost window)	Provide context-aware responses	Not sold or shared	Temporarily during session; not stored long-term
Precise geolocation	Location-relevant responses	Not sold or shared	Duration of account + 30 days
Commercial information (purchases, subscription history)	Process payments; manage subscriptions	Not sold or shared	Duration of account + 3 years for tax/legal compliance
Internet/electronic activity (pages viewed, interactions, timestamps, device info, browser type, operating system)	Analytics; improve Services; security	Shared with analytics providers (PostHog, Google Analytics)	26 months (analytics); duration of account (device/usage data)
Contacts/address book	Facilitate social interactions you initiate	Not sold or shared	Duration of account
Audio/voice data (microphone input when enabled)	Voice-based AI assistant interaction	Not sold or shared	Temporarily during processing; not stored long-term
Third-party account information (Google profile, username, photo)	Authentication; account creation	Not sold or shared	Duration of account + 30 days
Inferences (preferences, interests derived from usage)	Personalize service	Not sold or shared	Duration of account + 30 days
Sensitive personal information (precise geolocation, contents of communications, voice data)	Provide core AI assistant services	Not sold or shared	See specific categories above

3. Information We Collect

We may collect a variety of information from or about you or your devices from various sources, as described below.

A. Information You Provide to Us.

Registration Information. When you register to use our Services with a third-party email account, we ask you for your name and email address. From those third-party services, we will also receive information such as your name and email address, and access to your inbox and calendar.

Communications. If you contact us directly, we may receive additional information about you, such as your name, email address, phone number, the contents of a message or attachments that you may send to us, and other information you choose to provide. If you subscribe to our newsletter, then we will collect certain information from you, such as your email address. When we send you emails, we may track whether you open them to learn how to deliver a better customer experience and improve our Services.

Payment Information. If you make a purchase through our Services, your payment-related information, such as credit card or other financial information, is collected by our third-party payment processor on our behalf.

B. Information We Collect When You Use Our Services.

Communications with our Bot. When you communicate with our bot, we will receive whatever information you provide to the bot, such as your zip code, the number of people in your household, your personal interests, the contents of a message or attachments that you may send to us (including any photos, voice messages, videos, and other information you choose to provide).

Voice Data. If you enable microphone access in our macOS application, we collect audio input from your microphone to provide voice-based AI assistant interaction. Voice data is processed to generate transcriptions and responses to your spoken queries.

Email and Calendar Contents. If you ask our Services to provide a briefing, summary, or otherwise interact with your emails or calendar events, we retrieve information from your emails and calendar through third-party APIs on demand to respond to your requests. Our Services limit the information retrieved to what is reasonably necessary to respond to your request.

Active Window Content. Our macOS application allows you to share content from your active window with our Services to respond to your requests. If you enable “Share active window” in the settings of our macOS application, we collect and temporarily process text and images from your active window while our application is running.

Location Information. When you use our Services, we may receive your precise location information to help us tailor our responses to be relevant to your location. We also infer your general location information, for example by using your internet protocol (IP) address.

Device Information. We receive information about the device and software you use to access our Services, including IP address, device type, web browser type and version, operating system version, phone carrier and manufacturer, and device identifiers.

Usage Information. To help us understand how you use our Services and to help us improve them, we automatically receive information about your interactions with our Services, like the pages or other content you view, referrer information (where you came from), purchases you make, and the dates and times of your visits.

Your Contacts. If you permit us to access the address book on your device or give us permission to import your contacts from an email account associated with your account, we may access and store names and contact information from your address book to facilitate invitations and social interactions that you initiate through our Services and for other purposes described in this Privacy Policy or at the time of consent or collection. We also collect your contacts if you invite them to use our Services or share information or content with them from our Services.

Information from Cookies and Similar Technologies. We and our third-party partners collect information using cookies, pixel tags, or similar technologies. Our third-party partners, such as analytics partners, may use these technologies to collect information about your online activities over time and across different services. Cookies are small text files containing a string of alphanumeric characters. We may use both session cookies and persistent cookies. A session cookie disappears after you close your browser. A persistent cookie remains after you close your browser and may be used by your browser on subsequent visits to our Services.

Please review your web browser’s “Help” file to learn how you may modify your cookie settings. Please note that if you delete or choose not to accept cookies from the Service, you may not be able to utilize the features of the Service to their fullest potential.

C. Information We Receive from Third Parties.

Information from third-party services. When you access our Services through a third-party account, we may receive information about you, including your username, user ID, profile information, your photo, and your use of the third-party account. If you wish to limit the information available to us, you should visit the privacy settings of your third-party accounts to learn about your options. Our use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

4. How We Use the Information We Collect

We use the information we collect:

To provide, maintain, improve, and enhance our Services;
To improve our Services, including by analyzing aggregated and de-identified usage patterns. We do NOT use your bot communications, email/calendar content, active window content, or voice data to train third-party AI models. We may use de-identified and aggregated data to improve our own service quality;
To personalize your experience on our Services such as by providing tailored questions and recommendations;
To understand and analyze how you use our Services and develop new products, services, features, and functionality;
To communicate with you, provide you with updates and other information relating to our Services, provide information that you request, respond to comments and questions, and otherwise provide customer support;
For marketing and advertising purposes, such as developing and providing promotional and advertising materials that may be relevant, valuable, or otherwise of interest to you;
To generate anonymized, aggregate data containing only de-identified, non-personal information that we may use for any lawful purpose;
To send you text messages and push notifications;
To facilitate transactions and payments;
To find and prevent fraud and abuse, and respond to trust and safety issues that may arise;
For compliance purposes, including enforcing our Terms of Service or other legal rights, or as may be required by applicable laws and regulations or requested by any judicial process or governmental agency;
To comply with the California Consumer Privacy Act (CCPA), the California Privacy Rights Act (CPRA), and other applicable privacy law obligations; and
For other purposes for which we provide specific notice at the time the information is collected.

5. How We Disclose the Information We Collect

Affiliates. We may disclose any information we receive to our affiliates for any of the purposes described in this Privacy Policy.

Vendors and Service Providers. We may disclose any information we receive to vendors and service providers retained in connection with the provision of our Services.

AI Model Providers. To generate responses to your queries, we transmit your communications to third-party large language model providers (e.g., Anthropic, OpenAI, Google, xAI, Moonshot AI, DeepSeek) that process your communications to generate responses. These providers act as service providers and processors and are contractually prohibited from using your data for their own model training purposes.

Third-Party App Integrations. When you access or register for our Services through a third-party account, we may disclose information such as your email and username to that third party.

Social Networks and Other Online Services. Our Services allow you to, upon your direction, disclose information to social networking services, such as X, Facebook, and Instagram. You understand and agree that the use of your information by any social networking websites will be governed by the privacy policies of these third-party platforms and your settings on that platform. We encourage you to review their privacy policies.

Analytics Partners. We use analytics services such as PostHog and Google Analytics to collect and process certain analytics data. These services may also collect information about your use of other websites, apps, and online resources. You can learn more about Google’s practices by visiting https://www.google.com/policies/privacy/partners/ and PostHog’s practices by visiting https://posthog.com/privacy.

As Required By Law and Similar Disclosures. We may access, preserve, and disclose your information if we believe doing so is required or appropriate to: (a) comply with law enforcement requests and legal process, such as a court order or subpoena; (b) respond to your requests; or (c) protect your, our, or others’ rights, property, or safety. For the avoidance of doubt, the disclosure of your information may occur if you post any objectionable content on or through the Services.

Merger, Sale, or Other Asset Transfers. We may transfer your information to service providers, advisors, potential transactional partners, or other third parties in connection with the consideration, negotiation, or completion of a corporate transaction in which we are acquired by or merged with another company or we sell, liquidate, or transfer all or a portion of our assets. The use of your information following any of these events will be governed by the provisions of this Privacy Policy in effect at the time the applicable information was collected.

Consent. We may also disclose your information with your permission.

We do not sell your personal information as defined under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA).

We share internet/electronic activity information with analytics providers (PostHog, Google Analytics) for service improvement purposes, which may constitute “sharing” under the CPRA. You may opt out of this sharing as described in Section 9 (“Do Not Sell or Share My Personal Information”) below.

6. Sensitive Personal Information

Under the California Privacy Rights Act (CPRA) §1798.121, certain categories of personal information are classified as “sensitive personal information.” Jo collects the following categories that qualify as sensitive personal information:

Precise geolocation: Used to provide location-relevant AI assistant responses when you enable location sharing.
Contents of mail, email, and text messages: Your communications with the Jo bot, and email/calendar content accessed on your behalf, are used to provide the core AI assistant services you request.
Audio/voice data: When you enable microphone access, voice input is processed to provide voice-based AI assistant interaction.

We use sensitive personal information solely for the purpose of providing the AI assistant services you request. We do not use or disclose sensitive personal information for purposes beyond what is necessary to provide those services, including not using sensitive personal information for advertising, profiling, or any purpose other than delivering the Services.

You have the right to limit our use of your sensitive personal information to only those uses that are necessary to provide the Services. To exercise this right, please contact us at [email protected] or through the Jo application.

7. Your Privacy Rights (California Residents)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

Right to Know (CCPA §1798.100, §1798.110, §1798.115). You have the right to request that we disclose to you the categories and specific pieces of personal information we have collected about you, the categories of sources from which your personal information was collected, the business or commercial purposes for collecting or selling your personal information, the categories of third parties to whom we have disclosed your personal information, and any personal information sold or shared and the categories of third parties to whom it was sold or shared.

Right to Delete (CCPA §1798.105). You have the right to request that we delete the personal information we have collected about you, subject to certain exceptions provided by law (such as where the information is necessary to complete a transaction, detect security incidents, comply with legal obligations, or for certain internal uses compatible with your expectations).

Right to Correct (CCPA §1798.106). You have the right to request that we correct inaccurate personal information that we maintain about you, taking into account the nature of the personal information and the purposes of the processing.

Right to Opt-Out of Sale/Sharing (CCPA §1798.120). We do not sell your personal information. We share certain internet/electronic activity data with analytics providers, which may constitute “sharing” under the CPRA. You have the right to opt out of this sharing. See Section 9 (“Do Not Sell or Share My Personal Information”) below.

Right to Limit Use of Sensitive Personal Information (CPRA §1798.121). You have the right to limit our use of your sensitive personal information to only those uses that are necessary to provide the Services. See Section 6 (“Sensitive Personal Information”) above.

Right to Non-Discrimination (CCPA §1798.125). We will not discriminate against you for exercising any of your privacy rights under the CCPA/CPRA, including by denying you goods or services, charging you different prices or rates, providing you a different level or quality of service, or suggesting that you will receive a different price or level of quality.

Right to Data Portability (CCPA §1798.100(d)). When you exercise your right to know, you have the right to receive your personal information in a structured, commonly used, machine-readable format that allows you to transmit the information to another entity without hindrance.

Right to Access Information About Automated Decision-Making. You have the right to access information about how automated decision-making technology is used in connection with your account. See Section 8 (“Automated Decision-Making Technology”) below.

How to Submit Requests. You may submit a verifiable consumer request to exercise any of the rights described above through two methods:

Email: [email protected]
In-app: Through the Jo macOS application or by messaging the Jo bot

Verification Process. We will verify your identity before fulfilling your request by confirming information associated with your account (such as your email address or account credentials). For requests submitted through authenticated accounts, account authentication serves as identity verification. For non-authenticated requests, we may require additional information to verify your identity.

Authorized Agents. You may designate an authorized agent to submit requests on your behalf. We require the authorized agent to provide proof of your written authorization and will verify your identity directly.

Response Timing. We will respond to verifiable consumer requests within 45 calendar days of receipt. If we need additional time (up to 90 calendar days total), we will notify you of the extension and the reason for it.

8. Automated Decision-Making Technology (ADMT)

In accordance with the California Privacy Protection Agency regulations (16 CCR §§7150–7153), effective January 1, 2026, we provide the following information about our use of automated decision-making technology:

Jo uses artificial intelligence and automated processing to generate responses to your queries, summarize information, and perform tasks on your behalf. These automated processes are integral to providing the core AI assistant services.

These automated processes do not make legally significant decisions about you, such as decisions related to employment, credit, insurance, housing, or education.

You have the right to access information about how automated decision-making technology is used in connection with your account. You may also opt out of automated decision-making technology processing where such processing produces legal or similarly significant effects on you.

To exercise these rights, please contact us at [email protected].

9. Do Not Sell or Share My Personal Information

Jo does not sell your personal information as defined under the CCPA/CPRA.

Jo shares certain internet/electronic activity data with analytics providers (PostHog, Google Analytics) for service improvement purposes, which may constitute “sharing” under the CPRA.

To opt out of the sharing of your personal information:

Contact us at [email protected]
Adjust your cookie and analytics preferences through your browser settings

Jo honors Global Privacy Control (GPC) signals. When we detect a GPC signal from your browser, we treat it as a valid opt-out request for the sale or sharing of personal information associated with that browser.

10. AI Training and Your Data

We send your communications to third-party AI model providers (as identified in Section 5) solely to generate responses to your queries. These providers are contractually required to process your data only for the purpose of providing inference services and are prohibited from using your data to train their models.

Jo does not use your raw communications, email/calendar content, active window content, or voice data to train AI models.

We may use de-identified, aggregated usage patterns to improve our service quality. This aggregated data cannot be used to identify you.

You may request that we not use any of your data for service improvement purposes by contacting us at [email protected].

11. Data Retention

We retain your personal information for the following periods:

Account and profile data: Retained for the duration of your account plus 30 days after deletion.
Bot communications and conversation history: Retained for the duration of your account plus 30 days after deletion.
Email and calendar data: Accessed temporarily on-demand; not retained after processing your request.
Active window content: Processed temporarily during your session; not retained after the session ends.
Voice data: Processed temporarily for transcription; not retained after processing.
Location data: Retained for the duration of your account.
Analytics data: Retained for 26 months by analytics providers per their respective retention policies.
Payment records: Retained for 3 years after the last transaction for tax and legal compliance.

Upon account deletion, we will delete or de-identify your personal information within 30 days, except where retention is required by law.

12. Your Choices

Marketing Communications. You can unsubscribe from our promotional emails via the link provided in the emails. Even if you opt out of receiving promotional messages from us, you will continue to receive administrative messages from us.

Cookie Controls. Most web browsers are set to accept cookies by default. If you prefer, you can usually set your browser to remove or reject cookies. Please note that removing or rejecting cookies could affect the availability and functionality of our Services.

Analytics Opt-Out. You can opt out of Google Analytics by visiting https://tools.google.com/dlpage/gaoptout. You can learn about PostHog’s opt-out mechanisms at https://posthog.com/privacy.

Voice Data. You can disable microphone access at any time through the Jo macOS application settings or through your device’s system settings.

Active Window. You can disable the “Share active window” feature at any time in the Jo macOS application settings.

Location. You can disable location sharing in your device’s system settings or within the Jo application.

Contacts. You can revoke address book access in your device’s system settings.

13. Data Breach Notification

In the event of a data breach involving your unencrypted personal information, we will notify affected California residents in accordance with California Civil Code §1798.82.

Notification will be provided in the most expedient time possible and without unreasonable delay, consistent with any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.

Notification will include: the types of personal information involved in the breach, a general description of the incident, the steps we have taken in response to the breach, and contact information for further questions.

14. Third Parties

Our Services may contain links to other websites, products, or services that we do not own or operate. We are not responsible for the privacy practices of these third parties. Please be aware that this Privacy Policy does not apply to your activities on these third-party services or any information you disclose to these third parties. We encourage you to read their privacy policies before providing any information to them.

15. Security

We make reasonable efforts to protect your information by using physical and electronic safeguards designed to improve the security of the information we maintain. We implement administrative, technical, and physical security measures including encryption in transit (TLS) and at rest, access controls, and regular security assessments. However, because no electronic transmission or storage of information can be entirely secure, we can make no guarantees as to the security or privacy of your information.

16. Children’s Privacy

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from individuals under 18. If you are under 18, please do not use our Services or provide any personal information. If we learn that we have collected personal information from an individual under 18, we will take steps to delete that information promptly. If you believe that an individual under 18 has provided us with personal information, please contact us at [email protected].

17. International Visitors

Our Services are hosted in the United States and intended for visitors located within the United States. If you choose to use the Services from the European Union or other regions of the world with laws governing data collection and use that may differ from U.S. law, then please note that you are transferring your personal information outside of those regions to the U.S. for storage and processing. We may also transfer your data from the U.S. to other countries or regions in connection with storage and processing of data, fulfilling your requests, and operating the Services. By providing any information, including personal information, on or to the Services, you consent to such transfer, storage, and processing.

18. Google API Services User Data Policy

Our use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We access Google API data (Gmail, Calendar, Drive) only when you explicitly request it through your interactions with the Jo assistant.

We do not use Google API data for advertising purposes. We do not transfer Google API data to third parties except as necessary to provide the services you have requested (e.g., transmitting email content to an AI model provider to generate a summary you requested). We do not use Google API data for AI model training.

19. Changes to this Privacy Policy

We will post any adjustments to the Privacy Policy on this page, and the revised version will be effective when it is posted. If we materially change the ways in which we use or disclose personal information previously collected from you through the Services, we will notify you through the Services, by email, or other communication.

20. Contact Information

If you have any questions, comments, or concerns about our processing activities, please contact us using the following methods:

Email: [email protected]
Mail: Jo, Inc., 2261 Market Street STE 10471, San Francisco, CA 94114

For CCPA/CPRA requests specifically, you may contact us at [email protected] or through the Jo macOS application.

Last Updated: February 27, 2026