Privacy Policy

Last updated October 24, 2026

Jimothy runs on your own computer, and your work stays there. We collect as little as we can, we tell you exactly what it is, and we never sell your data.

This policy covers EchelonOne, Inc. (“EchelonOne”, “we”, “us”): the jimothy.dev website, the Jimothy desktop app and tools, and Jimothy accounts and paid plans.

What stays on your computer

The app keeps everything on your own machine: your code, pipelines, prompts, issues, agent output, logs, settings, and the tokens and API keys you add. Credentials are encrypted with your operating system’s keychain. None of it is sent to us.

When you connect services such as an AI provider, Jira, Linear, GitHub or Slack, the app talks to them directly from your computer, using your credentials. What they receive is governed by their privacy policies, not this one.

What the app sends us

Update checks

The app checks our download site (downloads.jimothy.dev) for new versions. That request contains no identifiers. Like any web request, it reveals your IP address and basic details about the app, and our hosting provider (Cloudflare) logs it. The app also checks the public release pages of the agent tools you’ve installed, so it can tell you when they have updates.

License agreement acceptance

When you accept the license agreement, the app sends us a record that this install accepted it: the agreement version, the time, the app version, operating system and CPU architecture, and a random install id that isn’t linked to your name, email or account. It’s sent once for each version you accept, whether or not you share usage analytics. Setting DO_NOT_TRACK=1 or JIMOTHY_TELEMETRY=0 switches it off.

Anonymous usage analytics (opt-in)

The app asks once whether to share anonymous usage data, and sends nothing until you say yes. You can change your choice at any time in Settings → General → Privacy. You can share everything, or only:

Feature usage: which harness types are installed, how many pipelines, projects, triggers and boards you have, and how pipelines, triggers and boards were created; and
Run results: whether runs succeed, fail or are cancelled, how long they take, and the types of their steps and harnesses.

Each event includes the app version, operating system and CPU architecture, and a random install id. It’s the same id as the license acceptance record, and isn’t linked to your name, email or account. We never collect code, diffs, prompts, agent output, logs, issue text, names of projects, pipelines or repositories, file paths, branch names, environment variables or secrets. The app only lets through events and fields on a fixed list. View what’s sent in Settings shows you every event.

Setting the environment variable DO_NOT_TRACK=1 or JIMOTHY_TELEMETRY=0 switches analytics off, whatever the setting says.

We use PostHog (EU region) to store and analyze these events and license acceptance records. We ask PostHog to discard IP addresses, and we don’t create person profiles.

The website

jimothy.dev uses Google Analytics to count visits and downloads, but only if you click Accept on the cookie banner. Until then, no analytics script is loaded and no analytics cookies are set. Google Analytics records things like the pages you visit, the site that referred you, your browser and device type, an approximate location, and which installer you downloaded. You can change your choice at any time with Cookie settings in the footer. Declining also deletes any Google Analytics cookies already set.

Other services the site uses

Hosting: the site and downloads are served by Cloudflare. Cloudflare processes your IP address and request details to deliver pages and keep them secure.
Fonts: the site loads fonts from Google Fonts, so your browser sends Google your IP address and browser details.
Links: links to Discord, GitHub and other sites take you to services with their own privacy policies.

Accounts and payments

Signing in is optional for the free version. If you create an account or buy a plan, we collect your name and email address, and your organization and its members if you set one up. We use them to run your account, bill you, and send you service messages, such as receipts, security notices and important changes. Product news is sent only if you opt in.

Our authentication and billing provider (Clerk) and its payment processor handle sign-in and payments. Card details go directly to the payment processor and never reach our servers. We keep records of your transactions for accounting and tax purposes.

If you use a hosted Jimothy feature, we’ll describe what it stores before you turn it on, and we’ll process that content only to provide the feature for you.

We don’t sell or rent personal information, and we don’t share it for advertising. We share it only:

with the service providers listed above, who process it on our behalf under contracts that require them to protect it;
when the law requires it, for example to answer a valid subpoena or court order (we’ll tell you about the request unless we’re prohibited from doing so);
to protect the rights, safety or security of our users, the public or EchelonOne; or
as part of a merger, acquisition or sale of assets. If that happens, we’ll make sure this policy keeps applying to your information, or tell you first.

How long we keep it

Usage analytics: kept for up to 2 years, then deleted.
License acceptance records: kept for as long as the license agreement applies to that install.
Website analytics: retained according to our Google Analytics retention setting, 14 months.
Server logs: kept briefly by our hosting provider for security and operations.
Account data: kept while your account is open. We delete it within 60 days after you close the account, except where the law requires us to keep records, such as invoices.

Your rights

Depending on where you live, including under the GDPR, the UK GDPR and California privacy law, you may have the right to access, correct, delete, export or restrict the use of your personal information, and to object to how we process it. You can exercise these rights by emailing us. We won’t discriminate against you for doing so.

Usage analytics and license acceptance records aren’t tied to you. To have yours deleted, send us your install id from the telemetry.json file in Jimothy’s data folder, or delete that file to start over with a new one.

Where the GDPR applies, our legal bases are your consent (usage analytics, analytics cookies), performing our contract with you (accounts and plans), and our legitimate interests (keeping the site and downloads secure and running, and recording that the license agreement was accepted). You can withdraw consent at any time. If you have concerns, you can also complain to your local data protection authority.

Our service providers may process information in the United States and other countries. Where personal data leaves the EU, the UK or Switzerland, we rely on safeguards approved for those transfers, such as the EU Standard Contractual Clauses.

Children

Jimothy isn’t intended for anyone under 16, and we don’t knowingly collect their personal information. If you think we have, please contact us and we’ll delete it.

Changes

If we change this policy, we’ll update the date at the top. If the change is significant, we’ll also tell you in the app or by email before it takes effect.

Contact

Questions or requests? Email privacy@jimothy.dev, or write to EchelonOne, Inc.

Adapted in part from the Basecamp open-source policies / CC BY 4.0.