App Jam preview

Privacy policy

Your apps live on your device. Some information also reaches App Jam when you connect an agent, receive updates, or use encrypted backups. Here is what that means.

Effective October 29, 2026. App Jam is operated by Nolan Cassidy. Contact privacy@getappjam.com with privacy questions or requests.

What stays on your device

App records, saved photos, installed app files, preferences, and mini-app browser storage are stored locally. Provider API keys entered into the native credential vault and backup recovery keys are held in device storage and are not included in App Jam backups. A mini app can store its own information in its isolated browser storage; that storage is included when its data backup is enabled.

What App Jam receives

• Account and connection information: name, email address, password hash, account identifiers, authorized agents and devices, session information, and optional push-notification tokens. We do not store your account password in plaintext.
• App delivery: submitted app designs and files, requested tool operations, app names and versions, table schemas, capability declarations, installation status, and limited error information. Hosted agent tools process submitted designs and requests before encrypting delivery. A private connector can encrypt before upload.
• Information you authorize an agent to read: separate permissions can allow access to installed app designs or selected records. Approving a connection is not permission to read every credential.
• Encrypted backups: app designs and supported saved data are encrypted on your device before upload. App Jam stores encrypted content, app identifiers, sizes, timestamps, and recovery-key identifiers. The recovery key itself is not uploaded.
• Service operations: hosting providers process connection information such as IP addresses and request metadata for delivery, reliability and abuse prevention. Support messages contain information you choose to send us.

Why we use it

We use this information to provide accounts, authorize agents, deliver app updates, show installation status, maintain backups, answer support requests and protect the service. We do not sell personal information, run behavioral advertising, or use private app content to train an App Jam AI model.

Your connected services

An app may send information to a provider you choose, such as an AI service, Dropbox or a configured API. Photos and text used for analysis go to the configured provider when you run that feature. Its own privacy policy and usage charges apply. Review the app’s requested capabilities and destinations before approving it. A connected agent also has its own privacy terms.

Infrastructure currently includes Vercel for hosting, Turso for the service database, Expo for build tooling and optional push relay, and Apple for iOS distribution and push delivery. Email sent to our domain is forwarded through Namecheap to the operator’s email provider. These providers may process data in countries other than yours.

Backups and retention

Design and data backups are enabled by default for signed-in devices, with separate global and per-app switches in Settings → Backups. Copies run while App Jam is open and connected. Turning a switch off stops new copies; use Delete saved copies to erase existing ones. The current preview keeps up to three completed copies per app and backup type, within a 100 MiB account limit. Incomplete uploads expire after 24 hours.

Queued app delivery expires after seven days and acknowledged payloads are deleted. Tool replies expire after five minutes or are deleted after reading. Catalogs, connection information and operational status remain while needed for your account. Account deletion removes active account records, grants, hosted app content, queued delivery and encrypted backups. A non-identifying deletion receipt may remain for 24 hours so an interrupted request can finish safely. Hosting security logs and infrastructure recovery copies may follow the provider’s retention schedules; they are not an active user backup service.

Your choices

You can disconnect agents, revoke app permissions, disable notifications, manage backup settings, remove apps or delete your account. Account deletion is available in Settings → Account & agents and on the account page. It requires confirmation, your current password and the typed word DELETE. In-app deletion also removes the current iPhone’s private App Jam data. If cleanup is interrupted, keep App Jam installed and use Finish removing phone data to retry. Web deletion removes hosted account data and this browser’s App Jam storage; it cannot erase a phone. All other devices keep their local copies, even when online, and lose server access: remove those copies separately. Saved recovery kits, exported files, the system photo library and third-party copies are outside App Jam’s control.

Contact us to request access, correction or deletion, or to exercise other rights available where you live. We may need to verify that the request concerns your account. Account recovery and email verification are not yet available in this preview; keep your password and backup recovery kit safe.

Security and children

We use encrypted transport, scoped access controls and device-encrypted backups. No service is guaranteed secure. Backups exclude some storage types and are not live synchronization between devices. App Jam cannot decrypt a backup without its recovery key. This preview is not intended for children under 13; do not create an account for a child under 13. Contact us if you believe we hold a child’s account information.

Changes

We will update this page and its effective date when the policy changes. Material changes to how we handle personal information will be communicated through the service where appropriate.