Jig runs on your own computer, and Jig on your phone (iPhone or Android) connects only to Jig on your own computer. Tenon AI does not collect or receive your content in Jig, and Jig contains no analytics, telemetry or reporting code.
Data kept on your computer: sessions, messages, tool call records, permissions you granted, letters between sessions, the decisions you make in the approval center, scheduled tasks and settings are stored in a database in Jig's data folder (~/.jig by default); provider API keys are stored in the system keychain; very long command output is stored in the tmp folder of the data folder; every version of the artifacts sessions save (documents, pages, data and charts) is stored in its artifacts folder. When you set Jig to start at login with jig service, its service log (start-up, errors and relay connection lines, without conversation content) is stored in the logs folder of the data folder. This data stays until you delete it. If you set a decision log file in Settings, Jig adds each decision to that file.
Phone access: when you turn on phone access on your computer, Jig on the computer connects to a relay, and Jig on your phone talks to it through the relay. The default relay is run by Tenon AI; you can also run your own. The two ends are encrypted end to end: the relay only passes ciphertext along and can neither read nor keep the content. For network security, the relay run by Tenon AI keeps a connection log: the time, the IP address, the path requested (which carries your computer's identifier, a hash of its public key) and the status, without content, deleted automatically after 184 days. The relay server is in mainland China. Jig on the computer records each paired phone: its name, public key, when it was paired and when it last connected. Jig on iPhone keeps the pairing and its own key in the iOS keychain, on that device only. With notifications on, Jig on iPhone gives the push token it got from Apple to your computer over the encrypted channel, and the computer keeps it; the computer encrypts what a notification says for that iPhone and hands it to Apple's push service through the relay. The relay and Apple handle the push token and the ciphertext, and cannot read what the notification says. Jig on Android keeps the pairing and its own key in a private file of the app, encrypted with a key in the Android Keystore, on that device only; it is left out of system backups and device transfers. Jig on Android uses no push service and has no push token: with notifications on, a foreground service keeps a connection to the relay open in the background, and the computer sends what a notification says to the phone over the end-to-end encrypted channel; the relay only passes ciphertext along. Android shows a standing notification for this connection, and notifications do not arrive while the system has stopped Jig. Scanning the pairing QR code uses the camera; the picture is read on the phone and is neither kept nor sent. The phone also remembers whether notifications are on and the ids of the items it has already seen, without their content.
Data sent to third parties: the model provider you choose for a session receives the conversation sent to it, including files the session read and command output; that provider's privacy policy applies. The default provider, DeepSeek, is a service of the Chinese company DeepSeek; how it handles and stores this content is set out in its privacy policy. If you choose a provider outside mainland China, this content goes abroad. When a session fetches a web page, that site receives the request. Once you save a key for a search service, that service receives the query when a session searches the web, and its privacy policy applies; with a search service outside mainland China (Tavily, Brave), the query goes abroad. An MCP server you set up in mcp.json receives what a session passes to its tools; each tool asks you before its first use.
Access, export and deletion: you can look at the files in the data folder directly. To delete a provider's key, delete it in Settings or run jig key delete; to remove a paired phone, remove it under Phone access on the computer, or unpair on the phone; to delete everything, stop jig serve and delete the data folder.
Contact: support@tenonai.cn.