Privacy Policy

At Jogeave, we are committed to protecting your personal data and being transparent about how we collect, use, and safeguard it. Jogeave is a global production marketplace for film, TV, music, and live events. This Privacy Policy explains our data practices across the platform, as they actually work on the date above.

Who We Are

Jogeave is not yet incorporated. Until it is, the platform is operated by Jogeave's founder as a sole proprietor whose place of business is in Alberta, Canada. That operator is responsible for your personal data (the "controller"). Our Privacy Officer is the founder; contact details are in Section 16. When Jogeave is incorporated, the new company will take over this responsibility, and we will tell you by email.

This version takes effect on the date above for new accounts and for anyone who uses our sites without an account. For accounts created earlier, it takes effect 14 days after the date of the email we send you about it (Section 15). In this policy, "jogeave.com" is our public website, "the web app" is the platform at app.jogeave.com, and "the mobile app" is our iOS and Android app.

1. Information We Collect

Account Data

When you create an account, we collect your name, email address, and password (managed by our own self-hosted sign-in system). If you sign in with Google, see Google User Data in Section 3 for what Google shares with us and how we use it. You may also provide profile information including your professional roles, city and country, phone number, rates, availability, and a bio. On the work-eligibility page you may provide your citizenship and country of residence, the countries whose passports you hold and their expiry dates, and the visas or work permits you hold or have applied for (their type, status, and expiry).

Your Acceptance of Our Terms

When you sign up, we record which version you accepted, when, and the network (IP) address and browser description your device sent at the time, so we can show that you agreed.

What Other Members See

Signed-in members can see your profile: your first and last name, handle, profile and cover photos, location, roles, badges, verification level, bio, YouTube video links, when you joined, follower counts, account type, linked platform IDs, your minimum project rate and whether you accept tips (if you set them), and the credits and work you publish. If you choose, it also shows the countries you select from those where, based on what you have told us, you are authorized to work. Your profile is not shown to signed-out visitors or to search engines. Your email address, phone number, and payment details are never shown on your profile or in search. Your saved and liked collections are private to you. If you joined through someone's invite link, your profile shows who invited you.

Identity Verification

You can verify a Spotify artist page, an Apple Music artist page, or an IMDb name page. We give you a code to place in that page's public bio, valid for 24 hours. When you ask us to check, we retrieve that one public page, ourselves or through a page-retrieval provider (Section 3), and look for the code in the page text. We also send the page text to an AI model provider (Section 3) to read the name and public profile details shown on it, such as audience figures. Only the code match decides whether verification succeeds.

On success, we link that identity to your account, record the name on the page, and show a Verified badge. Our team can also grant a higher verification level by hand. A code stops working 24 hours after we issue it. We delete it as soon as the check succeeds; otherwise a daily clean-up deletes it, normally within 48 hours of issue. Changing your display name or username, or unlinking the page, removes the badge. Each IMDb, TMDB, Spotify, Apple Music, Deezer, or MusicBrainz identity can be linked to only one Jogeave account. When you verify an IMDb page, we look up your public film and TV credits in public databases (Section 3).

Jogeave does not collect government-issued identification for profile verification. Identity verification required by our payment processor (Stripe Connect) for know-your-customer and anti-money-laundering purposes is performed by Stripe through its hosted onboarding; Jogeave does not see or store the documents Stripe collects, and Stripe's privacy policy governs them. If we ever add a verification flow that needs government-issued identification, it will be run by a third-party identity-verification provider, and we will update this policy first.

Automatic Profile Detection

After you verify a Spotify artist page, we search other public music catalogues for profiles that match it. A match is saved as "Detected". A detected profile is shown only to you, does not verify you or grant anything, and can be confirmed or unlinked by you in Settings.

Automatic Credits

After you verify an IMDb page, we add you as a credited collaborator on the film and TV titles on Jogeave that TMDB's public records list under that person, and we tell you by email and in your notifications in the web app, whatever your email settings. You can remove a credit with "Remove my credit"; a removed credit can be added again if you verify again or later ask to join that title. Other members may also ask to be credited on a title you are credited on, or vouch for your credits.

Portfolio and Media

This includes work credits, project history, and the photos, videos, and documents you upload. Some photos are cleaned of hidden metadata when we prepare them for display, and we keep the original in private storage; other photos, and videos, are shown largely as you uploaded them, so metadata in them (which can include where and when they were taken) can be read by anyone who can view them. Remove location data from your files before uploading if you do not want it shared.

Booking, Hiring, and Contract Data

When you use the platform for hiring or bookings, we collect job listings and applications (including cover letters, self-tape links, and proposed rate), project details, booking and contract information, escrow transaction records, and logistics preferences. Contract PDFs and project documents are kept in private storage. When you sign a contract, we record that you agreed, the time, the network address you signed from (when available), and your account.

Payment Data

Payments are processed through Stripe Connect, which runs in test mode today. We never store your card numbers; card and bank details for payouts are held by Stripe. We keep records of payments, payouts, tips, refunds, and your Jogeave balance in our financial records.

Tax Information

We do not collect tax identifiers (such as a Social Insurance Number, a Social Security Number, or a Form W-9) today. Tax reporting may require them once workers are paid real money; before we collect any, we will update this policy to say how they are collected, protected, and kept.

Communications

We store direct messages and project channel conversations, including the photos, videos, and voice notes you send in them, to deliver them to the other participants. Messages are not end-to-end encrypted; attachments are kept in private storage and shown through short-lived links. Message text is normally checked by OpenAI's moderation service before it is sent (see Section 3). Video calls are provided by Daily.co: Daily receives your user ID and display name to set up the call, and it carries the call's audio and video.

Search

The text you type into search (which requires you to be signed in) is sent to our search and AI providers and the public catalogues and search services listed in Section 3, to find matching results. Your account details are not sent with it. We keep search text, with the web snippets used to answer it, in a search cache (see Section 8).

Activity on the Platform

We store the likes, follows, shares, saves, and mutes you make, and the reports you file about posts. Your Commons feed is ordered using who you follow and mute and each post's overall likes, comments, and shares. We do not keep a per-person history of what you view or play; video play counts are kept as totals with no record of who played them.

Usage Data

Cloudflare Web Analytics runs on jogeave.com and in the web app: a cookie-free script that reports each page view's address, the referring page, your browser, and how long the page took to load to Cloudflare, which receives your network address with the report. Separately, the servers that host jogeave.com and the web app count the requests they answer, by page address (which can contain search terms), referring site, browser, device type, and the country derived from your network address, along with response times and errors. These are kept only as totals; your network address is not stored in them. The same servers also log each request, including your network address, the page address, the referring page, and your browser; these logs are overwritten as new logs arrive (Section 8).

Error Monitoring and Performance Telemetry

When jogeave.com or the web app encounters an error, or when a page load completes, our error-monitoring provider (Sentry, see Section 3) receives a diagnostic event containing the error message and stack trace, the route or page path involved, the browser and operating system reported by your device, and standard Web Vitals performance metrics. Before any event leaves your browser or our servers, a redaction layer removes user identifiers, email addresses, phone numbers, authentication tokens, payment processor identifiers, request cookies, authorization headers, fields carrying personal contact and address data, and the text of certain free-text fields, such as messages and bios. This data is used only to find software defects and performance problems. Session Replay is disabled. The mobile app and our backend services do not send data to Sentry.

Security, Rate Limiting, and Server Logs

To protect sign-in, sign-up, and password reset from abuse, we count requests per network (IP) address and per device. The web app gives your browser a random identifier cookie for this (see Section 5), and the mobile app keeps a random identifier for the same purpose in your device's secure storage. At sign-up in the web app, Cloudflare Turnstile checks that you are not a bot. Our backend servers log requests, including the address of the page requested (which can contain search terms), and these logs are deleted after 7 days.

Location, Camera, and Microphone

Your profile location is the city and country you enter. When you check in to a booking by scanning its on-site code, the scanning device sends its precise location (latitude and longitude) at the moment of the scan, if you have allowed location access. Location is optional today; before we make it required for paid bookings, we will update this policy. We store the location with each check-in, and with each scan rejected for being too far from the venue, so an arrival can be checked if disputed. If a hirer chooses "use current location" when picking a venue in the web app, the browser's precise location is saved as the venue's location. We use your camera only while you scan a code or take a photo or video, and your microphone only while you record a voice note or are on a call. The mobile app never collects location in the background.

Website Forms

If you join the waitlist on jogeave.com, we collect your name, email address, the kind of member you are signing up as, city, department, industry, and investment interest, along with the approximate city and country our network provider derives from your IP address and a summary of your browser. These are stored with Google (Section 3), and the submission is also written to jogeave.com's server log. The investor-documents login on jogeave.com is also handled through Google.

Adult Content Preference

If you choose to see adult content, we record when you opted in and that you confirmed you are 18 or older. We do not ask for your date of birth or an ID document for this.

2. How We Use Your Information

• Run your account, your profile, and the features you use, including messaging, calls, and the Commons.
• Facilitate hiring, bookings, escrow payments, and logistics coordination between users.
• Verify professional identities and add verified credits, as described in Section 1.
• Help you find people, projects, jobs, and services through search, including AI-assisted search.
• Process payments through Stripe Connect.
• Send notifications by email (through Resend) and in the app.
• Moderate content: classify uploaded images and videos for explicit content on our own servers, and check post, comment, and message text through OpenAI's moderation service.
• Protect the platform from abuse, fraud, and attacks.
• Find and fix software defects and improve performance.
• Comply with legal obligations.

We do not sell your personal data, use it for advertising, or use it to train AI models. We do not show ads.

3. Third-Party Services

We work with the providers below. Each receives only the data it needs for its function.

Service Providers That Handle Your Data

• Stripe — Payment processing, escrow, payouts, tips, and balances (test mode today). On our pages, Stripe's code loads in your browser only when you open a tip form or a page for paying (adding funds or paying for a booking), and receives your IP address and device signals for fraud prevention. Stripe analyzes these signals, with transaction and identifying information, to run and improve its services, including fraud detection, as described in the Stripe Privacy Policy.
• Cloudflare — DNS, network protection, content delivery, file storage (R2), the Turnstile bot check at sign-up, which processes your IP address and device signals, and Web Analytics (Section 1). No account identity is shared with Cloudflare for Turnstile or Web Analytics.
• Resend — Email delivery: your email address and the message content.
• Daily.co — Video and voice calls: your user ID, display name, IP address, and the call's audio and video. The call software is loaded into your browser from unpkg.com, a public code host.
• Google — Sign in with Google (if you choose it); Google Maps Places and Routes for location lookups (place names and addresses, sent from our servers); and storing the forms submitted on jogeave.com.
• OpenAI — (a) Moderation of Commons posts, comments, and message text. (b) Processing search queries and public catalogue text to find matching results. No account identifier is sent. Under OpenAI's API terms, this data is not used to train its models.
• OpenRouter — Routes requests to AI model providers for identity verification (Section 1), search, and reading public pages for our visa-requirements and events information. No account identifier is sent. These providers may process requests outside Canada and the United States, including in China.
• Zyte — Retrieves public web pages for us: the pages you verify (Section 1) and public event pages. Only the page address is sent.
• Mapbox — Maps in the venue picker and on jogeave.com. Your browser loads them from Mapbox directly, so Mapbox receives your IP address and the map area you view.
• YouTube — YouTube videos on Jogeave play in YouTube's embedded player through YouTube API Services, so YouTube receives your IP address when a video or its preview loads, may set cookies on your device, and may show ads. Google's handling of that data is described in the Google Privacy Policy.
• Iconify — Icons on jogeave.com, loaded by your browser from Iconify's servers, which receive your IP address.
• WeatherAPI.com and OpenWeatherMap — Weather for a place name, requested from our servers; your IP address is not sent.

Google User Data

If you sign in with Google, Google shares your basic profile with our sign-in system: your name, email address and whether Google has verified it, your profile photo, and the ID Google uses for your account, so we can recognise you when you sign in again. We use it to create your Jogeave account or connect it to an existing account with the same email address, to sign you in, and to fill in the name and email address on your account (and your profile photo, if our sign-in system passes one on); from then on it is part of your account data and is used as described in Section 2. We do not ask for access to your Gmail, Google Drive, contacts, calendar, or any other Google service, and we cannot read or change anything in your Google account. We do not sell this data or use it for advertising. Your name appears on your profile, which other signed-in members can see (Section 1), and we share this data with the service providers in this section where they need it to run the platform, such as Resend when we email you, and as described in Section 12. It is stored on our servers and in our backups in the United States, and with the service providers that receive it, as described in Section 13, and protected as described in Section 6. It is kept while your account is active. You can delete your account under Settings → Security & Privacy in the web app, under Settings → Delete account in the mobile app, or by emailing legal@jogeave.com; Section 8 describes what deletion removes. You can remove Jogeave's access to your Google account at any time at myaccount.google.com/permissions. This does not delete your Jogeave account or the information we already received from Google; deleting your account removes most of it, and Section 8 describes what is kept. If you sign in with Google again, Google will ask you to allow access again. Jogeave's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Logistics Providers

Travel and logistics booking is not open to members. Flight, hotel, and shipping search uses providers connected with test accounts, which receive the search details you enter (for shipping, the pickup and delivery addresses). Uber is connected with a live account for ride estimates; booking a ride, which is not offered to members, would send Uber the passenger's name, phone number, and pickup and drop-off addresses. Before real bookings open, we will list each provider here with what it receives.

Public Catalogues and Search Services

To build our film, TV, and music catalogue, answer searches, run verification, and find events and news, we query these services with names, titles, IDs, public page addresses, or your search text — never your account details. Each processes requests under its own terms:

• Spotify, Apple Music, and Deezer — music lookups, verification, and detection.
• TMDB and IMDb (public name pages) — film and TV lookups, verification, and credits.
• MusicBrainz — music lookups.
• YouTube and other music-video databases — music-video lookups.
• Other public music, film, and TV databases, public encyclopedias, and ticketing and event listings — charts, artist and song details, linked profiles, background articles, and events.
• Web and news search services — search, public government immigration pages, and events.
• News publishers' public feeds — industry news.
• Link previews — when you post a link, our servers fetch that page to show a preview, so the linked site sees a request from Jogeave, not from you.

Images from TMDB, Deezer, Apple, Spotify, YouTube, Google, and pravatar.cc (placeholder avatars on event pages) are loaded by your browser or app directly from those services, which therefore receive your IP address.

Run on Our Own Servers

These run on our own infrastructure, and the data they handle is not sent to a third party: sign-in and password storage (including two-factor authentication); explicit-content checks of images and videos (images are evaluated in memory, not kept by the checker, and not used for training); our servers' traffic totals; and our logs.

Observability and Diagnostics

• Sentry (Functional Software, Inc.) — Receives the redacted error events and Web Vitals metrics described in Section 1, from jogeave.com and the web app only. Data is sent to Sentry's European Union region (Frankfurt, Germany) and stored there for up to 90 days. Session Replay, profiling, and Sentry's optional default personal-data collection are disabled.

Infrastructure Providers

• Hetzner Online GmbH — Hosts our servers and databases in its United States West region (Hillsboro, Oregon), and keeps backup copies of our servers.
• Backblaze, Inc. — Stores backups of our data in its United States West region.

4. Analytics

We use two cookie-free sources of analytics, described in Section 1: Cloudflare Web Analytics, which Cloudflare runs for us, and our servers' own traffic totals. None of them tracks you across sites. The mobile app has no analytics.

5. Cookies and Similar Technologies

We do not use advertising or cross-site tracking cookies. The cookies Jogeave sets are:

• Sign-in cookies (web app: __Host-Http-jg_access and jg_session_refresh) — keep you signed in until you go 30 days without using the web app, and never more than 90 days after you signed in (you are also signed out after 30 minutes without activity); they cannot be read by page scripts.
• Sign-in service cookies (auth.jogeave.com) — set by our self-hosted sign-in system to recognize your browser, keep your sign-in session, and protect sign-in forms; kept for up to 1 year.
• sb_anon (web app) — a random identifier, kept for 1 year, used only to limit request rates and block abuse.
• signup_gate and signup_gate_open (web app) — record that you passed the bot check at sign-up; expire after 10 minutes.
• __Host-jg_large_screen (web app) — remembers for 12 hours whether your screen is large enough for the full layout.
• doc_auth_token (jogeave.com) — keeps you signed in to the investor-documents area for 7 days, if you use it.

The web app also uses your browser's local storage for your adult-content preference, the inactivity timer, sign-in state, and unsent drafts. Third-party services described in Section 3 may set their own cookies when they load: Cloudflare Turnstile at sign-up, Stripe when you open a tip form or a page for paying, Daily.co during a call, Mapbox when a map loads, and YouTube when a video plays.

6. Data Security

• Data is encrypted in transit between your device and our servers, and traffic between our servers is encrypted or stays on our private network.
• Payment funds are held by Stripe, not by Jogeave.
• Private files (original uploads, message attachments, contracts, and data exports) are kept in private storage and shown only through short-lived links.
• Access to our servers, databases, and backups is limited to authorized personnel and automated tools.

No method of transmission or storage is completely secure, and we cannot guarantee the security of your data.

7. Your Rights

You have the following rights regarding your personal data:

• Access and Export — Request a copy of your data under Settings → Security & Privacy → Download my data archive in the web app, or by email. The web app does not yet show the download link when the archive is ready, so email legal@jogeave.com after requesting it and we will send you the link. The link stops working 24 hours after the archive is created; you can request a new archive at any time. The archive does not include our internal audit records.
• Correction — Edit your profile yourself, or ask us to correct anything else.
• Deletion — Delete your account yourself under Settings → Security & Privacy in the web app or Settings → Delete account in the mobile app, or ask us by email. See Section 8 for what happens.
• Objection and Restriction — Ask us to stop or limit a use of your data.
• Withdraw Consent — Withdraw consent you gave at any time. For example, turn off location access in your device settings, or turn off adult content under Settings → Content Preferences in the web app.

To exercise a right by email, contact legal@jogeave.com. We may ask you to confirm the request from your account email. We acknowledge your request within 10 business days (counted in Alberta, Canada) of receiving it, and respond within 30 calendar days of receiving it, even if we ask you to confirm it from your account email; if the law allows more time for a complex request, we will tell you within those 30 days.

8. Data Retention

• Active accounts: Account data is kept while your account is active.
• Account deletion: We begin deleting your account 30 days (720 hours) after you confirm deletion in the web or mobile app, or after we confirm an emailed request. Signing in to the web app, or opening the mobile app while it is still signed in, during those 30 days cancels the deletion — sign out of the mobile app first if you want it to go ahead. A suspended account cannot sign in, so its deletion goes ahead. Your account is removed from search and discovery from the moment you ask, but your profile page, posts, comments, and credits stay visible until deletion runs. If a booking escrow or payout on your account is still open after 30 days, deletion waits until it settles, with no fixed limit, and can start up to 24 hours after it does; your data stays as described above until then. We email you when deletion is complete.
• What deletion removes: Your sign-in account, profile, photos, videos, documents, portfolio, linked and verified identities, badges, likes, follows, saves, the content of the messages you sent, the content of your posts and comments, and the text of reviews you wrote and your replies to reviews. Your posts and comments are replaced by a "deleted" placeholder where others have replied, and an anonymous record of the account remains so that other members' conversations, bookings, and credits still make sense.
• What deletion does not yet remove: Your citizenship and residence, your last sign-in time, the network address and browser recorded when you accepted our terms, the YouTube links on your profile, your adult-content opt-in, your minimum project rate and tips setting, who invited you, a new email address you had asked to change to, your Last.fm ID, your currency, your Stripe customer reference (kept with financial records), the signature records on contracts you signed, the reports you filed, the star ratings you gave, reviews other members wrote about you, messages other members sent you, and your check-in records, including the location captured at each scan. Until deletion removes them, email legal@jogeave.com after deleting your account and we will remove them by hand.
• Deletion record: We keep a record that you asked us to delete your account, including the email address, name, and roles on the account at the time, with no fixed end date. We do not use it to contact you.
• Financial records: Payment, payout, and tax records are kept for 7 years after the end of the year in which the transaction took place, as tax and accounting law requires. We have not yet built the deletion that runs after that, so today they are kept longer.
• Check-in records: Check-ins, including the location captured at the scan, are kept with the booking so an arrival can be checked if disputed. We have not yet set a fixed period.
• Data export archives: The download link works for 24 hours; the archive itself is deleted when your account is deleted.
• Verification: Verification codes are deleted as soon as the check succeeds; otherwise normally within 48 hours of being issued. The copy of a page we fetch to verify you is kept in a short-term cache for up to 10 minutes (up to 1 hour for profile detection).
• Backups: We back up our databases daily. Our backup storage keeps superseded copies, and old copies are not yet deleted automatically, so data you delete can remain in backup copies indefinitely. Backups are never used to restore an individual's deleted data, and we will update this policy when automatic deletion is in place.
• Logs and background jobs: Our central log store deletes entries after 7 days. Copies of logs held on each server, including the waitlist submissions logged by jogeave.com, are overwritten as new logs arrive rather than on a fixed schedule. Our workflow engine keeps a background job's inputs (which can include the text of a post being moderated) while the job runs and for 7 days after it ends; an account-deletion job runs for at least 30 days.
• Error events: Kept by Sentry for up to 90 days.
• Analytics: Our servers' traffic totals are kept for up to 395 days.
• Search cache: Search text is cached for reuse. Entries are meant to expire after 7 days, but expired entries are not yet deleted, so today they are kept indefinitely.

9. Legal Bases for Processing (EEA / UK)

Where the EU or UK General Data Protection Regulation applies, we process your personal data on the following legal bases:

• Performance of a contract — to provide your account and the features you use, verify the identities you ask us to verify, process bookings, operate escrow, and deliver payouts.
• Legitimate interests — to secure the platform, prevent fraud and abuse, moderate content, detect your other profiles and add verified credits, answer searches, debug software, and improve our services, balanced against your rights. You can object to any of these (Section 7).
• Legal obligation — to meet tax-reporting, accounting, and other legal requirements.
• Consent — for precise location at check-in, camera and microphone access, and the adult-content opt-in, which you may withdraw at any time.

10. Sensitive Information & Automated Processing

Sensitive Personal Information

Some data we collect is treated as sensitive under laws such as the California Privacy Rights Act (CPRA) and Quebec's Law 25: precise geolocation captured at check-in, and the content of your private messages. Your choice to see adult content could also reveal something sensitive about you. We use sensitive information only for the purposes described in this policy, do not use it to infer characteristics about you, and do not sell or share it. Where the law requires it, we ask for your express consent first.

Automated Decision-Making

Some decisions are made automatically: a post or comment flagged by text moderation, or a post reported by several different members, is removed from view for everyone, including its author (its content is kept); a flagged message is not sent or stored; images you upload for your profile, projects, services, and events are checked before they are published — explicit profile photos, headers, service banners, and event covers are not published, and a project with explicit art is left out of your profile's project list for members who have not turned on adult content; a check-in scanned too far from the venue is rejected; explicit images and videos in Commons posts are blurred in the web app; verification succeeds or fails on whether the code is on the page; detected profiles and automatic credits are created from public records; and search results are ranked by software. A person on our team makes any decision to suspend or close an account. You may ask us to explain, or have a person review, an automated decision that affects you, by emailing legal@jogeave.com (to appeal a moderation action, follow Section 10 of our Community Guidelines).

11. Your Privacy Rights by Region

We honor the privacy rights described below regardless of where you live. We do not sell your personal data, and we do not "share" it for cross-context behavioral advertising.

Canada (PIPEDA & Quebec Law 25)

For users in Canada, we handle personal information in accordance with the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and, for Quebec residents, the Act respecting the protection of personal information in the private sector as amended by Law 25. You have the right to access and correct your personal information, to withdraw consent (subject to legal or contractual limits), and, for Quebec residents, to data portability and to be informed about automated decisions. Our Privacy Officer is accountable for our compliance; contact details are in Section 16. Because our servers are in the United States, your information is stored and processed outside Canada, including Quebec, as described in Section 13.

California and Other U.S. States

California residents, and residents of other U.S. states with comprehensive privacy laws, have the right to know what personal information we collect and how we use it, to access, delete, and correct it, to opt out of its sale or sharing (we do neither), to limit the use of sensitive personal information, and not to be discriminated against for exercising these rights. In the past 12 months we have collected these categories of personal information: identifiers (name, email, account and device identifiers, IP address); professional and profile information; commercial information (bookings, payments, tips); internet activity on our platform (searches, likes, follows); precise geolocation (at check-in); audio and visual information (photos, videos, voice notes, calls); and the content of your messages. We collected it from you, from Google if you sign in with Google, and from the public sources in Section 3, for the purposes in Section 2, and we disclosed it only to the service providers in Section 3 to operate the platform. You may submit a request yourself or through an authorized agent.

Because we do not sell or share personal information, there is nothing for a Global Privacy Control (GPC) signal to opt you out of today. If that ever changes, we will treat a GPC signal as a valid opt-out.

European Economic Area & United Kingdom (GDPR)

If you are in the EEA or UK, you have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with your local supervisory authority. The legal bases for our processing are set out in Section 9.

To exercise any of these rights, contact legal@jogeave.com. We respond within the times in Section 7, and we will not discriminate against you for exercising your rights.

12. Data Breach Notification & Lawful Disclosures

If a breach of security affecting personal information creates a real risk of significant harm to you, we will notify you and the relevant regulators (for example, the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, or an EU or UK supervisory authority) as the law requires — for an EU or UK supervisory authority, within 72 hours of becoming aware of it where the GDPR requires notice. We keep a record of every breach of security safeguards for at least 24 months.

We may disclose personal information when we believe in good faith it is necessary to comply with the law, respond to lawful requests and legal process, enforce our Terms, prevent fraud, or protect the rights, safety, and security of our users, the public, or Jogeave. If we become aware of apparent child sexual abuse material, we will preserve the relevant content and account data and report it to the National Center for Missing & Exploited Children (NCMEC) and/or law enforcement as required by law (including 18 U.S.C. § 2258A), and we may share that information with them.

13. International Data Transfers

Our servers are in the United States (Hillsboro, Oregon). If you use Jogeave from outside the United States, including from the European Union, the United Kingdom, or Canada (including Quebec), your personal data is transferred to and stored in the United States. Most of the providers in Section 3 are also in the United States; redacted error data is processed in the European Union (Sentry); and AI model providers reached through OpenRouter may process requests in other countries. Where a provider's data-processing terms include Standard Contractual Clauses or a similar safeguard, we rely on them. We have not yet signed a separate transfer agreement with each provider. Because your data is transferred, processed, and stored outside Canada, it may be subject to disclosure as the laws of the countries where it is held require.

14. Children's Privacy

Jogeave is not directed at children, and our Terms require users to be at least 18, or the age of majority where they live if that is higher. In this policy, a child is anyone under that age. We do not knowingly collect personal data from children. If we learn that a child has provided us with personal data, we will delete it.

15. Changes to This Policy

When we change this Privacy Policy, we revise the "Last Updated" date at the top of this page. For a material change, such as collecting a new kind of personal data or using it for a new purpose, we will tell you by email at least 14 days before it takes effect, unless the law requires the change to take effect sooner or it fixes a safety or security problem, and where the law requires your consent, we will ask for it.

16. Contact Us & Privacy Officer

Our Privacy Officer is Jogeave's founder, who is accountable for Jogeave's compliance with applicable privacy laws, including PIPEDA and Quebec's Law 25. To ask a question about this Privacy Policy or our data practices, or to exercise a privacy right, contact legal@jogeave.com, or our operations team at operations@jogeave.com. For usage rules and liability details, please refer to our Terms of Service.

This policy has not yet been reviewed by an external lawyer. It describes how the platform actually handles personal data on the date above. If a lawyer's review changes it, we will update it under Section 15.