Privacy Policy

Jaabni ("we", "our", or "us") operates the website at jaabni.com, the web application at app.jaabni.com, and the Jaabni browser extension (collectively, the "Service"). This Privacy Policy explains what information we collect, how we use it, and what rights you have over it.

We wrote this policy to be honest and readable — not to bury important information in legal language. If something is unclear, contact us at support@jaabni.com.

By using Jaabni, you agree to the practices described in this policy.

Jaabni is operated by an individual developer under the trading name "Jaabni." We are not currently a registered company. When a legal entity is established, this policy will be updated to reflect the company details.

Contact:

• Email: support@jaabni.com
• Website: jaabni.com
• Response time: Within 30 days

The Jaabni extension is injected into every webpage you visit. It needs to run on all pages so it can display your saved notes and show the note count badge when you land on a site where you have notes. Here is exactly what it does and does not do:

It does:

• Check your local extension storage for any saved notes matching the current page and display them if found
• Send the current page's URL to the extension's own service worker (running locally in your browser) so it can update the note count badge on the extension icon. This URL is processed entirely within your browser — it is only the domain (e.g. amazon.com) that is stored in session storage, and it is cleared when your browser closes. The full URL is never sent to our servers unless you save a note on that page
• Open a note composer when you press the keyboard shortcut. At that moment only, it reads the CSS selector, XPath, and a short text excerpt of the element your cursor is resting on. This data is used solely to re-anchor your note when you revisit the same page
• On social media feeds (Twitter/X, Instagram, Reddit, and similar), read the link elements of the post nearest the centre of your screen at the moment you open the note composer. This is used solely to anchor your note to the specific post URL rather than the generic feed URL. No page content, post text, or author data is read or stored — only the post's permalink
• Store a user-configured list of domains where you have chosen to pause the extension (for example, banking or medical sites). This list is kept entirely in your browser's local extension storage (chrome.storage.local) and is never sent to our servers
• Fire OS reminder notifications using the browser's notifications permission, and schedule those reminders using the alarms permission. Both permissions are used exclusively for the reminders feature
• For team members only: when you click a note marker on the page, the extension opens a panel and requests that note's comment thread from our servers. Nothing is requested until you click. The first time you type @ in a note or comment, it fetches your teammates' display names and handles so it can offer them for mentioning, and keeps that list for the rest of the page session

It does not:

• Track your mouse movements between keypresses
• Read the full text content of any page you visit
• Send any data about pages where you have not saved a note to our servers
• Intercept your network requests
• Communicate with any service other than Jaabni's own servers
• Build a browsing history or profile of the sites you visit

Browser permissions used:

• storage — stores your notes and settings locally in your browser
• activeTab — grants temporary access to the currently active tab when triggered by a user action (e.g. opening the popup or pressing the shortcut). The extension does not hold the broader tabs permission and therefore has no access to your list of open tabs or their URLs
• alarms — schedules reminder notifications at the time you choose. No alarms are set without explicit action on your part
• notifications — displays OS-level reminder notifications when a reminder you set becomes due

The extension also uses externally_connectable restricted to jaabni.com only. This allows the Jaabni web app to securely pass your login token to the extension after you sign in, without requiring you to log in separately inside the extension. It cannot be triggered by any other website.

Auth synchronisation between the extension and your Jaabni account only occurs when you are on a Jaabni domain. It never runs on third-party sites.

4.1 Guest Users (No Account)

If you install the extension without creating an account:

Stored locally in your browser only — never sent to our servers:

• Your notes including content, URLs, and DOM fingerprint data (the CSS selector and page position of the element you annotated)
• A randomly generated guest ID (a UUID created on install, stored in Chrome extension storage)

Sent to our servers:

• Your guest ID (sent when you open the extension popup). No URLs, no browsing history, and no note content are ever sent to our servers as a guest

Purpose: To count active users without identifying you. The guest ID is a random string with no link to your real identity.

Retention: Guest data lives in your browser. Uninstalling the extension deletes it. The server-side record containing only your guest ID is deleted automatically after 12 months of inactivity.

4.2 Registered Users (Free Account)

Account information:

• Email address
• Display name and username
• Profile picture URL (Google Sign-In users only — we store the URL, not the image)
• Password stored as a bcrypt hash (12 rounds) — your raw password is never stored or transmitted to us in readable form
• Which sign-in method you used (email/password or Google)

Usage data:

• Last login date and login count
• Whether the extension is installed and when it was last active
• Whether you have completed the onboarding steps

Sessions and email verification:

• For each active session we store a hashed refresh token, a short device description derived from your browser's user agent (e.g. "Chrome on macOS"), and its creation and expiry dates. This is what lets you see and end your sessions, and it is removed when you log out
• A single-use email verification token and its expiry, and a single-use password reset code and its expiry, both stored only while they are valid

Notes: Free plan notes are stored in your browser locally, not on our servers. Up to 50 notes can be stored this way. They are only transferred to our servers if you upgrade to Pro.

Telemetry: Same as guest users — your anonymous guest ID is sent when you open the extension popup. No URLs or note content are included.

Retention: Until you delete your account, at which point all data is permanently and immediately hard-deleted from our servers with no retention period.

4.3 Pro and Enterprise Users (Paid Account)

In addition to everything in 4.2:

Notes data stored on our servers:

• Note content (the text you write)
• The URL of the page where the note was saved. We store a sanitised copy — tracking parameters (UTM tags, referral IDs, session tokens) stripped — which is the only version used to look your notes up or display them. The original URL as your browser reported it is also retained on the note record so the link still resolves on sites where those parameters are load-bearing. It is never indexed, analysed, or used for any purpose beyond opening that page again, and it is deleted with the note
• The domain name and page title at the time of saving
• DOM fingerprint data: CSS selector, XPath, and a short text snapshot of the annotated element. Used solely to re-anchor your note when you revisit the page
• Note metadata: type, tags, colour, creation date, reminder date if set

What we do not collect:

• The full content of pages you visit
• Data from pages where you have not saved a note
• Your browsing history

AI / MCP integration (optional, Pro only):

• Pro users may generate an API key to connect Jaabni to compatible AI tools (such as Claude Desktop or Google Antigravity). The raw key is shown once and never stored. We store only a SHA-256 hash of the key and its first 12 characters as a display prefix
• When an AI tool accesses Jaabni via MCP, the request is authenticated against the stored hash. Your notes are returned to the AI tool you configured — we do not control how that tool processes them
• An AI client can alternatively connect over OAuth 2.1 rather than an API key. In that case we store the client's registration details, and the access and refresh tokens issued to it as SHA-256 hashes — never in readable form. Nothing is issued until you sign in and approve the connection on a consent screen that names the client and what it is asking for
• You can revoke your API key or any connected client at any time from your profile page, which immediately invalidates that tool's access
• What an AI tool does with notes it retrieves is governed by that tool's own privacy policy, not ours. Connecting one is your decision and we have no visibility into or control over its processing

Privacy Lock (optional):

• If you set a PIN to lock the launch pad and extension, we store only a SHA-256 hash of it. Setting or removing a PIN on a Google Sign-In account requires a single-use code we email you, stored hashed and only until it expires. A PIN protects against someone at your own device — it is not encryption of your notes

Browser push notifications (optional):

• If you allow notifications in the launch pad, we store the push subscription your browser generates — an endpoint URL at your browser vendor's push service and the two keys needed to encrypt messages to it. It is used only to deliver reminders you set, is deleted when you revoke permission or the subscription expires, and it does not identify you to us beyond the account it is attached to

Notifications and reminders:

• Reminders you set are stored with the note so they can be re-armed after a browser restart. In-app notification records hold a title, a short body, and a link to the note concerned

Billing data:

• Billing is handled entirely by Paddle. We never receive or store your card number, expiry date, or CVV
• We store your Paddle customer ID and subscription ID to manage your subscription status

Active tab URL processing:

• When you navigate to a page, the content script sends the full page URL to the extension's service worker running locally in your browser. The service worker extracts only the hostname (e.g. amazon.com) and stores that in Chrome session storage to power the note count badge. The full URL is processed in memory only and is never sent to our servers unless you save a note on that page
• Session storage is cleared automatically when your browser closes

Offline note queue:

• If our servers are temporarily unreachable when you save a note, the note is held in an offline queue in local extension storage and synced to the server automatically when connectivity is restored. The data held in the queue is identical to what would have been sent to the server

Local note cache:

• After you log in, up to 50 of your most recent notes are cached in local extension storage so the popup can load instantly and remain usable if you are temporarily offline. This cache is cleared when you log out

Retention: Until you delete your account. Account deletion is immediate, permanent, and complete — see Section 9.

4.4 Team Accounts

If you buy or join a team, we store the following in addition to everything in 4.3.

About the team itself:

• Team name, and optionally a business domain and logo URL that the owner enters. The domain is descriptive only — it grants nobody access and we do not verify it
• Which subscription pays for the team and how many 10-seat packs it has

About your membership:

• Which team you belong to and whether you are its owner or a member
• A mention handle derived from your display name, made unique within your team. Your teammates see it when addressing a note or comment to you

Invitations:

• When an owner invites someone, we store the email address they entered, who sent the invitation, and its status — before and whether or not that person ever creates an account. If the invitation is never accepted, this is the only record we hold about them
• The invitation link itself is stored only as a SHA-256 hash. The usable token exists only in the email we send, and expires after 7 days

Shared notes and conversations:

• Whether each note is personal or shared with your team, and which teammates you have mentioned on it
• Comments: the text you write, who wrote it, when, whether it was edited, and anyone mentioned in it
• Notifications generated when someone mentions you or when your team changes

Emails we send: team invitations, and a notification when a teammate mentions you by name. A mention email contains the name of the person who mentioned you, your team's name, the title of the page the note is anchored to, and a short excerpt of the note.

Retention: team records live for as long as the team does. When a team closes, shared notes revert to personal notes belonging to whoever wrote them and their comments are removed. Deleting your account removes your notes and your comments permanently, wherever they were posted.

4.5 Website Visitors (jaabni.com)

Server logs:

• IP address, browser type, pages visited, and timestamps. Logged automatically by our server software (Morgan) for security and debugging. Stored on our EU servers and not shared with any third party.

Analytics:

• We use Plausible Analytics on jaabni.com. Plausible collects no personal data, uses no cookies, and is fully GDPR compliant. It provides aggregated, anonymous information such as page visit counts and general geographic regions — not individual user data. Review Plausible's data policy at plausible.io/data-policy.

4.6 Emails We Send You

All of our email is transactional — we send no marketing and operate no mailing list. Using your email address, we may send you: a welcome message when you register; email verification and password reset codes; the single-use code for Privacy Lock changes; trial reminders at 7, 3 and 1 days remaining and when a trial ends; confirmation that a subscription was cancelled; confirmation that your account was deleted; notice that an account was suspended or reinstated; team invitations; and a notice when a teammate mentions you.

4.7 Moderation, Support, and Staff Access

We hold a small amount of administrative data about accounts: whether an account is suspended and the reason recorded, and whether a team is suspended — for example for non-payment or for a breach of Section 7.2. Suspension records are kept for as long as the account exists.

Being honest about the limits of "we don't read your notes": authorised Jaabni personnel hold administrative access to our systems, which they use to maintain the Service, act on your support requests, and enforce the rules in Section 7.2. That access is restricted to the smallest number of people necessary, used only for those purposes, and covered by confidentiality obligations. Our internal tools surface account and billing records, team membership, and seat counts — they do not present note or comment content, and we do not read it, search it, or export it for our own purposes. We would access specific content only where you ask us to in support, or where we are legally compelled under Section 14.

We use collected data for these purposes only:

We do not:

• Sell your data to anyone, ever
• Use your note content for advertising or machine learning
• Share your data with third parties beyond those listed in Section 8
• Track your mouse movements or browsing behaviour
• Run background scripts on third-party websites

5.1 Limited Use of Data Received from Google APIs

Jaabni's use and transfer of information received from Google APIs, and of any information obtained through the browser extension, adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements. Specifically:

• We use the data only to provide and improve the user-facing features described in this policy
• We do not sell it, and we do not transfer it except as set out in Section 8
• We do not use it for advertising, retargeting, personalised advertising, or credit assessment, and we do not transfer it to a data broker or information reseller
• We do not use it to train, fine-tune, or improve any generalised or standalone AI or machine learning model. Where you connect an AI tool yourself under Section 4.3, the transfer is one you initiate and control
• Humans do not read, and our systems do not process, your note content except as necessary to provide the Service to you, where you give us explicit permission in support, for security purposes, or to comply with applicable law

Joining a team is the only situation in which another Jaabni user can see anything you have saved. This section says exactly what that means.

6.1 Nothing is shared unless you share it

Every note is personal by default. A note only becomes visible to anyone else when you explicitly mark it as a team note. Joining a team does not make your existing notes visible to anyone, and there is no setting an owner can switch to see a member's personal notes.

6.2 What a shared note reveals

When you share a note with your team, the people who can see it can see:

• The text you wrote
• The web address, domain, and page title of the page you saved it on — so sharing a note tells your team that you were on that page
• The short excerpt of the page the note is anchored to, and where on the page it sits
• Its type, tags, colour, status, whether it is pinned or archived, and when it was created
• Your display name and profile picture, as the note's author
• Every comment on it, and who wrote each one

Reminders you set are not shared and are visible only to you.

6.3 Who exactly can see it

A team note with nobody mentioned is visible to everyone in your team. If you mention one or more teammates on it, only you and the people you mention can see it — the rest of the team cannot, and it does not appear in their counts.

One consequence worth knowing: on a note that is already narrowed this way, mentioning someone in a comment gives that person access to the note. On a note the whole team can already see, a mention only sends a notification. The app tells you which of the two you are doing as you type.

6.4 What the team owner can see

The owner is a member with administrative powers over the team, not a supervisor over its people. They can see the shared notes they have access to like anyone else, the member list with names and email addresses, and outstanding invitations. They can delete any comment in their team. They cannot read personal notes, see your password, or access your account.

6.5 When you leave

If you are removed from a team or the team closes, you lose access to shared notes immediately and your own notes are unaffected. Notes you wrote and shared stay with the team while it exists — your colleagues have been working from them. If the team closes, they revert to being your personal notes and their comments are removed.

We remain the data controller for all of this. A team owner is not our customer's processor and we do not act as a processor for them; if you need a data processing agreement for your organisation, contact us.

Jaabni saves what you point it at. If the page you are annotating contains someone else's personal data — a name, a profile, a customer record, a colleague's message — and you save it into a note, you are the person who decided to do that, and this section explains what that means.

7.1 Your role and ours

For the account data described in Section 4 we are the controller. For the content you choose to put inside a note, you decide what is captured and why; we store it on your instruction and do not read it, index it, or use it for any purpose of our own.

If you use Jaabni purely for your own personal purposes, capturing incidental personal data is generally covered by the personal-use exemption in data protection law. If you use Jaabni for work, your employer is responsible for having a lawful basis for the content you capture, and for telling the people concerned. Sharing such a note with a team makes that clearer, not less relevant — you are then disclosing it to your colleagues.

7.2 What you must not capture

You agree not to use Jaabni to:

• Build a record or profile of an identifiable person you have no relationship with or lawful reason to document
• Store special-category data about someone else — health, biometrics, racial or ethnic origin, religious or political beliefs, sex life or sexual orientation, trade union membership — or criminal offence data
• Store payment card numbers, government identifiers, passwords, or authentication codes belonging to anyone
• Extract data you are permitted to view in a system but not permitted to remove from it
• Capture or share content in a way that harasses, monitors, or endangers a specific person

We may suspend an account and remove content where we become aware of a breach of this section.

7.3 If your data is in someone else's note

If you believe a Jaabni user has stored personal data about you, contact support@jaabni.com and we will act on a substantiated request. Please understand the practical limit: notes are private to their author and we do not search or read note content, so we usually cannot locate a note about you without specific information such as the account concerned. We will not run speculative searches across users' notes, including at your request — doing so would itself be a privacy failure. Where you can identify the account, we will contact its holder and, where required by law, act ourselves.

Paddle (paddle.com)

Payment processing. Receives your email address and payment information when you subscribe. Paddle acts as Merchant of Record and handles all payment compliance. Their privacy policy: paddle.com/legal/privacy

Hostinger (hostinger.com)

Web hosting and email infrastructure. Our servers and email service are hosted on Hostinger infrastructure in the European Union. Hostinger processes data as a data processor under our instruction.

MongoDB Atlas

Database infrastructure. All data is stored on MongoDB Atlas servers located in the European Union.

Google (Sign-In users only)

If you sign in with Google, Google provides your name, email address, and profile picture URL. We do not receive your Google password. Google's privacy policy: policies.google.com/privacy

Plausible Analytics (plausible.io)

Privacy-first website analytics. Receives only anonymised, aggregated data. No personal data, no cookies. EU-based.

AI tools you connect yourself (optional)

If you connect an AI client — Claude, Cursor, ChatGPT, Google Antigravity, or any other MCP-compatible tool — using an API key or the OAuth consent flow, that tool receives the notes it requests. This transfer happens only because you set it up, only while the credential is valid, and stops the moment you revoke it. Each such tool is an independent controller of what it receives, under its own privacy policy.

Your browser vendor's push service

If you enable push notifications, reminders are delivered through the push service operated by your browser vendor (for example Google, Mozilla, or Apple). The message payload is encrypted end-to-end using keys your browser generated, so the push service can route the notification but cannot read it.

We do not use advertising networks, data brokers, or social media tracking pixels.

Your teammates are not a third party

People in your team are other Jaabni users, not an external service we pass your data to. What they can see is described in Section 6, and it is determined entirely by what you choose to share.

Access your data

View your account information and all saved notes by logging into app.jaabni.com.

Export your data

Pro and Team users can export their notes as a CSV file from the launch pad. An export covers your personal notes and the team notes you wrote — not notes written by your teammates, because an export is your own data, not a copy of your team's workspace. Guest and free user notes live in your browser and can be managed there — they never reach our servers.

Correct your data

Update your display name from your profile page. Contact support@jaabni.com for other corrections.

Delete your account — immediate and complete

You can delete your account from your profile page at any time. Deletion is a complete, immediate, permanent hard delete with no retention period:

• All your notes are permanently deleted, including notes you had shared with a team
• All comments you posted are permanently deleted, including comments on other people's notes
• All telemetry records associated with your account are permanently deleted
• All credentials on your account are permanently deleted and immediately stop working — sessions, MCP API keys, and any OAuth tokens held by AI tools you connected
• Your notification records, browser push subscriptions, and Privacy Lock PIN hash are permanently deleted
• Your subscription record is deleted and any active Paddle subscription is cancelled immediately — no further charges will occur
• Your user account is permanently deleted

No data is held after deletion. This is not a soft delete. We cannot recover deleted accounts.

If you are in a team

Deleting your account also settles your membership. As a member, your seat returns to your team. As an owner, deleting your account closes the team for everyone in it — you can transfer ownership to a teammate first if you want it to continue. The launch pad warns you and names how many people are affected before you confirm.

You can also ask the team owner to remove you, which releases your seat and returns your account to the free plan without deleting anything you own.

Opt out of extension telemetry

When you open the extension popup, your anonymous guest ID is sent to our servers so we can count active users. No URLs, note content, or personal data are included. To stop this entirely, uninstall the extension.

EU / EEA / UK Residents — Additional Rights Under GDPR / UK GDPR:

• Right to restriction of processing
• Right to object to processing
• Right to data portability — receive your data in a structured, machine-readable format
• Right to lodge a complaint with your local supervisory authority. Find your authority at edpb.europa.eu/about-edpb/board/members_en

Legal bases for processing:

• Contract performance — processing necessary to provide the Service
• Legitimate interests — server security logging, anonymous usage metrics
• Consent — Google Sign-In (you explicitly choose this)
• Contract performance — sharing a note with your team, and sending mention and invitation emails, when you have chosen to share or to invite

No profiling or automated decisions

We do not profile you, score you, or make any decision about you by automated means. Nothing you do in Jaabni feeds a model, an advertising audience, or an eligibility decision.

How we handle a request

To exercise any right, email support@jaabni.com. We respond within 30 days, and free of charge.

We will ask you to verify that you are who you say you are before we act on a request about an account, because handing someone's notes to an impostor would be the worse failure. Where a request is manifestly unfounded or excessive, particularly if it is repetitive, the law allows us to charge a reasonable fee or decline it — we will explain why and tell you how to challenge that.

Nothing in this policy removes or limits a right you have under applicable data protection law. Where anything here conflicts with such a right, the law wins.

We keep data only for as long as it serves the purpose it was collected for. In practice:

Backups: deleting your account removes your data from our live systems immediately. Our database provider keeps encrypted infrastructure backups on a rolling cycle of no more than 30 days, after which deleted data is gone from those too. We never restore a deleted account from a backup, and backups are not searchable or used to serve the Service.

We may retain a minimal record where the law requires it — for example a record that a deletion request was made and honoured, or information we are ordered to preserve. We do not keep your notes for that purpose.

Location: All personal data is stored on servers in the European Union. We chose EU-based infrastructure to provide strong data protection regardless of where you are located.

Security measures:

• Passwords hashed with bcrypt (12 rounds) — never stored or transmitted in plain text
• Access tokens are short-lived (15 minutes) and rotated on each use
• Refresh tokens stored as SHA-256 hashes — raw tokens are never stored
• All data transmitted over HTTPS/TLS
• Payment data never touches our servers — processed entirely by Paddle
• The extension does not hold the tabs browser permission — it cannot access your open tab list
• Mouse position is read once at the moment you press the keyboard shortcut and is never stored or transmitted
• MCP API keys are stored as SHA-256 hashes — the raw key is shown to you once and never stored on our servers
• Team invitation tokens are stored as SHA-256 hashes and expire after 7 days — the usable link exists only in the email we sent
• OAuth access and refresh tokens issued to AI clients are stored as SHA-256 hashes, bound to PKCE, and expire automatically
• Your Privacy Lock PIN and every single-use email code are stored as hashes, never in readable form
• Authentication, sensitive account actions, and note writes are rate limited to blunt brute-force and abuse
• Access to a shared note is checked on every request against your current team membership, so removing someone takes effect immediately rather than when their session expires

If something goes wrong

If a breach occurs that affects your personal data, we will notify the relevant supervisory authority within 72 hours of becoming aware of it where the law requires, and we will tell you directly, without undue delay, where the breach is likely to present a high risk to you. We will tell you what happened, what data was involved, and what to do — not a vague reassurance.

What we cannot promise: no system, ours included, is perfectly secure. The measures above are real and we maintain them, but we cannot and do not guarantee that unauthorised access will never occur. You also share responsibility: keep your password unique, protect your API key, and be careful what you save. This paragraph limits our promises, not your rights under data protection law.

Vulnerability disclosure: If you discover a security issue, email support@jaabni.com before public disclosure. We will not pursue good-faith researchers who report privately, avoid accessing other people's data, and give us reasonable time to fix the issue.

app.jaabni.com: Authentication tokens are stored in your browser's local storage and in a cookie scoped to our domain, both strictly necessary to keep you signed in. Your Privacy Lock state is held in session storage and cleared when you close the tab. We do not use advertising cookies or cross-site tracking cookies, so no consent banner is required.

jaabni.com: Plausible Analytics uses no cookies whatsoever.

Browser extension: Uses Chrome's extension storage APIs (chrome.storage.local and chrome.storage.session). These are isolated to the extension and cannot be read by websites you visit.

If we introduce cookies in the future, we will update this policy and provide a consent mechanism where required by law.

Our servers are in the European Union. Data is transmitted to them over encrypted connections (HTTPS/TLS).

We do not transfer personal data outside the EU except:

• To Paddle for payment processing — Paddle operates under applicable data transfer frameworks
• To Google if you use Google Sign-In — governed by Google's transfer mechanisms

14.1 When we disclose data to authorities

We will disclose personal data to a government body, law enforcement agency, or court only where we are compelled by valid legal process that is binding on us, or where disclosure is strictly necessary to prevent imminent harm to someone, or to investigate fraud or an attack against the Service.

We review every request. We reject requests that are overbroad, informal, or not legally binding on us, and we disclose only the narrowest data that satisfies a valid order. We do not give any government direct, automated, or bulk access to our systems, and we have never been asked to.

Where we are legally permitted to do so, we will tell you before we disclose anything, so that you have the opportunity to challenge it. Sometimes an order forbids us from telling you; in that case we will tell you as soon as the prohibition lifts.

14.2 If the business changes hands

If Jaabni is sold, merged, or transferred — in whole or in part — your data may transfer with it, because a notes service without its notes is not a service. If that happens we will tell registered users by email at least 30 days beforehand, and the acquirer will be bound by this policy until they give you notice of any change. You can delete your account before the transfer takes effect, and deletion works exactly as described in Section 9.

Your data is not an asset we sell separately. We will not sell, licence, or transfer user data on its own, in an insolvency or otherwise.

14.3 Notice for US residents

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under California law and comparable US state privacy laws. We have not done so in the preceding twelve months, and we do not offer financial incentives in exchange for personal information. We honour Global Privacy Control and other opt-out preference signals by default, because there is nothing for them to opt out of.

Jaabni is not directed at children under 13. We do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has provided us with personal data, contact support@jaabni.com and we will delete it immediately.

Users aged 13 to 18 should have parental permission before using the Service.

We will notify registered users by email of material changes. The "Last updated" date above reflects the most recent revision. Continued use after a change constitutes acceptance.

• Email: support@jaabni.com
• Website: jaabni.com
• Response time: Within 30 days

For urgent security matters, email support@jaabni.com with "Security" in the subject line.

Complaints

If you are unhappy with how we have handled your data or your request, tell us first — email the address above with "Complaint" in the subject line and we will respond within 30 days. If you are not satisfied with our answer, you can complain to your local data protection supervisory authority, and nothing here requires you to come to us first or prevents you going to them directly. EU and EEA residents can find their authority at edpb.europa.eu/about-edpb/board/members_en; UK residents at ico.org.uk.

This policy was written to be honest, not to protect us from you. If something here seems wrong or unclear, please tell us.