This is an informational translation. The binding version is the Polish privacy policy.

Privacy Policy

In effect from 5 November 2026. It covers the JayNest iPhone app, the web app at app.jaynest.app, the JayNest account and the jaynest.app website. The previous version was in effect from 4 November 2026; the new one describes Sign in with Google and the app language stored with the account.

In short

JayNest works without an account. In that case, what you enter stays only on your phone and is not sent to us.

A JayNest account is optional and is used to sync your catalog across devices. Once you create one, your catalog and photos are also stored on our server in Germany, and photos and encrypted database backups in the European Union. We don't sell data, show ads or track you.

Who is responsible for the data

Bity i bajty uśmiechniętej Marty, Budy Siennickie, Poland. Contact: [email protected].

The app without an account

The phone stores rooms, containers, items, photos, dates, prices, tags, properties and settings. Without an account, the app doesn't send this data over the internet. It contains no ads, analytics or tracking.

This data may be included in your phone's backup in iCloud or on a computer, if backups are turned on. You manage that backup, and we have no access to it.

The JayNest account

When you create an account and sign in, we store:

• Account data: email address, whether it is confirmed, the date the account was created and the app language (Polish, English or Japanese) in which we send emails. We don't store your password, only a secure hash of it.
• Sign in with Apple: the identifier assigned by Apple, the email address from Apple (it may be a hidden relay address) and an Apple token used only to revoke the sign-in when the account is deleted.
• Sign in with Google: the identifier assigned by Google and the email address from Google. We don't store Google tokens: they are used only once to confirm your identity when you sign in.
• Devices: the device name reported by the phone or browser (e.g. “Browser: Safari, macOS”), the dates of sign-in and last use, and hashes of sign-in tokens. You can see the list of devices in the web app and sign out any of them.
• Catalog: everything you enter in the app: rooms, containers, items, dates, prices, tags, properties, marks in the “Needs Attention” tab and photos. Also the name and phone number of a person something was lent to, if you enter them. The contact identifier from Contacts and notification settings stay only on the phone.
• Change history: when a change from one device overwrites a change from another, we keep the previous value of the field so that nothing disappears without a trace.

We use the IP address during the connection and to limit the number of sign-in attempts. We don't store it in the database.

When you create an account or change your password, we check whether the password has appeared in known data breaches, because such passwords are easy to guess. Only the first five characters of the password's SHA-1 hash are sent to the Have I Been Pwned service; they can't be used to recover the password or to find out whose it is. Neither the password nor the email address leaves our server.

The web app

The app at app.jaynest.app works only with an account and shows the catalog stored on the server. After you sign in, it stores two cookies with sign-in tokens in the browser. They are necessary for the app to work, so we don't ask for consent. The page's scripts can't access them (HttpOnly), and they are sent only to our server and only over an encrypted connection. Without “Keep me signed in on this computer” checked, they disappear when the browser is closed, and the server ends the session after 12 hours without use anyway. With it checked, you stay signed in for up to 60 days from the last use.

In the browser, the catalog is kept only in the memory of the open page; we don't save it on the computer's disk. Signing out deletes the cookies and the page data. A photo added from disk is first resized and saved again by the browser, without camera metadata such as the location where it was taken. The web app doesn't use analytics or advertising tools.

We do this to provide the account and sync service you ask for (Art. 6(1)(b) GDPR) and to protect accounts from break-ins and data from loss (Art. 6(1)(f) GDPR). Data about other people, e.g. who something was lent to, is entered by you and is only part of your catalog.

Where the data is and who processes it

• Hetzner Online GmbH, a server in Nuremberg, Germany: the account and catalog.
• Cloudflare: photos and encrypted database backups in the R2 service with storage in the European Union, sending emails with address confirmation and password changes, and hosting the website and domain names. Cloudflare, Inc. is based in the USA. When data leaves the European Economic Area, the basis is the EU-US Data Privacy Framework or standard contractual clauses.
• Apple: only when you sign in with Apple. Apple confirms your identity under its own privacy policy.
• Google: only when you sign in with Google. Google confirms your identity under its own privacy policy.
• Have I Been Pwned (a service by Troy Hunt): checking whether a password has leaked, as described above. The service receives no personal data.

Photo files are in private storage and reach the phone only through addresses valid for one hour, issued to signed-in devices with access to the catalog. Connections to the server are encrypted.

How long we keep data

• Things deleted from the catalog stay in the Trash for 30 days and then disappear forever, photos included.
• A device not used for more than 60 days is signed out and removed from the device list.
• Deleting the account in the iPhone app or in the web app immediately deletes the account, devices, catalog and photos from the server and, for Sign in with Apple, also revokes the sign-in with Apple. Encrypted database backups disappear on their own after 30 days.
• Signing out leaves the data on the phone, but it stops syncing.

Emails

We send to the account address only the emails needed for it to work: a link to confirm the address, a link to set a new password and a notification when the password has been changed. If you write to us, we use your address and the content of your message only to reply.

Phone permissions

• Camera: taking photos and scanning QR labels.
• Photos: attaching photos from the library to items and containers.
• Contacts: you choose a person in the system window, and the app doesn't see the whole list. It stores only that contact's name, number and identifier to assign the loan to them. With an account, the name and number sync with the catalog; the identifier doesn't.
• Notifications: a weekly summary of deadlines, created on the phone.

The website

The website is hosted by Cloudflare, which may technically process the IP address, among other things, while handling connections. The website counts visits with Cloudflare Web Analytics. This tool doesn't use cookies or build visitor profiles; the statistics include, among other things, the address of the visited page, the type of browser and the country. Label pages and pages opened from links in emails are not counted. QR labels are links to this website. Opening a label without the app passes on its identifier but doesn't reveal the contents of the catalog.

Your rights

You change and delete the data in the catalog yourself in the app, and you can delete the account in the iPhone app (Settings → JayNest Account) or in the web app at app.jaynest.app/konto. You can also request access to your data, its correction, deletion, restriction of processing or transfer in a file, or object to processing. Write to [email protected] from the account address. You have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO) in Poland.

Changes

We will announce changes on this page and, for significant changes concerning the account, also by email before they take effect.