Privacy Policy
Version 2026-11-01 · Last updated November 1, 2026
The short version. We collect only what we need to run your account: your email, a scrambled (hashed) password, sign-in and activity records for security, and the messages you send us. We use one essential sign-in cookie. No advertising, no analytics trackers, no session recording, no fonts or scripts loaded from other companies, and we never sell your data.
Who we are
JustGamma (justgamma.com) is operated by [legal name of the owner or company], [business mailing address]. Contact us about privacy through the Contact page.
What we collect
- Account: your email address; your password, stored only as a salted one-way hash (we cannot see it); your access status (trial, free, paid, blocked); when you accepted the Terms and confirmed you are 18 or older; whether your email is confirmed.
- Sign-in and activity records: when you sign up, log in (including failed attempts), log out, reset a password, and when you were active (at most once every 15 minutes), with the IP address, the country our host derives from it, and your browser/device type. We keep the most recent 1,000 entries per account.
- Messages: what you send through the Contact page (name, email, message, IP address and country), and whether you have seen or dismissed messages we show you.
- Billing (only if you subscribe, when available): Stripe processes your payment details; we receive and store only a Stripe customer ID, subscription status and renewal date. We never see or store your card number.
- Technical logs: our hosting provider keeps short-lived request logs for security and reliability.
Cookies and browser storage
- jg_session: one strictly necessary cookie that keeps you signed in (HttpOnly, Secure, SameSite=Lax; only a random token whose hash we store). It is required for the Service and does not track you across sites.
- Local storage holds two small display preferences: whether to show the signed-in menu before the page finishes loading, and which notices you hid. They contain no personal data.
- We do not use advertising or analytics cookies, third-party trackers, session-replay tools, or externally hosted fonts or scripts. If we ever add optional analytics, we will ask for your consent first.
Why we use it
- To provide the Service and your account (performance of our contract with you).
- To keep accounts secure, prevent abuse and enforce our Terms (legitimate interests; legal obligations).
- To answer your messages and send service emails: password resets, email confirmation and account notices. We do not send marketing emails.
- To process payments when subscriptions are offered (contract; legal obligations such as tax records).
Who we share it with
We do not sell or rent personal information, and we do not share it for advertising. We use these service providers, who process data on our behalf: Cloudflare (hosting, database, security), Resend (sending email), and Stripe (payments, when offered). We may disclose information if required by law or to protect our rights, users or the public. These providers may process data in the United States and other countries; we rely on their contractual and legal safeguards for such transfers.
How long we keep it
- Account data: while your account exists. When an account is deleted, we delete its account data, sessions, activity log and messages shown to you; a masked record of the deletion is kept for security. Contact messages you sent are kept but unlinked from the deleted account.
- Contact messages: until we delete them after handling.
- Stripe keeps its own payment and invoice records as required by law.
Your rights and choices
Depending on where you live (including under Canada's PIPEDA, the EU/UK GDPR and California's CCPA/CPRA), you may have the right to access, correct, delete or obtain a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. Make a request through the Contact page; we will verify it comes from the account holder and respond within the time the law requires. You may also complain to your data-protection authority (in Canada, the Office of the Privacy Commissioner of Canada). We do not sell or share personal information as those terms are defined under California law.
Security
We use encrypted connections (HTTPS), hashed passwords, secure cookies, rate limits and access controls. No system is perfectly secure; if a breach affects you, we will notify you as the law requires.
Children
The Service is only for people 18 or older. We do not knowingly collect information from anyone under 18; if we learn we have, we will delete it.
Changes
We may update this policy. If changes are material, we will ask you to accept the new version before you continue using the Service. The version and date are shown at the top.