What we keep, and what we do with it.

Jean Technologies. Questions, requests and complaints go to jonathan@jeantechnologies.com, and a person reads that address.

This page covers the Jean API, the console you sign in to, and this website. It does not cover what a third party does with data after you send it somewhere else.

Sign-in goes through Google Identity Platform. We never see or store a password. What we keep from sign-in is:

• the user id the identity provider gives us
• your email address
• which organisation you belong to

That is the whole account record.

Every account belongs to an organisation, and the organisation is what owns things here: keys, submissions, results and usage.

An API key belongs to the organisation rather than to the person who created it. A key is shown once, at creation. After that we store only a SHA-256 hash of it, so we cannot show it to you again or recover it for you — we do not have it. A lost key is revoked and replaced, not retrieved.

When you send work to the API we use it to compute the score you asked for and to return a result and an execution trace. By default, nothing else.

The default setting is scoring_only. An organisation may choose otherwise:

• scoring_only — submissions are used to produce your result and for nothing else. This is the default.
• aggregate_ok — we may additionally publish aggregate statistics that include your usage.
• training_ok — we may additionally use your submissions to improve Jean models.

The choice is made per organisation, not per user. We record which setting was accepted, by whom, and when. An organisation owner can change it at any time, and the change applies from the moment it is made.

Results and execution traces are stored in Google Cloud Storage, under access rules that make them readable only by the organisation that produced them.

Input files you upload are deleted after thirty days. Results and traces are retained, so that a score you were given stays something you can go back and check.

Every API request is metered, one record per request. That log is what billing and quotas are computed from, and it is append-only: entries are written, not edited.

Administrative actions are written to a separate append-only audit log, with the actor, the time, and the IP address the action came from.

We measure how the product is used: ids and counts of actions such as sign-ups, key creation and job submission.

We do not send submission content, email addresses, API key prefixes or results to our analytics provider. None of that leaves the systems that need it to run the service.

On this website, PostHog records page views. It stores an identifier in your browser so that repeat visits count as one visitor.

If you email us, or use a form on this site, we receive what you wrote and the address you wrote from, and we reply to it. Transactional mail from the platform is sent through Resend.

The platform runs on Google Cloud, in the United States. If you are outside the United States, using the platform means your data is processed there.

The companies we rely on to run the service:

• Google Cloud Platform — hosting, identity and storage
• Vercel — this website
• PostHog — product analytics
• Resend — transactional email

An organisation owner can ask us to delete the organisation by emailing jonathan@jeantechnologies.com. We remove the organisation's data and the artifacts stored for it.

Two things survive that: the billing usage records and the audit log. We keep those as business records.

The date at the top of this page is the date it last changed. When something material changes we will say so, rather than quietly editing the text.

The companion document is the terms of use.

Jean Technologies — jonathan@jeantechnologies.com