Privacy Policy

Draft — replace with your finalized date before launch

This is a starting template, not legal advice. Rules around data privacy (like GDPR or CCPA) vary by where your users are, so have a lawyer review this before launch.

1. What we collect

Data	Why we collect it
Name, email, password (or Google account)	To create and secure your account
GitHub repository connection and commit activity	To generate project updates automatically
Project names, client emails, preview links	To run the core service — sharing progress with your clients
Update reactions/comments from clients	To show feedback on the project timeline

2. How we use it

We use this information to operate Jessel: creating your account, connecting your repositories, generating update summaries, sending notification emails, and displaying your project timeline to the clients you choose to share it with.

We don't sell your data, and we don't use your commit content to train unrelated products.

3. Third parties involved

Supabase — stores your account and project data.
GitHub — provides commit and repository data you connect.
Google — used only if you choose "Continue with Google" to sign in.
Groq — processes commit messages to generate plain-English summaries.
Email provider (e.g. Resend) — sends notification emails to you and your clients.

Each of these providers has its own privacy practices governing how they handle data on our behalf.

4. Client data

If you add a client's email address to a project, we use it only to send that client update notifications for that project. Clients don't need to create an account to view their project link.

5. Data retention

We keep your data for as long as your account is active. If you delete a project or your account, associated data is removed within a reasonable time, except where we're required to retain it by law.

6. Your choices

You can disconnect GitHub or Google at any time from account settings.
You can delete individual projects or your entire account at any time.
You can turn off email notifications from your notification preferences.

7. Security

We use industry-standard practices (like encrypted storage of access tokens) to protect your data, but no system is 100% secure. Let us know if you ever notice something that looks like unauthorized access.

8. Changes to this policy

We may update this policy from time to time. We'll update the date at the top when we do.

9. Contact

Questions about your data? Reach out at [your contact email].