Privacy
Jasette is a family tool. This page explains in plain words what is kept, where your messages go and who can read them.
What we keep
- Your account: the name of the sign-in provider (such as Google), the email address and name it gives us, its identifier for you, a preferred language, a chosen appearance, the homework-help setting, a plan, the dates the account was created and approved, and the date of your last visit. No password is ever stored here.
- Conversations: nothing on our servers. Messages and replies are never saved on our servers. Only a report sent with the box ticked attaches the open chat to an email. Your browser keeps a copy of your recent chats, only in this browser (see "On this device").
- The number of turns and conversations started each day (in total and by age range), the account, the age range, the model and the token counts of each API call (its cost is estimated from them), and a log of safety alerts (the account, the kind of alert, the age range and the date), without message text.
- A log of the administrator's actions, which names the accounts concerned by number, not by email, and keeps the email of the administrator who acted. Entries from before sign-in with a provider may still hold the old logins.
Where the conversation lives
So the assistant remembers the latest exchanges, the page keeps a masked copy in a token signed by the server and sends it back with every message. The server stores it nowhere. The token stops working after a while: an older chat can still be read on this device, but not continued. Opening a new conversation starts without any memory of the previous one.
On this device
Your recent chats are saved only in this browser, on this device: the masked messages, the replies and the chat's signed token. Nothing is sent to us for this. Reloading the page, changing language or reopening the tab brings a chat back, and the saved chats list beside the chat shows every chat saved on this device for your account. Any of them reopens in its own range. Anyone using the device while you are signed in can reread them, a child's chats included. This device also remembers the last age range used, so the chat opens in it. Logging out or clearing the browser data erases the saved chats and that setting. Safari can also erase them after 7 days without a visit, unless the site is added to the Home Screen. Nothing is saved without JavaScript.
Masking before anything is sent
Our server replaces phone numbers, email addresses, postal codes and simple street addresses with neutral text before a message is sent to the AI provider or kept anywhere. Only the masked message is sent or kept. The contact form on the home page is not a chat and masks nothing: see "Email".
Where messages go
Masked messages are sent to the AI provider the administrator has selected: Anthropic by default, or OpenRouter when the service is switched to it. OpenRouter does not keep the messages or the replies by default and does not train models on them, but the model provider it routes the request to may keep them under its own terms. Anthropic keeps what is sent to its API and the replies for up to 30 days, and for up to 2 years if its safety systems flag them, and does not train models on them.
Anthropic's API data retention policy
Where the data is kept
Accounts, counters and alerts are stored in a database hosted by Turso, and the app runs on Vercel. Both services are located in the United States, in addition to the processing by the AI provider described above.
The contact form on the home page sends us two things by email: the address you type and your message, exactly as typed (nothing is masked). The email is delivered through Resend, an email delivery service in the United States. Neither the address nor the message is kept in our database. To limit abuse, we keep a count of the messages sent through the form each day, a number with no address and no text, for 2 days.
The Report a problem button in the chat sends us, by email through Resend, the message with personal details masked, the email address of the account (so we can reply), the account number, the age range, the language and the version of the app. A checkbox, ticked to begin with, adds the conversation that is open too: the messages with personal details masked and the replies shown, none of it kept in our database. If the message holds a worrying phrase, it is not sent: the email then holds only the account number and those details, never the message or the conversation. A chat in which a worrying message was already written is not attached either. To limit abuse, we also keep the number of reports sent each day by each account, a number with no text, for 2 days.
We may also email ourselves, through Resend, about a refused sign-in to the administrator account (the sign-in provider and the time), and once a day a summary of the previous day in plain counts: new accounts, accounts waiting for approval, chat turns that showed the help card by age range, failed calls to the AI provider and failed sign-ins by provider and reason. The summary holds no address, name, message or account number. To prepare that summary, we keep a daily count of failed sign-ins by provider and reason, with no identity, for 2 days.
When an account is activated, we may send its address one welcome email through Resend. It holds the address, the account's language and two links, and no child data. When an account deletes itself, we may send that address one confirmation the same way, with no child data. To limit abuse, we keep a daily count of these emails per account, with no address, for 2 days.
Payments
The Plus plan is sold through Stripe. To pay, your name and address go to Stripe, a new piece of personal information we do not keep ourselves; no child data is sent to it. Stripe acts as the seller: Link appears on your statement, and receipts, refunds and support go through Stripe and Link.
Stripe and Link process this information in the United States and other countries, under their own privacy notice.
To limit abuse, we keep the number of payment requests each account makes per day, a number with nothing else, for 2 days.
How long
Safety alerts are deleted automatically after 30 days. An account that nobody approved within 30 days is deleted too. Usage counters and call records are kept for 395 days. The administrator's action log is kept with no time limit.
Who can see what
The administrator manages accounts (and approves them, unless approval is automatic) and sees usage and safety alerts, without message text. It also reads the reports sent by email, with the conversation attached when the box is ticked.
Deleting data
Saved chats can be deleted one by one or all at once from the saved chats list beside the chat, and logging out erases them all. An account that is still waiting for approval can be deleted from its waiting page, and an active account and its data can be deleted from the Account page, which also erases the chats saved in this browser.
Cookies and tracking
Only five kinds of small cookies: one keeps you signed in (before you sign in it only protects the forms), one remembers the language you chose before signing in, one remembers the appearance (light or dark) saved in your account once you are signed in; before signing in, it remembers this device's choice, and Automatic follows each device's own setting; one remembers which idea buttons the chat showed last (only their numbers) so the next page shows other ones, and short-lived ones carry a confirmation message or protect the sign-in itself. The browser's preferred language is read to pick the first language shown, and the header itself is not stored. A new account starts with the language shown at first sign-in as its language setting, which you can change on the Account page. Besides cookies, the browser's local storage holds your saved chats and a few small markers, such as a logout time (see "On this device"). No ads. Visits to the public pages (Home, About, Privacy and Sign in) are counted without cookies by our host, Vercel: it receives the page address, your IP address (it uses it to work out the country), the kind of device and browser and the site you came from, never a name or an account. Nothing is counted once you are signed in, in the chat or in the parent area. Nothing is loaded from other sites: no scripts, fonts or images.