Privacy Policy

1. Who is responsible

The Services are provided by J20 ("we", "us"), which is the data controller for the personal data described here. For any privacy question, or to exercise your rights, contact privacy@j20.dev.

2. What this covers

This policy covers both sites (j20.dev and labs.j20.dev), your account, purchases, downloads, support, and every app we publish. It does not cover third-party services we link to, which have their own privacy policies.

3. Data we collect

Account & authentication

When you create an account we process your email address and authentication identifiers via Firebase Authentication. If you sign in with Google or Apple, we receive basic identifiers from them (such as your email); we never receive your Google or Apple password.

Purchases & billing

When you buy Premium, Stripe processes your payment. We receive billing metadata such as your Stripe customer and subscription IDs, plan, status and renewal date — not your full card number. We keep this record so we know what you have bought.

Support

If you email us, we process your message and contact details to help you.

Website analytics

On labs.j20.dev we use Cloudflare Web Analytics, which is cookieless and privacy-friendly: it measures aggregate traffic without cross-site tracking or building a profile of you.

Our apps

Our apps run on your own device. They do not upload your files or documents to us. Signing in unlocks the paid features included in your plan.

Where a particular app handles data differently — for example if it connects to a service you configure yourself — that is described in that app's own terms, linked from its product page.

4. How and why we use data

We use personal data to:

• provide the app, your account and Premium features;
• take payment and manage subscriptions and renewals;
• provide support and respond to you;
• keep the Services secure and prevent abuse;
• understand aggregate usage to improve the product;
• meet legal, tax and accounting obligations.

Legal bases (GDPR)

Where the GDPR applies, we rely on: performance of a contract (providing the app, your account and Premium); our legitimate interests (security and minimal aggregate analytics); consent (where required); and legal obligation (for example, keeping billing records).

5. Who we share data with

We do not sell your personal data. We share it only with service providers ("sub-processors") that help us run the Services, under appropriate agreements:

• Google Firebase — authentication and database (accounts, purchases);
• Stripe — payment processing and subscription billing;
• Cloudflare — app download delivery and cookieless website analytics;
• Vercel — website hosting.

We may also disclose data where required by law, or to protect our rights, our users, or the Services.

6. International transfers

Some providers are based outside your country, including in the United States. Where personal data is transferred internationally, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an equivalent mechanism.

7. How long we keep data

We keep your account and purchase data while your account is active, and billing records for as long as tax and accounting law requires. Support emails are kept as long as needed to handle your request. Aggregate analytics contain nothing that identifies you. When data is no longer needed, we delete or anonymize it.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, port, restrict or object to the processing of your personal data, and to withdraw consent. To exercise any of these, email privacy@j20.dev.

We answer requests within one month, as the GDPR requires. If a request is complex we may need longer, and we will tell you why.

If you are in the EU/EEA or the UK, you also have the right to lodge a complaint with your data-protection supervisory authority. In Poland that is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) — uodo.gov.pl.

9. Security

We use reputable providers and reasonable technical and organizational measures to protect personal data. No method of transmission or storage is completely secure, but we work to protect your information.

10. Children

The Services are not directed to children and are not intended for anyone below the age of digital consent in their country. We do not knowingly collect data from children; if you believe a child has provided us with data, contact privacy@j20.dev.

11. Changes to this policy

We may update this policy. The "Last updated" date shows the current version, and we will communicate material changes where appropriate.

12. Contact

For any privacy question or request, contact privacy@j20.dev. Please also read our Terms of Service.