Privacy Policy

1. What We Collect

• Account info: email address, password (stored as a salted hash, never in plain text)
• Conversation content: messages you send and the responses you receive
• Basic usage metadata: timestamps, which mode/features you used, account tier

2. How We Use It

To operate the Service: authenticate you, generate responses, maintain your conversation history so you can return to it, and enforce these policies (including automated safety review of content, and — for flagged content — a recorded compliance log).

3. Where Your Data Lives

Jenny is self-hosted: your data is stored in a database we operate (currently hosted on Railway), not sent to a third-party AI API provider. Responses are generated by a model we run ourselves. Session login is handled via an httpOnly cookie that client-side code can never read directly.

4. Who We Share It With

We don't sell your data. It's shared with:

• Infrastructure providers necessary to run the Service (currently Railway, for hosting/database/compute)
• Google AdSense, on free-tier accounts only, to serve ads. AdSense may use cookies and device information to select and measure ads; it does not receive your conversation content. See Google's policy on data used by partner sites for what Google itself does with that information, and your options for controlling ad personalization
• Stripe, for paid-tier accounts only, to process payment — we never see or store your full card details ourselves

5. Cookies

We set one cookie ourselves: a session cookie required to keep you logged in. Free-tier accounts also load Google AdSense, which may set its own third-party cookies to serve and measure ads — we don't control these directly. Paid-tier accounts, which don't see ads, aren't served these third-party cookies.

6. Your Rights

You can delete individual conversations yourself at any time from the chat sidebar. Under UK GDPR you also have the right to: access the personal data we hold about you; correct it if it's inaccurate; request erasure of your account and associated data; restrict or object to certain processing; and receive your data in a portable format. To exercise any of these rights — including full account deletion, which is currently a manual process rather than a self-service button — contact legal@willgraves.co.uk. We'll respond within one month. If you're unhappy with how we've handled your data, you can also complain to the UK Information Commissioner's Office (ico.org.uk).

7. Children

The Service isn't directed at children under 16. We don't knowingly collect data from children under that age; if we learn we have, we'll delete it.

8. Changes

We may update this Policy from time to time; material changes will be reflected here.

9. Contact

Questions about this Policy, or data requests: legal@willgraves.co.uk.