Legal

Privacy Policy

How JTU.ME collects, uses, and protects your information.

Who I am

This Privacy Policy describes how JTU.ME, available at https://jtu.me or through the Toolbox mobile app, collects, uses, stores and protects your information. JTU.ME is a URL shortener and text sharing service.

JTU.ME is operated by me, Jérémy T. (Koizeay), an individual developer based in Switzerland, and I am the data controller for the personal data described in this policy. I comply with the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR).

For any privacy-related question or request, contact: info@jtu.me.

Where your data is stored

The data I store myself (the database, the server logs and the profile pictures) is stored on servers located in the European Union and Switzerland.

Data I collect

When you create a short link or a paste

  • The URL you shorten or the text you share.
  • The IP address and the user agent (device type, operating system, browser) of the device you use, and the date and time of your access.
  • If you set an access password, its hashed value; if you set an expiration date, the date you chose.
  • If you are logged in, the link or paste is associated with your account.

Pastes marked as encrypted are encrypted in your browser before being sent. I only receive and store the encrypted version and cannot read the plain text.

When you visit a short link

  • The short link you visit.
  • Your IP address and your user agent (device type).
  • The date and time of your visit, and the country derived from your IP address. This data is used to provide the link owner with aggregated visit statistics.

When you create an account

  • Your username, your email address and a hashed password.
  • If you sign in with Google, GitHub, Twitch or Apple, the identifier of your account with that provider and your email address (and, where the provider sends it, your display name).
  • Optional profile information you choose to provide: display name, bio, country, school, profile picture, external links, media, colors and design.
  • Your two-factor authentication settings and, if enabled, the related secret, as well as any WebAuthn passkeys you register.
  • Your language preference.

When you log in

I set a session cookie on your device and keep a server-side session record that includes your IP address and your user agent. Sessions remain valid for up to 60 days.

When you pay for a subscription

If you subscribe to a paid plan, payment is processed by Stripe (card payments) or, inside the mobile app, by Apple (App Store) on iOS or Google (Google Play) on Android. I do not collect or store your full payment card details. I store the customer and subscription identifiers and your plan for as long as the subscription is active. Donations made through "Buy Me a Coffee" are governed by Buy Me a Coffee's own privacy policy.

Server logs

I keep server logs that record, for each request, your IP address, your user agent, the page or path requested, the HTTP method and status and, when you are logged in, your username. These logs are kept for 90 days.

How I use your data

  • To provide and operate the service (creating and serving short links and pastes).
  • To show short link owners statistics about visits to their links.
  • To prevent abuse, fraud and violations of the Terms of Service.
  • To keep the service secure.
  • To send you emails you requested or that are necessary to the service (email verification, password reset, login alerts, subscription confirmations).
  • To comply with legal obligations and to protect the rights and safety of the service, its users and the public.

Automated content review

When a short link or a paste is created, I automatically review it for compliance with the Terms of Service. For a short link, the destination URL and text extracted from the destination page (title, description, headings, links and body text) are sent to an AI provider; for a paste, the text of the paste is sent to that provider. The AI provider is contractually required not to keep the content, not to train its AI models on it, and not to use it for tracking. The result of the review is stored by me. The operator of the destination website may also see the JTU.ME server IP address in its logs.

Analytics

I use Google Analytics (Google Analytics 4) to measure how the website is used overall (pages visited, approximate country and device type). This aggregated usage data helps improve the service. No advertising features are enabled and this data is never used for advertising or to build a profile of you. Google Analytics is not loaded in the mobile app.

Third parties I work with

  • IP geolocation providers (such as ipinfo.io) receive your IP address to determine the country used to display the pricing currency and for visit statistics.
  • Emails are sent through an SMTP provider (Purelymail).
  • Static files of the site (including the third-party JavaScript, CSS and fonts used by the interface) are delivered through a content delivery network operated by Gcore, based in the European Union. Google Tag Manager is also loaded by your browser. These services may see your IP address, but they do not receive the content you share.
  • QR codes are generated by my own servers; no third party receives the encoded URL.

Sharing your data

I do not sell your personal data and do not share it for advertising purposes. Your data is shared only with the service providers described above (as processors necessary to operate the service), when required by law, or to protect the rights and safety of the service and its users. When a service provider is located outside the European Economic Area or Switzerland (for example in the United States), the transfer relies on appropriate safeguards, such as the standard contractual clauses.

Retention

  • Server logs: 90 days.
  • Sessions: deleted when they expire or when the account is deleted.
  • Some data is deleted automatically shortly after use (rate limiting counters, one-time API tokens, password reset tokens, verification codes).
  • Short links, pastes and their visit statistics are kept until you delete them or until they expire. Expired links are no longer served, and links you delete are no longer publicly accessible.

Account deletion and content removal

To delete your account, send an email to info@jtu.me from the email address registered on your account. Your account will then be closed: your subscription is cancelled, your profile data is removed and your account is anonymized. Short links and pastes you created are not deleted automatically; you can ask me to remove them at the same address.

If a short link contains personal data or sensitive information that you do not want to be public, contact info@jtu.me to request its removal.

Your rights

Subject to applicable law, you have the right to access, rectify and delete your personal data, to restrict or object to its processing, and to data portability. You can exercise these rights by contacting info@jtu.me. You also have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, in the European Economic Area, with your local supervisory authority.

Security

JTU.ME uses HTTPS, stores passwords in hashed form, uses secure and signed session cookies, and limits access to personal data to the people who need it to operate the service.

Children

JTU.ME is not directed at children under the age of 16 and I do not knowingly collect personal data from them. If you believe a child has provided me with personal data, contact info@jtu.me.

Changes to this policy

This policy may be updated from time to time. The current version is always available on this page.

For further information: info@jtu.me