Privacy Policy

Last updated: July 23, 2026

Summary: Jellyfish keeps your AI session keys on your device; it never sees them or sends them to our servers. Only the comments you deliberately share, your profile, and your login identity are stored on our cloud. We do not sell your data.

1. Who is the data controller

This policy applies to the "Jellyfish" app and its services. For questions: [email protected]

2. What data we collect

Account/identity: the unique user ID sent to us when you sign in with Google or Apple, and (if shared) your email. We never see your password.
Profile: your handle, display name, and profile photo if you upload one.
Content: comments, likes, ratings you share about a page/video/product and the page URL they attach to.
Social: friend requests, your friends list, users you block.
Technical: minimal logs needed to run the service (request time, error logs). We use no advertising/tracking cookies.

3. Data that stays on your device — never sent to the cloud

Jellyfish runs AI through your own subscription (Claude, ChatGPT, Gemini, Kimi). Those providers' session keys/tokens are kept only in the respective tool's own vault, on your device. Jellyfish does not read, store or transmit them to its servers. Your AI conversations also stay on your device.

4. Why we process data

To create your account and keep you signed in
To show your comments and provide friend/social features
To prevent abuse (spam, harassment) and maintain security

5. Where your data is stored

Your cloud data (account, profile, comments) is stored in a PostgreSQL database on a server in Germany/Finland (Hetzner). Profile photos are stored on Cloudflare R2. Traffic is encrypted end-to-end with TLS.

6. Third parties

Google / Apple: for sign-in (authentication) only. Their privacy policies apply.
Cloudflare / Hetzner: our infrastructure providers (hosting, security).
We never share or sell your data to anyone for advertising or marketing.

7. How long we keep it

As long as your account is active. When you delete your account, your data is marked and permanently deleted within 30 days (if you return within that window, your account is restored). Legal obligations are an exception.

8. Your rights

You have the right to access, correct, delete and object to the processing of your data. Contact [email protected]. For rights under Turkish KVKK, see the KVKK Notice.

9. Children

Jellyfish is not directed to users under 13.

10. Changes

We may update this policy; significant changes will be announced in the app. The current version is always on this page.