Privacy Policy

1. Information we collect

Information you provide directly

• Email address. Collected when you join our waitlist, sign up for product updates, purchase a license, or write to us.
• Name. The name you give at checkout and when you activate JAST, the name you enter on our Contact and Feedback forms, and your display name in a team.
• Purchase and license information. If you buy a license, we receive limited transaction details from our payment processor, such as the plan purchased, the amount charged, and whether the charge is one-time or recurring. We do not receive or store your full card number, CVV, or billing address ourselves — see “Payments and license activation” below.
• Messages you send us. If you write to us through our Contact or Feedback page, we receive whatever you include in that message.
• Team information. If you use Teams, we store the team's name, its members' names, email addresses and roles, pending invitations, and the full contents of every Xpansion or Macro group a team Admin or Manager shares. See “Teams and shared libraries” below.

Information collected automatically

• Hashed IP address. When you submit one of our forms, activate JAST, or the app checks your license, we store a salted hash of your IP address, used only to limit how many requests a single connection can make. We do not store the address itself. The hash is pseudonymous, not anonymous, so we treat it as personal information and delete it after 30 days.
• License checks from the app. About once a week, and once after each update, the JAST app sends its activation token and version number to our server to confirm your license is still valid.
• Update checks. The JAST app downloads update information from updates.jastapp.com. Like any download, this reveals your IP address to our file host.
• Standard technical logs. Our hosting infrastructure keeps ordinary web server logs (such as request timestamps and response codes) for operating and securing the Services, in the same way most infrastructure providers do by default.

Information we intentionally do not collect

We do not request or collect your device's geolocation, contacts, camera, or photo library. We do not offer or use social media login (Facebook, Google, GitHub, or similar). We do not use advertising identifiers, and, as described below, we do not run analytics or tracking scripts of any kind on jastapp.com.

2. How the JAST desktop application handles what you type

JAST's core feature requires operating-system-level permissions to work in any application — on Windows, a low-level keyboard hook; on macOS, Accessibility and Input Monitoring permissions. This is the same category of access a keylogger has, and we treat it accordingly.

• We never log, store, or transmit the content of anything you type. Not to us, not to any third party, not in a crash report, not at any diagnostic level.
• Keystrokes are held only in a small, bounded, in-memory buffer used to detect the trigger phrases you configure. That buffer is cleared on a focus change, on expansion, on timeout, and on any non-text key, and it never leaves your device.
• JAST detects secure input contexts (such as password fields) and suspends buffering rather than reading them.
• Your snippets, placeholders, macros, and settings are stored locally, in a database on your device. We do not have access to them, except for groups shared with a team, as described below.
• JAST's Clipboard History stores what you copy locally on your device so you can find and reuse it. It is on by default, can be turned off, and keeps entries for 7 days unless you change that. It skips copies that password managers mark as private. This data is never transmitted to us and can be cleared at any time from within the application.

Teams and shared libraries

• When a team Admin or Manager shares an Xpansion or Macro group, its entire contents (group and item names, triggers, text, formatting, images, and macro actions) are uploaded to our servers and delivered to the team's members. Nothing is shared unless an Admin or Manager chooses to share it.
• A team with a team key (every team created with JAST 1.2.53 or later, and any team whose Admin or a Manager turns encryption on) encrypts shared groups end to end. They are encrypted on the sharing device with a key that only the team holds and passes along itself, and decrypted on members' devices. We store only the encrypted data. We cannot read it, and we cannot recover a lost key.
• For a team without a key, shared content is encrypted in transit but stored on our database servers in a form our systems can read. We access it only to operate and secure the Services, to help you when you ask us to, or where required by law.
• Either way, we can see the team's name, its members' names, email addresses and roles, and when each shared group was changed and by whom, and its size.
• Do not put passwords, payment card details, health information, or other sensitive personal information in shared groups. If a shared group contains information about other people, the team is responsible for having the right to share it.
• Nobody joins a team without accepting an invitation or having a join request approved. Members' devices keep a copy of shared groups so they work offline. That copy is removed when the member leaves or is removed from the team (on their next reload), or when the device's license is deactivated or expires.
• We keep a record of team actions, such as who invited, removed or changed a member and who shared or unshared a group. This record contains no shared content.

3. How we use your information

• To operate, maintain, and secure jastapp.com and the Services.
• To send you product updates you have asked for, such as closed-testing invitations if you joined our waitlist. We do not send newsletters or marketing email you have not asked for.
• To process one-time and recurring payments and to deliver and support your license.
• To respond to messages you send us through our Contact page.
• To detect and prevent fraud and abuse, such as rate-limiting repeated signups from the same connection.
• To comply with our legal, tax, and accounting obligations.

We do not use your information for interest-based advertising, and we do not build advertising profiles or make decisions that produce legal or similarly significant effects using automated processing.

4. Cookies, analytics, and advertising

We do not use any of the following on jastapp.com:

• Digital analytics or traffic-tracking software (such as Google Analytics)
• Advertising, or advertising networks of any kind
• The Facebook Pixel or any comparable conversion-tracking pixel
• Retargeting for advertising purposes
• Advertising or tracking cookies, web beacons, or comparable tracking technologies

Because we do not track visitors across sites or over time, our servers do not currently respond differently to a “Do Not Track” browser signal — there is no tracking to disable. If that ever changes, this Policy will be updated to explain how we respond, and we will update the “Last updated” date above accordingly.

5. How we share information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share personal information only with:

• Service providers who process it on our behalf and under our instructions:
  • Vercel, which hosts jastapp.com and runs our server code in Singapore.
  • Our database, which runs on a server we operate ourselves and holds the records described in this Policy.
  • Cloudflare, which stores and delivers app downloads and updates.
  • Brevo, which sends our email, such as your license key and our own copy of your messages.
• Paddle, our reseller and merchant of record. Paddle sells you the license and processes your payment under its own privacy policy. Paddle's script loads when you click a Buy button, or on the Pricing page if we cannot show prices without it.
• Legal and safety reasons, if required to comply with a law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of JAST, our users, or others.
• Business transfers, if we are involved in a merger, acquisition, or sale of assets, in which case we will provide notice before personal information becomes subject to a different privacy policy.

6. Payments and license activation

JAST offers both a one-time license purchase and a recurring subscription plan. Whichever you choose, payment card details are collected and processed directly by a third-party payment processor, not by us. We do not receive, transmit, or store your full card number, expiration date, CVV, or billing address; we receive only what is necessary to confirm your purchase and provision your license.

A JAST license may be activated on a limited number of devices (currently two). To enforce that limit, we keep an activation record for each device: a random identifier the app creates, your operating system, the app version, and when the device was activated, last checked in, and deactivated. We do not collect your computer's name. This record is used only to administer your license and provide support.

7. Data retention

• Hashed IP addresses: 30 days.
• Unaccepted team invitations: 30 days.
• Contact and Feedback messages: 12 months.
• Waitlist email addresses: until you ask us to remove them.
• Payment and license records: as long as your license exists, and afterwards as long as tax and accounting law requires. If you ask us to erase your data, we remove your name and email from these records and keep only what the law requires.
• Shared team groups: until unshared or the team is deleted. A team's membership and activity records are deleted with the team.

Copies may remain in our database backups until those backups are deleted.

8. Data security

We use reasonable technical and organizational measures to protect personal information, including encrypting data in transit and limiting access to personnel and service providers who need it to do their jobs. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Children's privacy

The Services are not directed to, and are not offered to, children under the age of 13, and we do not knowingly collect personal information from children under 13. If you are under 16 (or the age of consent that applies where you live), please do not use the Services or provide us with personal information without your parent or guardian's involvement. If we learn we have collected personal information from a child in a way that is not permitted by law, we will delete it. If you believe a child has provided us with personal information, please contact us using the details below.

10. Your privacy rights

If you are in the European Economic Area, the UK, or Switzerland (GDPR)

We process your personal information on the following legal bases:

• Contract, to provide the license you purchased, and to send the waitlist and product updates you asked for.
• Legitimate interests, to secure our systems, prevent fraud and abuse (such as rate-limiting), and answer messages you send us.
• Legal obligation, for recordkeeping we are required to perform.

Subject to applicable limitations, you have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Request erasure of your personal information
• Restrict or object to certain processing
• Receive a portable copy of your information
• Lodge a complaint with your local data protection supervisory authority

If you are a California resident (CCPA/CPRA)

In the preceding 12 months, we have collected the categories of personal information described in Section 1 above: identifiers (your name and email address) and, where you make a purchase, commercial information (your order and license details). We collect this directly from you and, for abuse prevention, automatically via a hashed IP address. We have not sold or shared (as those terms are defined under the CCPA) any personal information, and we do not use or disclose sensitive personal information beyond what is necessary to provide the Services.

Subject to applicable limitations, California residents have the right to:

• Know what personal information we have collected, used, and disclosed
• Delete personal information we have collected from you
• Correct inaccurate personal information
• Opt out of the sale or sharing of personal information (we do not sell or share it)
• Non-discrimination for exercising any of these rights
• Appeal a denial of a request
• Designate an authorized agent to act on your behalf

Exercising your rights

To exercise any of the rights above, contact us using the details in “Contact us” below. We may need to verify your identity, typically by confirming the email address associated with your request, before acting on it, and we will respond within the timeframe required by applicable law.

11. International data transfers

Our server code runs in Singapore, and our service providers may process personal information in other countries, including the United States and the European Union. Where the law requires it, we rely on safeguards such as the European Commission's standard contractual clauses for these transfers.

12. Third-party links

The Services may link to third-party websites we do not operate. This Policy does not apply to those sites, and we encourage you to review their own privacy policies before providing them with any information.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page, and for material changes we may provide additional notice, such as a notice on jastapp.com. We encourage you to review this page periodically.

14. Contact us

If you have questions about this Privacy Policy or want to exercise any of the rights described above, please visit our Contact page.