Privacy
This describes what jamiio actually stores, who can see it, and what it is used for. It is written to be checked against the software rather than to cover us, so where something is uncomfortable it is said plainly.
What is held
Before you sign in
The app works without an account. When it does, it identifies your browser by a random key it generates and keeps on your device. That key is not a name and is not linked to you — it is how the server knows that the person asking for a record is the one who created it. Clearing your browser storage discards it, and anything scoped to it becomes unreachable.
When you sign in
| Your email | Needed to send the sign-in code, and to recognise you on another device. |
|---|---|
| Your name and picture | Only if you sign in with Google, and only what Google returns for your basic profile. |
| Sessions | A signed cookie and a matching row. Signing out deletes the row, and it stops working immediately. |
No passwords. There are none to store, lose or steal — a six-digit code to your email, or Google, and nothing else.
What you put in
| Your profile | Name, home, phone and area, if you fill them in. |
|---|---|
| Membership | Which communities you belong to, your role in each, and which home. |
| What you do | Requests you raise, proposals, votes, contributions, jobs sent to a trade, and messages you post. |
| Money | What you owe, what you have paid, and what you have given. Kept as double-entry bookkeeping, so every figure can be traced to the movement that produced it. |
What is recorded about what happened
Meaningful changes are written to a record that is not edited afterwards — a request approved, money posted, a member released from a community. A correction is a new entry rather than a rewrite, because a record that can be quietly altered is not evidence of anything. Each entry says who acted, what changed, and when.
Operating the service
Request counts for rate limiting, faults with the message and stack of what broke, and a security log for organisations using the API. Faults never include request bodies, so what you typed is not in them.
What never leaves your device
Photographs. When the app reads a photo — to guess what a maintenance problem is, or to read a flier — the image is processed in your browser and is not uploaded. The result may be sent; the picture is not.
Who can see it
| Other members | Your name as your community chooses to show it — initials by default — and what you post. Not your contact details. |
|---|---|
| Your committee | Contact details, which home you are in, and the record of decisions. Not other communities. |
| Your treasurer | Balances by name. Nobody else sees who owes what. |
| A trade you contact | Enough to find the house and greet you — never a way to reach you outside the job. |
| Organisations using the API | Only what a community has granted, scope by scope, and only after that organisation has been approved. |
Two rules are worth stating on their own, because they are the ones most often broken by software of this kind:
- Who owes money is never published. A community can see what it is collectively owed as a single figure. It cannot see a list, a ranking, or a name.
- An address is a place, never a person. The address register says where somewhere is and what it is called locally, so a courier or an ambulance can find it. Looking one up never returns who lives there.
Asking for help
Where a community uses jamiio for mutual aid, whether you are named to other members is a setting, and it defaults to not named. Giving anonymously hides your name from other members; the community's own record still shows that a real member gave, which is what stops an empty appeal looking busy.
Where it is
In a PostgreSQL database in Frankfurt, Germany, run by Neon, reached only by the application. The application runs on Vercel, also in Frankfurt.
Who else is involved
| Neon | Stores the database. |
|---|---|
| Vercel | Runs the application and serves the site. |
| Resend | Delivers sign-in codes. Receives your email address and the code. |
| Only if you choose to sign in with it. Returns your email, name and picture. | |
| Open-Meteo | Weather and place lookup. Receives an approximate location, never who is asking. |
Nothing is sold, and there is no advertising, no tracking across other sites, and no analytics that follows you. The app is not instrumented to measure how long you spend in it.
How long it is kept
Your profile and membership last as long as you are a member. Leaving a community removes your membership; the community's financial and decision records are kept, because a community cannot un-decide what it decided or un-spend what it spent. Sign-in codes expire in ten minutes. Sessions expire after thirty days, or immediately when you sign out.
What you can ask for
- A copy of what is held about you.
- A correction, if something is wrong.
- Removal when you leave, other than entries that form part of a community's financial or decision record.
- To stop being emailed, without losing your account.
Ask at privacy@jamiio.net. If you are in the UK or EU, these are your rights under the UK GDPR and GDPR, and you may also complain to your data protection authority.
Children
jamiio is for adults running and living in a community. It is not designed for children and accounts are not knowingly created for them.
Changes
If this changes in a way that affects what is held or who can see it, the date above changes and anyone signed in is told. Quiet edits to a privacy policy are how trust is lost.