Legal
Privacy
What this site stores about you, in full. It is a short list, and every line of it is checkable against the source code.
What is stored
| What | Why | How long, and in what form |
|---|---|---|
| Your email addressemail: · key: · account: | One free key per address, and so a signed-in visitor can be shown their own key's usage. | Plaintext, lowercased. Kept until you revoke the key. |
| A SHA-256 hash of your API keykey: | To recognise the key when you present it. | The key itself is never stored and cannot be recovered — not by you, not by us. Shown once at issue. |
| A count of decisions used this monthusage:<month>:<email> | The free tier is 5 credits a month and something has to count them. | An integer per address per month. Expires on its own 40 days later. |
| A session, if you sign in with Googlesession: | So you stay signed in. | An opaque random id in a httpOnly cookie. The row holds your email, name and avatar URL from Google. 30 days. |
What is not stored
- The text you send to the API or type into the playground, chess board, Wikirace or any other tool. It is forwarded to the model and the answer is returned. Nothing writes it anywhere — grep the repository for a log line and you will not find one.
- Your Google password. The sign-in happens on Google's own page; this site never sees it.
- Any payment detail, because there is nothing to pay for.
- Anything you typed, in analytics. lib/analytics.ts sends event names and buckets only, and says why at the top of the file.
The first of those is the one worth being precise about, because it is the one that matters if you paste a real support ticket into the playground. Your text is sent to TypeSafe's API, because that is the whole point of the tool — what it is not is written to a database or a log on this side. TypeSafe states that it does not train on customer requests or responses; that is their claim about their systems, not ours, and it is linked below.
Cookies
| Cookie | Set when | Life |
|---|---|---|
| jev_session | You sign in with Google. httpOnly, SameSite=Lax, Secure. | 30 days |
| jev_oauth_state | You start a sign-in. A CSRF guard, single-use, cleared the moment you come back. | Minutes |
| _ga, _ga_* | Always. Google Analytics 4, property G-GFSFDXTZNN. | Up to 2 years, set by Google |
| — | Umami sets no cookie at all. It is the second analytics tool here and the one we would keep if only one survives. | n/a |
The ad iframes set cookies of their own that this site neither controls nor reads. They are served from a separate document precisely so their scripts are not running in the same place as your session — but that is a containment measure, not an absence. If you would rather not have them, a content blocker removes the slot entirely and nothing on this site breaks.
Who else sees anything
| Vercel | Hosting and request logs |
| Neon | The Postgres database holding the rows above |
| Sign-in (OAuth) and Google Analytics 4 | |
| Umami | Analytics, alongside GA4. No cookies, no fingerprinting, and it honours Do Not Track |
| TypeSafe AI | The Jev API. Receives the text you submit to a tool or the API |
| OpenRouter | Fallback route for the same calls when the first-party API is unreachable |
| Adsterra | The ad slots. Loads in an iframe and sets its own cookies |
Deleting what we have
There is no account-deletion form, and pretending otherwise would be worse than saying so. What there is, is an endpoint that removes the two rows that identify you:
DELETE /api/keysSend your key as the bearer token. It revokes the key and releases your address, which is everything stored about you except the month's decision count — that one is deliberately kept, because it is what stops “delete and re-register” from being an unlimited free tier. It expires on its own 40 days later.
If you want it gone sooner than that, or you have lost the key and cannot send it, open an issue on the repository and it will be deleted by hand.
Analytics, if you would rather not
Google Analytics respects Do Not Track only if you use an extension that blocks it; the browser setting alone does not stop it. Any content blocker does. Umami, the second tool here, is configured to honour the browser setting on its own, and to drop query strings and hashes before they are recorded — this site puts things like ?purchased=starter in a URL and none of that belongs in an analytics store. Neither tool has a server-side fallback, so blocking them genuinely means we cannot see you.
Last reviewed 2026-09-19.