JaMo

JaMo Privacy Policy

This policy includes the processing of personal information for account sign-in and cloud features. You may choose whether to use these features.

JaMo (the “App”) values your privacy. This policy explains the information processed, the purposes of processing, and how information is retained and deleted. The App’s basic editing features can be used locally on your device. If you use account sign-in or cloud features, information needed for those features is processed on servers.

1. Information We Process and How It Is Collected

Account sign-in

When you choose Sign in with Apple or Google, your account is created or authenticated through the selected authentication service and Supabase. This involves processing your email address, user account identifier, sign-in provider information, and authentication and session information. If you use Apple’s Hide My Email feature, an Apple relay email address may be used.

The App does not directly ask for or store your Apple or Google account password. Authentication information needed to maintain your sign-in session is stored in your device’s Keychain.

During Google sign-in, the authentication provider may pass your name and profile picture URL to Supabase. JaMo does not use this information to display your account or provide project features. The authentication database is configured to remove names and profile picture URLs when account metadata is stored or updated. These fields have also been removed from existing authentication account metadata. Email addresses, user account identifiers, and information needed for authentication are retained.

This measure applies to JaMo’s operational database. It does not establish immediate deletion of information temporarily processed by Google or Supabase during authentication, previously issued authentication tokens, or provider-internal logs and recovery copies. The App does not use this information for advertising targeting.

Cloud storage and synchronization

For projects you choose to upload or synchronize automatically, the following information is transmitted to servers and stored in association with your account:

Local projects for which you do not use cloud features are not transmitted to servers for cloud storage or synchronization.

Service operation records

Authentication and server operations may generate service-provider logs containing authentication events such as sign-in and sign-out, access times, IP addresses, and technical information about requests and errors. This information is processed for service operation, security, and troubleshooting.

Operational logs include request times, request paths, response statuses, and technical information about the App and operating system. Under the current Supabase Free plan, the retention period for API and database logs is one day, and the period for external authentication audit logs is one hour. Additional database storage of authentication audit logs is disabled. These periods apply to the specified log types provided by Supabase; they do not establish when all internal operational records are deleted.

Inquiries and bug reports

If you contact the developer directly by email or another method, your email address, inquiry contents, and materials you voluntarily attach are processed. Attachments may include device information, work files, screenshots, or screen recordings.

2. Purposes of Processing

Information is processed for the following purposes:

The App does not collect your work files for advertising targeting or as materials for training artificial intelligence models.

3. Retention and Deletion

Account information is retained while needed to provide account services. When an account is deleted, associated information is deleted except where retention is required by applicable law. Cloud projects and attachments are retained while you keep them in the cloud and become subject to deletion when server-data or account deletion is completed.

Inquiry materials are received and stored through the email service to respond to inquiries and resolve issues. They are retained until the inquiry and any necessary follow-up have been completed, and deleted when they are no longer needed. Where the law requires separate retention, the applicable legal basis and retention period will be communicated.

Electronic data subject to deletion is removed using methods intended to make recovery or reproduction difficult. Deletion of operational data and deletion of copies in logs or backups may occur at different times.

Under the current Supabase Free plan, API and database logs have a retention period of one day, and external authentication audit logs have a period of one hour. Additional storage of authentication audit logs in the database is disabled. Scheduled backups and point-in-time recovery that users can restore are not currently provided for this project. This does not mean that Supabase has no internal recovery copies.

The developer does not currently download the Supabase database or cloud files for separate manual backups.

When account deletion is completed, the account’s associated JaMo operational data is deleted. Provider logs and recovery copies may be retained separately from operational data and remain subject to the provider’s applicable contract and retention and deletion policies. The specific period until every internal copy expires following individual-user deletion has not been verified. We therefore do not guarantee that every copy is deleted immediately or within a specified number of days. See Supabase’s Data Processing Addendum and its retention and processing-location information. The end-of-service agreement rules between the provider and developer are not applied as an individual JaMo account’s deletion period.

4. Disclosure to Third Parties

The App does not sell user information or disclose it to third parties for advertising. External authentication services and cloud processing necessary to provide the service are described in Section 5.

If information must be disclosed to a third party for a separate purpose, the necessary information will be communicated and consent obtained as required by applicable law, or processing will take place on a legally permitted basis.

5. External Services, Processing Providers, and International Transfers

Supabase

The App uses Supabase for account authentication and cloud features. Supabase supports account and authentication information processing, database and file storage, server functions for synchronization, and operational logging. The provider is Supabase Pte. Ltd.; its privacy contact is privacy@supabase.io. The current project’s primary region for database, authentication data, and file storage is Mumbai, India (ap-south-1).

Apple and Google

Sign-in is performed through the authentication service of Apple or Google, as selected by you. The provider passes authentication information you have authorized to the App’s account authentication system. Information independently processed by each provider is subject to that provider’s privacy policy. Information received and processed by JaMo is subject to this policy.

Email support

Inquiry emails are received, stored, and reviewed through Google’s Gmail service. Email addresses, inquiry contents, and attachments you provide are processed to respond to inquiries and resolve issues. See Google’s Privacy Policy.

Inquiry emails are received and stored through a Google Workspace Business Starter account. The active subscription was confirmed in the Admin console, which did not list a separate Google Vault subscription. Business Starter does not include Google Vault or data-region selection as standard features, so storage exclusively in South Korea or another specific country is not guaranteed. See Google’s edition comparison.

For a standard Google Workspace agreement with a South Korean billing address, the contracting entity is Google Asia Pacific Pte. Ltd. Google’s Cloud Data Processing Addendum permits processing in countries where Google or its subprocessors maintain facilities. The developer’s retention of inquiry emails is separate from Google’s removal of data from its internal systems after customer deletion becomes unrecoverable. Google’s contractual deletion rules are not applied as JaMo’s automatic inquiry-email deletion period, and we do not promise automatic deletion of inquiry emails within a specified number of days. See Google’s Cloud Data Processing Addendum and Workspace’s subprocessor and location information.

Retention and deletion of inquiry emails and attachments follow Section 3. Individual emails are not described as automatically deleted after a specified period.

International transfers

When you use account sign-in or cloud features, your email address, account identifiers, authentication information, selected project data, and attachments are transmitted over the internet to Supabase to provide those features and are processed in the project region in Mumbai, India. Transfers occur when you sign in or request cloud storage or synchronization.

According to Supabase’s official information, logs are processed in EU-based data centers. Supabase Pte. Ltd. in Singapore is the primary processor, and Supabase, Inc. in the United States performs support and operational services as needed. Support staff are distributed across countries, and Storage CDN delivery may involve processing outside the primary storage region. We therefore do not guarantee that all information is processed exclusively in India.

The subprocessor list updated on October 12, 2026 identifies countries and processing roles for each company. It lists AWS, Cloudflare, and Supabase, Inc. under the United States, and Supabase Pte. Ltd. under Singapore. These company-country entries do not mean that all JaMo databases or files are stored in those countries. The actual log, CDN, and support processing locations and internal-copy deletion periods applicable to JaMo still require separate confirmation.

Retention and deletion of accounts and projects follow Sections 3 and 8. If you do not choose account sign-in and cloud features, transfers associated with those features do not occur, and you can use local editing features.

International outsourcing and storage necessary to provide account authentication, cloud storage, and other features you request rely on Article 28-8(1)(3) of South Korea’s Personal Information Protection Act. The relevant processing information is disclosed in this policy. You may refuse transfers associated with these features by not using account sign-in or cloud features. If you already use them, you may stop automatic synchronization or delete your account. Requests about personal information processing or deletion can be submitted to the contact in Section 11. Account and cloud features will be restricted, but local editing on your device remains available.

Not every specific country involved in provider logging, CDN, or support, or the precise deletion deadline for internal copies, has been verified. We provide the processing locations verified so far and the providers’ published information. We do not guarantee that all data is processed exclusively in one country or that every copy is deleted within a specified number of days.

6. Local Work and Cloud Data

The App processes font and work data locally by default. Cloud features are optional. When you use cloud features, selected projects and their attachments are stored on servers so that they can be accessed or synchronized on other devices.

Signing out or uninstalling the App does not delete your server account or cloud data. Disconnecting sign-in through Apple or Google is also different from deleting your JaMo account.

For automatically synchronized projects, “Stop Automatic Sync” deletes the relevant project and attachments from the server while keeping local projects on your device. This feature does not delete your entire JaMo account.

The developer processes data to the extent necessary for service operation, security, troubleshooting, and support you request. If you attach work files or screenshots to an inquiry, those materials may be reviewed to resolve the issue.

7. Children’s Information

The App does not intentionally collect personal information from children.

If a legal guardian requests deletion, or if information about a child is found to have been collected in violation of applicable law, the developer will make efforts to delete it without delay.

8. Your Rights and Account Deletion

You may request access to, correction or deletion of, or suspension of processing of your personal information, and may withdraw consent. Requests can be submitted to the email address in Section 11. Identity verification may be required where necessary. If a request must be restricted under applicable law, the reason will be explained.

Questions about deleting accounts or cloud data can also be submitted to that contact. Local projects remaining on your device must be deleted separately even after server data has been deleted.

To delete your account, open your account information in the App’s Cloud Projects screen, select “Delete Account,” and confirm. Accounts with a linked Apple identity require Apple reauthentication and revocation of authentication tokens before deletion.

When deletion is completed, your JaMo account and its associated cloud projects, documents, operation history, and attachments are deleted. Local projects on your device are kept. Server deletion takes place while the request is being processed. If an error prevents completion, some files may already have been deleted. You can follow the App’s instructions and retry account deletion to remove the remaining data.

Retention and deletion of operational logs and backups follow Section 3.

9. Security Measures

The App communicates with cloud servers over HTTPS and stores local sign-in session information in the Keychain. Server data is designed to use account-based access controls so that users can access data belonging to their own accounts.

The developer limits access to personal information and work data to what is necessary for the relevant work and takes administrative and technical measures needed for service security and troubleshooting.

Row-level security (RLS) is enabled on the operational server’s JaMo data tables, with access policies that check project ownership. The jamo-projects and jamo-sync-assets cloud file buckets are not public. Project and synchronization tables and file storage also have restrictive policies that check whether an account is active.

10. Changes to This Policy

This policy may be revised as laws, service features, or operational policies change.

Significant changes will be announced by publishing the updated information on this page.

11. Contact

For questions about this policy or the processing of personal information, contact:

12. Effective Date

The original policy took effect on March 16, 2026.

The revision covering account sign-in and cloud features was announced on 2026-10-13. These revised provisions apply from the release of the App update that includes account sign-in and cloud features.