Privacy policy
Updated on November 3, 2026
jey.net is a personal non-commercial portal for tracking films, books and images. Below is an honest description of what the service stores and what happens to it. If something is still unclear, write to the project tracker.
1. What data is stored
- Account: email address, display name, Google account identifier (subject), interface language, avatar, banner, registration date and the public-profile flag. The service has no password: Google performs the sign-in.
- Records: type, title, subtitle, year, status, rating, note, source link, tags, creation and update dates, and a TMDB film metadata snapshot.
- Files: uploaded covers, avatars and banners, plus their smaller renditions; file size and type information.
- Technical data: session token hashes, sign-in and last-activity dates, IP address and browser user-agent, session expiry, sign-in and request rate-limit counters. The service does not send any service emails right now.
2. Public profile
The public profile is enabled manually in settings and is off by default. When it is on, the /u/… link shows the name, avatar, banner and finished records only: type, title, year, rating, tags, cover and the author's note for that record. Drafts, plans and records in other statuses are not shown.
Public profiles are listed in sitemap.xml and may be indexed by search engines. Turn the public profile off in settings — the page immediately starts answering “not found” and the link stops working.
3. Why it is needed
- to run the service: sign-in, record storage, cover rendering;
- to protect accounts: sign-in and request rate-limit counters, session lifetime;
- to show film data: the service queries TMDB by film id but does not send account data there.
The data is not used for advertising, is not sold and is not shared with third parties other than the hosting provider, Google (sign-in) and TMDB (film metadata), as described above.
4. Where and how it is stored
The data lives on a hosting provider's server: records in PostgreSQL, files on the server disk. The connection is encrypted (HTTPS, Let's Encrypt certificate). There is no analytics, ad tracking or third-party CDN.
To issue the certificate, Let's Encrypt receives the site's domain name — standard ACME protocol work that does not involve personal data.
5. How long it is kept
- sessions — up to 30 days, then they stop working;
- rate-limit counters — within the window and block (up to an hour);
- records and files — until you delete them; after account deletion they are kept anonymized for 30 days;
- the database is not backed up at the moment.
6. Account deletion
Deletion is available in settings. No password is requested: confirmation is typed as the word “delete”. What happens:
- all sessions and devices are revoked;
- the email is replaced with an anonymous one, the name becomes “Deleted user”, the public profile is turned off;
- records and uploaded files are anonymized and kept for another 30 days, then deleted together with the account;
- an account cannot be restored after deletion.
7. Your rights
- Access and portability: settings offer an export of all records to JSON and CSV.
- Correction: name, language, avatar, banner and records are edited in the interface.
- Deletion: individual records, files and the account are deleted in settings.
- Questions: project tracker.
8. Cookies and local storage
Two cookies are used: jey_session — a random session token, HttpOnly and removed on sign-out; jey_lang — the chosen interface language. The theme is stored in the browser's localStorage. There are no advertising or analytics cookies.
9. Changes
This policy may change together with the service. The last-update date is shown at the top of the page; significant changes are worth re-reading.
The short version: the public profile is off by default; when it is on, finished records with their notes are visible; export is available in settings, and deleting the account anonymizes the data. Terms of use are linked below. Terms of use.