Privacy Policy

This is a courtesy translation. The German version is the legally binding one.

Last updated: October 12, 2026

    In short: The core of Jade runs on your iPhone. Focus sessions, streak, statistics, your Screen Time analysis, and the selection of blocked apps stay local. For your account, login, and subscription status, we process your email address via Supabase with servers in Frankfurt. There is no advertising tracking. Only if you ask for an exception during a block or send us feedback does the text you entered go to our server and to Google. Usage analytics are off by default and start only when you expressly consent. By default, your focus minutes flow anonymously into a worldwide total on this website, with no link to your account, and this can be switched off in the settings.
  

1. Controller

Ben Köpke
Am Farnbach 5, 61381 Friedrichsdorf, Germany
Email: meetjade@web.de

We are not required to appoint a data protection officer.

2. What Stays on Your iPhone

Jade stores the following data exclusively locally on the device. We neither collect nor transmit it:

Focus sessions with duration, goal, and date
Streak, focus minutes, sessions, and badges
your Screen Time analysis, that is, the time spent on the iPhone today and the most-used apps. iOS provides this analysis in a sandboxed system component. The data cannot technically be read by us and does not leave your device
the selection of blocked apps and categories. It is managed by Apple’s FamilyControls and is visible even to Jade only as an anonymous token, not as a readable app name
app settings, your display name, an optional profile picture, and your onboarding details

If you delete the app, this data is gone. A backup of your iPhone may contain it; Apple’s privacy provisions apply to that.

3. Permissions

Screen Time (FamilyControls): required to block selected apps and to display the usage overview
Notifications: optional, for the end of a timer, expiry of the daily limit, and reminders

You can revoke both permissions at any time in the iPhone settings. Without the Screen Time permission, the blocks do not work.

4. Account and Login

To use the app, you create an account, either with an email address and password, via “Sign in with Apple”, or via “Continue with Google”. In doing so, your email address, a user ID, the time of login, and the status of your membership are processed. The password is stored exclusively as a cryptographic hash; we never see it. If you use “Sign in with Apple”, you decide with Apple whether we receive your real email address or an anonymized relay address.

If you use “Continue with Google”, Jade opens your iPhone’s system browser for sign-in and sends you to Google. You enter your Google password only there; we never see it. Via our login service Supabase, Google passes us your email address and, where applicable, your name. Google processes data under its own responsibility; Google’s privacy policy applies. Google LLC is based in the USA and relies on EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

The login data is held at Supabase in the Frankfurt region (eu-central-1). The access tokens are stored on your iPhone in the Keychain.

The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR).

5. Synchronization Between Your Devices

So that your progress stays in sync across several devices, Jade stores a small state in your account: a random device ID, device type and time of last contact, as well as your focus minutes of the day, your streak, and the selected accent color.

This data is tied to your account through access rules (Row Level Security). Other users cannot retrieve it. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR). If you delete your account, it is deleted along with it.

6. Purchases and Membership

Purchases are made exclusively through Apple’s StoreKit. Apple processes payment data; we do not receive it. Your account merely records whether an active membership exists. Apple’s privacy policy: apple.com/legal/privacy

7. AI Exception During a Block and Feedback

If a block is running and you ask for a short exception, we transmit the reason text you entered over an encrypted connection to our server (hosted at Railway) and from there to Google’s AI interface (Gemini API). Only the decision, including its duration and a short justification, comes back. If you send us feedback via the rating dialog, your text is transmitted to our server in the same way and stored there in the server logs.

Both happen only if you actively trigger them. We do not store your inputs permanently in a database and do not train any models with them. Together with the request, the server processes your IP address for technical reasons, among other things to limit the number of requests per time period.

Important note on processing by Google: The analysis currently takes place via the free tier of the Google Gemini API. Google may store the transmitted content, have it reviewed by employees, and use it to improve and train its models. Therefore, do not send any sensitive or confidential content via this function. The data may be transferred to servers outside the EU, including in the USA; Google relies on EU Standard Contractual Clauses or the EU-US Data Privacy Framework for this. The Google Privacy Policy and the Gemini API Terms of Service also apply.

The legal basis is your consent through active use (Art. 6(1)(a) GDPR). You can withdraw it at any time by no longer using the function.

The decision on an exception is made by an automated process. It has no legal effect and does not similarly significantly affect you within the meaning of Art. 22 GDPR; you can lift the block yourself at any time via the iPhone settings.

8. Usage Analytics in the App (Optional, Only With Consent)

If you expressly consent to usage analytics, Jade records via the PostHog service which areas of the app are opened and how focus sessions proceed, for example whether a session ends normally or is aborted, whether the paywall was displayed, and whether a subscription was purchased. We also record when something goes wrong, such as a failed sign-in, a failed purchase or a missing Screen Time permission. Only the type of problem is transmitted, never anything you typed and no error texts. A random identifier for your installation is created in the process; we do not transmit your name or your email address.

No screen recording: Jade does not record your screen or the course of your use. Only the individual events described above are captured.

Without your consent, nothing is recorded; the analytics are switched off by default (opt-in). You can switch them off again at any time in the settings, after which no further data is transmitted. The legal basis is your consent (Art. 6(1)(a) GDPR). Processing takes place on PostHog’s EU servers. The PostHog Privacy Policy also applies.

9. Worldwide Focus Statistic (Optional, Opt-Out)

When you complete a focus session, Jade by default reports the number of minutes to a shared counter on our servers, from which the total of all users displayed on meetjade.app is derived. It is not stored anywhere how many minutes came from you individually. There is no link to your account; only the one shared counter grows. The legal basis is our legitimate interest in this display (Art. 6(1)(f) GDPR). You can switch this off at any time in the settings, after which no further reports are sent.

10. This Website

Server logs: When you visit meetjade.app, our host Netlify processes technically necessary connection data such as IP address, time, requested file, and browser type in order to deliver the page and secure operation. The legal basis is our legitimate interest in a secure, functioning offering (Art. 6(1)(f) GDPR).

Nothing is measured without your consent: This website does not load any analytics or marketing scripts on its own. On your first visit, a notice asks whether we may evaluate usage anonymously. Only once you consent is the PostHog service loaded, which records which pages are visited; in doing so, cookies and entries in your browser’s local storage are set. If you decline or do not decide, none of this happens. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Session recording does not take place on the website. You can change your decision at any time via “Cookie settings” in the footer.

What is stored without consent: Your answer to the notice itself (consented or declined, with date) we store in your browser’s local storage so that we do not ask you again. The same applies to a technical marker that remembers whether you skipped the scroll animation. If you sign up for the waitlist, we additionally set a cookie named “jade_wl” (only on submission, not readable by scripts, lifetime 30 days) to prevent repeated spamming. If you reach the home page from an IP address outside Germany, Austria, or Switzerland and are therefore automatically redirected to the English version, or if you switch the language yourself using the toggle, we set a cookie named “jade_lang” (lifetime one year) so you are not redirected again on your next visit. All four are necessary for the operation you requested and therefore require no consent under Section 25(2) TDDDG.

Bot protection for the waitlist (Cloudflare Turnstile): To prevent the waitlist from being spammed automatically, we use Cloudflare Turnstile on the home page. The script required for this is loaded from servers of Cloudflare, Inc. when the home page is opened; in doing so, Cloudflare receives your IP address and information about your browser and device for technical reasons. The actual check runs only when you submit the form. Turnstile works without advertising tracking and does not create a user profile. The legal basis is our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR). The support form does not use Turnstile; it is protected against bots by a hidden field, for which no data goes to third parties.

Waitlist: If you sign up, we process your email address, a hashed confirmation code (not in plain text), and, for a few minutes, a hashed value of your IP address to prevent abuse. The entry becomes effective only after your confirmation by code (double opt-in). The sole purpose is to notify you about the launch of the app. The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe yourself again at any time.

Support form: Your details (category, classification, free text, and an email address if you state it in the free text) are transmitted to us by the form via Netlify Forms. The legal basis is the handling of your request (Art. 6(1)(b) or (f) GDPR).

11. Recipients and Service Providers

Supabase (account, synchronization, waitlist): Supabase Inc., USA, data held in the EU region Frankfurt (eu-central-1). Transfer basis for any access from third countries: EU Standard Contractual Clauses.
Netlify (website hosting, form, server functions): Netlify Inc., USA. Transfer basis: EU Standard Contractual Clauses.
Cloudflare (bot protection for the forms, Turnstile): Cloudflare, Inc., USA. Transfer basis: EU Standard Contractual Clauses. See Section 10 and the Cloudflare Privacy Policy.
Resend (sending of confirmation and notification emails): Resend Inc., USA. Transfer basis: EU Standard Contractual Clauses.
Railway (server for the AI exception and feedback): Railway Corp., USA. Transfer basis: EU Standard Contractual Clauses.
Google (Gemini API, sign-in with Google): see Section 7 and Section 4.
PostHog (usage analytics, only with consent): EU hosting, see Section 8.
Apple (app distribution, payments, Sign in with Apple, notifications): Apple Distribution International Ltd., Ireland.

Beyond this, we do not pass on your data, in particular not for advertising purposes.

12. Retention Period

Account and synchronization data: until you delete your account.
Waitlist: until you unsubscribe, at the latest upon sending of the launch notification.
Unconfirmed waitlist requests and confirmation codes: kept only briefly, they expire automatically.
Support requests: until resolved, thereafter only to the extent statutory retention periods apply.
Server logs: kept only briefly, for troubleshooting and abuse prevention.
Analytics data: according to PostHog’s retention period, at most until you withdraw your consent.
Worldwide focus statistic: permanently as a single total value, with no link to individual accounts.

13. Minors

Jade is aimed at persons aged 16 and over. Younger users should use the app only with the consent of a legal guardian. We do not knowingly collect data from children.

14. Your Rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and the right to object to processing based on legitimate interest (Art. 21). If processing is based on your consent, you can withdraw it at any time with effect for the future, without affecting the lawfulness of the processing carried out until then.

You can delete your account and the associated server data directly in the app. You remove your waitlist registration via this link. You additionally remove local app data by deleting the app. For all other concerns: meetjade@web.de

You can also lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (HBDI), P.O. Box 3163, 65021 Wiesbaden, Germany.

15. Changes to This Policy

If Jade develops further or the services used change, we will adapt this policy. The version published here, with the date stated above, applies in each case.