JEVCASES / PRIVACY

Privacy Policy

Effective date: September 25, 2026 · Version 0.3

1. Who is responsible

JevCases is the service name. The data controller is the individual who operates JevCases: a private individual resident in Hangzhou, China, trading as JevCases. Where the law requires the controller to be identified — for example in response to a valid data-protection or authority request — that identity is disclosed to the requesting party. Read the Terms of Service for the service scope and the billing, cancellation and refund terms.

Operator’s legal name

JevCases — the trading name of an individual sole proprietor resident in Hangzhou, China. The operator is a natural person, not a registered company.

Operator type

Individual or sole proprietor, not a registered company.

Country or region

Hangzhou, China

Registered address

Not applicable. JevCases is operated by an individual, so there is no registered business address.

Privacy contact

support@jevcases.com

Data protection officer

Not applicable. The operator does not carry out large-scale monitoring or process sensitive categories of data.

2. What we collect

2.1 Information you give us

• Placement draft. The project or brand name, website link, short description and optional image URL. A featured-case draft also includes the category, the description of Jev’s role and an optional repository URL. Records carry a generated ID and creation and update times.
• Paid placement. When you buy a placement, the same record also carries the payment status, the order and payment IDs, the checkout session ID and its expiry, the publication time and, for an advertisement, the date its 30-day period ends. We also receive and store the email address the payment provider reports for the order. We never receive your card number.
• Support and privacy requests. Whatever you choose to include in an email to us.

There are no user accounts and no password. A draft is associated with a browser cookie instead.

2.2 Information collected automatically

• Technical data. IP address, request time and browser and request headers, used to deliver pages, limit abuse and diagnose faults. The draft API applies IP-based rate limiting.
• Payment notification logs. When the payment provider notifies us that an order completed or was refunded, the processing log records the notification ID, the order ID, the placement ID, the store ID and, when a notification is not acted on, the reason. It does not record card data or the full email address.
• Draft access cookie. A random value set on your first successful draft save. See section 4.
• Analytics. Visits and interactions on the homepage and case pages. See section 4.

2.3 What we do not collect

• Payment card numbers. Card entry is intended to take place with the payment provider, not on this site.
• Passwords, identity documents, or a marketing or advertising profile.
• Precise location data.

The directory separately contains public project descriptions, author handles, repository links, images and recorded star counts. That is public directory information about projects, not personal data you submit to us.

3. How we use it and our legal basis

• Saving, previewing and restoring your draft — to provide the service you asked for (performance of a contract).
• Delivering the site and its demonstrations — legitimate interests.
• Security, abuse prevention and rate limiting — legitimate interests.
• Diagnosing faults — legitimate interests.
• Understanding site usage through analytics — legitimate interests, or your consent where the law requires it.
• Administering a paid placement, billing and refunds — performance of a contract.
• Meeting tax and accounting obligations — legal obligation.
• Answering support and privacy requests — performance of a contract or legitimate interests.

We do not use your draft content to train AI models, and we do not use it for advertising.

4. Cookies and tracking

Strictly necessary. The first successful draft save sets an HttpOnly cookie named jevcases_sponsor. It lets the same browser edit its case and advertisement drafts separately. It has a 180-day lifetime, and the server stores only a SHA-256 hash of its random access value. It is not an advertising identifier. You cannot turn it off and still use the draft feature.

Analytics. The homepage and case pages include Google Analytics, which can process visits, page interactions, device and browser information and cookie identifiers. See Google’s Privacy Policy and its Analytics opt-out information. You can turn analytics off with that opt-out add-on, or by restricting cookies and tracking in your browser.

We set no advertising, cross-site or social tracking cookies.

Clearing cookies removes editing access from that browser but does not delete the stored draft, and does not remove it from our systems.

5. Sharing and disclosure

We do not sell your personal information, including as “sale” is defined by laws such as the CCPA, and we do not share it for cross-context behavioural advertising. We share it only as follows:

• Cloudflare hosts the site, the draft storage and the shared demonstration state, and processes network information for delivery and security. See Cloudflare’s Privacy Policy.
• Waffo Pancake is the payment processor. Payment card data is entered with and handled by Waffo Pancake, which processes it as a PCI-DSS compliant provider, and card data is never stored on our servers. We send Waffo the order details needed to process the payment and receive back the order's status, amount and email address; we never receive your full card number.
• Google receives analytics data where its script runs.
• AI model providers. When a visitor enables a connected model in the configurable poker demonstration, the browser sends game state, permitted actions and strategy instructions to the provider that visitor selects, such as OpenRouter or a supported direct provider. The shared Jev live demonstration sends decision inputs to TypeSafe. The shared table and its action history are visible to other visitors.
• External image hosts receive an ordinary network request when a preview loads.
• Legal and regulatory. Where we are required to disclose information by law, a court order or a valid request from a competent authority.
• A business transfer. If the service is ever transferred, we will tell you and make sure the protection described here continues.

Do not send passwords, API keys, identity documents or payment details through the content form. Those fields are intended for a future public card.

6. Security

• The production site is served over HTTPS.
• The draft cookie value is stored only as a SHA-256 hash, and private ownership fields are omitted from public responses.
• Draft access is checked against the hash of the browser cookie.
• The draft API applies IP-based rate limiting.
• Access to production configuration is limited to the operator.

We do not claim a completed external security audit or certification, and no system is risk-free. Anyone with access to your browser can edit your draft. If a breach affects your rights, we will notify you and the relevant regulator without undue delay, and within 72 hours of becoming aware of it where the law requires that deadline.

7. How long we keep it

• Placement drafts — name, links, description, image URL, category, Jev role and timestamps: kept for 24 months from the last update, then deleted automatically.
• Draft access cookie — 180 days, in your browser. Expiry does not delete the stored draft.
• Support and privacy correspondence — 24 months, then deleted.
• Security and request logs — 30 days, then deleted.
• Google Analytics data — 14 months, then deleted by the analytics provider.
• Order and payment records — the order and payment IDs, the email address reported for the order, the amount, the currency and the product name: kept for 7 years from the transaction to meet tax and accounting obligations, then deleted by a daily cleanup job.

A cleanup job runs at least once a day and deletes expired draft records, including the pointer that links a browser to its draft. You can ask us to delete a draft earlier — see section 8.

8. Your choices and rights

Depending on where you live, you may have the right to be told what we hold and why, to receive a copy, to have inaccurate information corrected, to have it deleted, to restrict or object to processing, to receive it in a portable format, to withdraw consent, and to complain to a data protection authority.

To use any of these rights, email support@jevcases.com. We respond within 30 calendar days. We may ask you to confirm control of the browser or email address involved before we act, so that we do not delete or disclose someone else’s draft. Because a draft is tied to a browser cookie rather than an account, we can only locate it if you contact us with the draft ID or from that browser.

9. Marketing

We do not send marketing email and we do not run a mailing list. If that ever changes, we will ask for your consent first and give you a working way to opt out. Messages about a purchase you have made, such as a refund confirmation, are not marketing and are not affected by any opt-out.

10. Where your data is processed

JevCases is operated from Hangzhou, China. Cloudflare, Google and the AI model providers listed in section 5 may process data outside your country. Where the law requires specific safeguards for a transfer, we rely on the safeguards those providers already have in place, including standard contractual clauses. Contact us if you want to know which mechanism applies to your data.

11. Children

The service is intended for adults aged 18 or over, and it is not designed to collect information from children. We do not knowingly collect information from anyone under 18. If you believe a child has given us information, email support@jevcases.com and we will delete it.

12. Third-party links and services

The directory links to third-party projects and can load externally hosted images. This policy covers only what JevCases collects directly. The operators of those services control their own data practices, so review their policies before sending them information.

13. Changes to this policy

Every version is dated at the top of this page. Material changes to what we collect or how we use it will be published here with at least 14 days’ notice before they take effect, and will not apply retroactively to a draft you have already saved. Activating payments will be treated as a material change.

14. Contact

Privacy requests, deletion requests and questions about this policy: support@jevcases.com. We aim to acknowledge ordinary support email within 2 business days, and we answer rights requests within 30 calendar days as stated in section 8.