Legal
Cookies and storage
Cookies only while you sign in, for a few minutes. Your work in your browser's own storage. That's all.
The sign-in cookies
jf_google is set when you choose Continue with Google. It holds a random check value and a one-time code verifier so the sign-in can't be hijacked. It's HttpOnly, lasts at most ten minutes, and is cleared as soon as you're back.
jf_onetap is set when a page of this website (while you are not signed in) or one of the app's sign-in screens offers your Google account in the browser's own sign-in prompt. To offer it, the page loads Google's sign-in script, so Google learns that the page asked; it learns who you are only if you pick an account. It holds a one-time number the sign-in must carry, so a sign-in can't be carried over from another browser. It's HttpOnly, lasts at most ten minutes, and is cleared when you pick an account. g_csrf_token is set for the moment you pick it, as Google's sign-in asks, and is cleared with it.
Google's sign-in prompt
On the log-in page and the app's sign-in screens, in a browser that has its own sign-in prompt (Chrome, Edge), your browser loads Google's sign-in script from accounts.google.com so it can offer the Google account you already use. Google receives that request, like any site you load something from. Jefield never reads Google's cookies, and the rest of the website doesn't load it.
What we don't use
No analytics cookies, no advertising cookies, no tracking. So there's nothing to opt out of, and we don't ask you to accept anything. We don't sell or share personal information.
Your browser's own storage
Jefield keeps your library and settings in your browser's own storage, not in cookies. None of it is read by anyone but this site on this device, and none of it is used to follow you. A library's entries carry the account they belong to, so two people on one browser never see each other's work.
| Where | Name | What it holds | How long |
|---|---|---|---|
| IndexedDB | jefield.log | The record of your library: projects, versions, boards, what you kept and when | Until you erase it or clear the site's data |
| IndexedDB | jefield.holdings | Your files as they came, and their previews | Until you erase them or clear the site's data |
| localStorage | jefield.session, jefield.account | The sign-in session, and the name, email and picture of who is signed in | 30 days, or until you sign out |
| localStorage | jefield.key, jefield.pen | Your library's key and your device's signing key, which seal what syncs and sign what you publish | Until you sign out or clear the site's data |
| localStorage | jefield.welcome, jefield.notice | The website's welcome answers (look, email updates, what you make, team size) and that you've seen the note about storage; never sent | Until you clear the site's data |
| localStorage | other jefield.* names | Settings and conveniences: the look, rulers, tips seen, the names of your computer's fonts, your brand, what is being saved | Until you clear the site's data |
| sessionStorage | jefield.signedout | The one line Jefield shows after you sign out, in that tab | Until the tab is closed |
The apps for Windows, Mac and Android keep the same things in their own folder on your computer or phone. The privacy page says what leaves the device and when.