Privacy

In short

To work in Jefield you sign in with Google. Your library is sealed with its own key on your device before a copy goes to the server, and that key is bound to your account, kept sealed on the server and handed only to your other signed-in devices. That's how your phone and computers open the same library. It also means the server's operator can open your library. Looking around (templates, community, a project shared with you to look at) needs no account, and keeps nothing of yours.

Jefield is made by Moc Mallen Studio ("we", "us"), which decides how the personal information described here is used.

What stays on your device

• The record: what you kept and when, versions, projects, boards. In this browser's IndexedDB (jefield.log).
• Originals and previews: the same browser's IndexedDB (jefield.holdings).
• Settings: language, theme, view, the sync key and the sign-in session (30 days), in this browser's localStorage. The website's welcome answers (look, email updates, what you make, team size) and that you've seen the note about storage are kept there too, and never sent.
• Cutting out, removing and filling, cleaning up a voice: all run on this device. Pictures and sound are not sent anywhere.
• Fonts on your computer: where the browser can (Chrome, Edge), Jefield asks once before it lists the fonts installed on your computer. The list stays on this device; a font's file is read only to put it into a PDF you export.
• The apps (Windows, Mac, Android): the same storage, kept by the app on your computer or phone, in its own folder.

We can't see any of this. It's yours, on your device.

What leaves the device, only when you do it

• Sync (when you sign in): the record and originals are sealed with AES-GCM-256 on this device before they go to the server. Their names are keyed hashes, so without the key the server can't tell what anything is. Erasing a thing for good removes its sealed copy too, and erasing a project for good removes its boards, words, comments and history from the sealed record as well: from this device, from the cloud, and from your other devices when they next sync. A deleted file or project is erased on its own thirty days after you delete it. The server counts how many bytes each library's sealed copy takes, to keep the free limit; it can't tell what they are.
• Google sign-in (Settings, Account): only what Google vouches for is taken: the account id, email, name and picture. No Drive or other Google data, and no such permission is asked. On the log-in page and the app's sign-in screens, a browser with its own sign-in prompt (Chrome, Edge) loads Google's sign-in script from accounts.google.com to offer the Google account you use; Google receives that request (your IP address, and that Jefield asked), and picking an account signs you in the same way. The server issues a 30-day session per sign-in and keeps your library's key and pen sealed under your account (AES-256-GCM, with a secret only the server holds). A signed-in device that asks is handed the key. No user list, device list or activity log is kept.
• Publishing a template: the template's parts, its preview, its name, a sentence about it and the name you typed go to the public community shelf, signed with your device's key. Likes, comments and reports go there too. Anyone can see what you publish.
• Sharing a project (Share, in a project): the project is copied into a space of its own, sealed with a key made for it, and that sealed copy (with the pictures it uses) goes to the server so the people you invite can open it. The key travels only inside the link you send, after the # where browsers never send it. The names you type in the Share sheet go to the others in the project. While you're in a shared project together, your screens connect directly (WebRTC), so each sees the other's network address; when a direct connection can't be made, the encrypted traffic is relayed by Cloudflare's TURN service. Stop sharing removes the sealed copy. Delete for everyone removes it too, and the project leaves the others' devices the next time they are online in Jefield; a copy someone saved as their own stays theirs.
• Fonts from the font list: the first time you use one of the 2,000 families in the font list, its files are downloaded from cdn.jsdelivr.net (Fontsource), which sees that request (your IP address and which font), never your work.
• Updates: the apps check this website for a newer build of what is inside them, and GitHub for a newer app; those requests carry ordinary request data (IP address, the app's version), nothing of yours.
• Downloads: a file or version you download goes where you save it.
• AI: Jefield never sends your work to an AI. The AI tools in it today run on your device.
• Writing to us: what you put in a message to us, so we can answer.

What we collect, why, and for how long

We don't use analytics, advertising identifiers, error collectors or tracking cookies. We don't sell or share personal information, and we don't use it for advertising or to train AI models.

Who helps us run it

• Vercel hosts the site and the server functions, and may keep ordinary access logs (IP address, time, address requested). Servers are in the United States.
• An object store (Vercel Blob, or an S3-compatible store) holds sealed sync copies and the community shelf.
• Google handles sign-in when you choose it, and serves its sign-in prompt on the sign-in pages.
• Cloudflare stores the sealed copies (R2) and relays a live connection between devices when they can't reach each other directly (TURN); it sees encrypted traffic, never its contents.
• Public CDNs (cdn.jsdelivr.net, huggingface.co) serve the on-device models and the font list's fonts the first time you use them; they see the download request (your IP address and the like), never your files. This website's fonts are served by Jefield itself.
• GitHub hosts the Windows, Mac and Android installers and their updates; it sees the download request.

Information may be processed in the United States and other countries where these providers work. Where the law asks, transfers rely on the providers' standard contractual safeguards.

Your rights

Wherever you live, you can ask us to see, correct, export or delete the personal information we hold about you, and to stop using it. Most of it you control directly: erase things, turn off sync, sign out, or take down what you published. For the rest, write to us and we'll answer within 30 days.

• EU, UK and similar laws: you also have the right to object, to restrict processing, to withdraw consent at any time, and to complain to your data protection authority.
• California and other US states: you have the right to know, delete, correct and port your information, and not to be treated differently for using these rights. We don't sell or share personal information, and we don't use sensitive information beyond providing the service.
• Korea: a Korean version of this page comes with Jefield's Korean release. Until then, write to us in Korean or English and we'll answer in your language.

Children

Jefield isn't meant for children under 13, and we don't knowingly collect their information. Where the law sets a higher age for consent (16 in parts of the EU), younger people need a parent's permission. If you think a child has given us information, write to us and we'll delete it.

Deleting

Erasing a file or a project for good removes it from this device, the cloud and your other devices. Signing out first makes sure your work is in your account, then clears this browser's copy; anything that could not reach your account stays on the device, sealed to you. Clearing this site's data in your browser deletes Jefield on that device. Synced copies are sealed; only your signed-in devices are handed the key, and we don't open them. To keep a copy first: Settings, Your library, Download a backup.

Changes

When this page changes, the version and date at the top change, and important changes are posted on the blog before they apply. Version 1 (October 18, 2026) said the same things in fewer sections; version 2 added what we collect, our providers, your rights and children; version 3 (October 24, 2026) followed the new app: no link previews, no reading words in pictures, and no hand-offs to AI; version 4 (the same day) added shared projects and the live connection; version 5 (the same day) says the server counts each library's sealed bytes for the free limit; version 6 (the same day) follows sign-in becoming the way to work: every working library's key is kept with its account; version 7 (October 31, 2026) adds Google's sign-in prompt on the sign-in pages and the note about storage; version 8 (November 3, 2026) adds the font list's downloads, fonts on your computer, the apps' update checks and GitHub, and what signing out does.

Contact

Moc Mallen Studio, mocmallen.com, through the contact page.