JaoPor privacy policy

1. Accounts

• You sign in with Google or GitHub. We receive your name, email and profile picture from that provider and use them to create your account and show your name/picture on your projects and profile.
• We never see or store your Google or GitHub password.
• Account data is stored in a Supabase database (Singapore region).

2. Project and profile information you enter

• Project details (name, description, links, screenshots, etc.) are public once you publish.
• Builder profiles: you choose per field (e.g. province, social links, experience, skills) whether it's shown to everyone, signed-in members only, or hidden, and you can leave the builders directory.
• The LINE ID and contact email you add are shown only to people whose contact request you accept.
• Product updates, comments and images you post are public. Images are resized and converted in your browser, and location data (EXIF) is removed before upload. A post's author sees who liked it; everyone else sees only the count.
• When you add a project, we record which steps you completed (for example: opened the form, created the project, chose how to verify your numbers) and the type of error if one happened, linked to your account, so we can find the hard steps and make them easier. We don't record what you type, links or keys. This isn't shown to anyone and is deleted automatically after 180 days, or right away when your account is deleted.

3. Numbers from connected services (revenue, GitHub activity and visitor counts)

• API keys you connect (e.g. Stripe) must be read-only. We encrypt them before storing and decrypt them only on our server when fetching numbers.
• We store aggregate numbers only (e.g. 30-day revenue, MRR, visitor counts), never your customers' data.

4. The JaoPor visitor counter (the snippet founders add to their own sites)

• Each page view on a site using the snippet sends one beacon. No cookies.
• Our server computes a keyed hash (HMAC) of the IP address and user agent with a key that changes daily, to count unique visitors per day. The IP address is not stored.
• Hashes from previous days are deleted once they are rolled up into a daily total; only the daily visitor count remains.

5. "Who's here right now" (the live visitor map)

This section shows, anonymously, how many people have JaoPor open.

• Anonymous identity: your browser generates a random ID stored on your device (localStorage), a made-up name from a fixed word list we control (e.g. "Blue Elephant") and a cartoon avatar drawn from that ID. It is not linked to your account.
• Approximate location: our host (Vercel) estimates location from your IP address. We use only the country, the nearest province (in Thailand), and coordinates rounded to about 11 km plus a small random offset. Your IP address is not stored and is never shared with other visitors.
• What other visitors see while you're online: your made-up name and avatar, the type of page you're on (e.g. "a project page"), device type (mobile/desktop), country or province, and the approximate point on the world map.
• Connection: only while a JaoPor tab is visible on your screen; it disconnects when you switch tabs. This runs on Supabase Realtime and is not stored permanently; it disappears when you leave.
• Backup heartbeat: while a page is open, your browser sends a signal about once a minute so the count works even if the live connection fails. We store: a hash of your anonymous ID (daily-changing key), the page path, country/province, device type and last-seen time. Entries older than 10 minutes are deleted automatically.
• Opting out: press "Don't show me" under the map (or the button below); this browser then stops sending both (you can still watch). Press × to hide the section from the home page.
• World map: when you press "World", your browser loads map images directly from OpenFreeMap, which, like any website you load, sees your IP address.

6. What's stored in your browser

We don't use advertising cookies or cross-site tracking cookies for ads. We use Google Analytics cookies (named _ga) to see aggregate traffic; JaoPor's own visitor counter and our host's Web Analytics (Vercel) run cookie-free. Stored on your device: the sign-in cookie (signed-in users only), theme, currency, the province you picked in the Olympics, the live map's anonymous ID, your hide/opt-out choices, and Google Analytics cookies. You can clear them in your browser settings.

7. Messages (chat)

• A chat opens only when a contact request is accepted. Only you and the other person can read it.
• Messages are stored in JaoPor's database (Supabase) and are not end-to-end encrypted. The JaoPor team reads a message only when it is reported, to check for abuse.
• You can block at any time: the chat closes, no new messages can be sent, and your LINE / email stop being shared.
• Up to 200 messages a day.

8. Services we use

Vercel (hosting; also cookie-free Web Analytics), Supabase (database, sign-in, realtime), Google and GitHub (sign-in), Google Analytics (traffic statistics, loaded on page view), OpenFreeMap (world map images, only when you open it), Google Gemini (when a project owner presses "Fill from website", public text from that project's website is sent for a summary), Frankfurter (exchange rates, server-side, no user data).

9. Deleting your data

• Delete a project yourself from the dashboard.
• To delete your account, contact jaopordev@gmail.com. Deleting an account removes your profile, skills, experience, follows, contact requests and project memberships, plus your posts, images, comments (shown as 'comment deleted' where others replied) and the messages you sent. (A self-service delete button is being built.)

10. Changes

When we change how we collect or use data, we update this page and the date above.