Privacy

What is stored

• Your account: the email address you sign in with.
• Your sessions: a hash of each session token, never the token itself.
• Your workspaces and projects, who belongs to each, and with which role.
• Your records: each one's title, description, status, owner, due date and priority, the group it sits in, and the dependencies between records.
• Comments on your records: their plain text, who wrote each one and when.
• AI proposals: the exact change set a draft proposed, kept with an expiry.
• Invitations: a hash of the one-time link, and the address it was sent to.
• Who has a project open right now. It counts only inside a short window, and only the project's current members can read it.
• Rate limits: counts kept under a one-way digest, with no text you typed.

A plan drafted without signing in is not stored at all: no project, proposal, account or prompt. Your browser holds it until you sign in.

Where it is stored

Jextaa runs on Cloudflare Workers.

Your data is kept in a PostgreSQL database hosted by Neon, which the app reaches through Cloudflare Hyperdrive with query caching turned off.

Traffic is encrypted in transit, and data is encrypted at rest.

What the AI model sees

Drafting a plan sends your description to an AI model through OpenRouter. Asking for changes, or asking it to summarize the project or what is blocking it, sends that same model the same summary of the project.

The company that processes the request is whichever provider OpenRouter routes it to, under the provider and data-collection settings of Jextaa's OpenRouter account.

A project summary may be sent only while that account excludes providers that train on or retain prompts. That is an account setting; the code does not enforce it.

How long a provider keeps a request, and in which region it processes it, are not yet stated, so this page makes no promise about training, sharing or storage there.

Jextaa and the AI provider see the plain text of what they process. The model only proposes: nothing changes until a person reviews the proposal and applies it.

No training, prompt cache or shared vector corpus is used across customers, and there are no human analytics on project contents. AI can be turned off for each workspace.

What is never logged

Request bodies and tokens are kept out of logs and telemetry, and there is no session replay. AI usage is recorded as metadata, never with the prompt.

Deleting

You can delete your account in Account settings; it is refused while others depend on you as their only administrator. Any project you can open can be exported as JSON or CSV from its page.

Deleting your account deletes every project only you administer, removing everything stored under each one in the same step. The account row itself is kept afterward, with its identifying details cleared, because other data still refers to it — including activity you left in a project you did not own.

Backups may keep deleted content until they expire, and that retention period is not yet set. Email that has been sent cannot be recalled.