Privacy
Privacy
What jeex.org and the other JEEX services store about you, why, for how long, and how to get a copy of it or have it deleted.
Who is responsible
The JEEX services are operated by JEEX. JEEX decides what personal data the services store and is responsible for it.
For any question about your data, or to use any of the rights below, write to info@jeex.org. A message you send there is kept in our own mailbox, on our own server.
What this page covers
This page covers the JEEX websites and services under jeex.org:
jeex.org, this website;player.jeex.org, the site of the open-source tour player;profile.jeex.org, the account service you sign in with;studio.jeex.organdp.jeex.org, the studio and the address its published tours are served from;store.jeex.org, the asset catalogue.
A website that embeds the JEEX player is run by its own owner, and that owner's privacy notice applies to it. What the player itself sends is described below.
This website
jeex.org is a static page. It sets no cookies, uses no analytics or tracking, and loads nothing from other companies: no fonts, scripts or images from anywhere else. Its only scripts are a few lines of its own that run the menu and the page's animations in your browser; they send nothing anywhere.
Like every web server, the server behind it writes an access log, described next.
Server logs
When your browser asks a JEEX website for a page or a file, the web server records the request in an access log: your IP address, the time, the address requested, the result, the size of the answer, and the headers your browser sends, such as its user-agent string and the page you came from. Cookie and authorisation headers are not written to the log.
We use these logs only to keep the services running and secure: to find errors, and to detect and stop abuse. They are not used to build profiles and are not shared with anyone. They are kept for up to 90 days and then deleted.
The address that receives the player's telemetry, telemetry.jeex.org, keeps no access log.
Accounts
One account at profile.jeex.org signs you in to every JEEX service. Creating and using it stores:
- Profile: your name, your email address and whether it is confirmed, your interface language, and a profile picture if you upload one.
- Sign-in methods: your password, stored only as a one-way hash so that nobody can read it back, and the public part of any passkey you add.
- Workspaces: the organisations you create or join, your role in them, and the invitations you send or receive.
- Connected services: which JEEX services and other applications you allowed to sign you in.
- Sessions: each signed-in device, with its IP address and browser's user-agent string. A session ends when you sign out or after 30 days without use.
- Security events: a record of events that matter for the account's security, such as sign-ups, sign-ins and sign-outs, email confirmations, sign-ins to connected applications, password changes and resets, data exports, account deletions and blocked automated sign-up attempts, most of them with the IP address and user-agent string of the request, so that misuse of an account can be noticed and investigated.
We store this to provide the account you asked for and to keep it secure. See why we may use this data.
The account data is kept for as long as the account exists. When you delete the account, your profile, sign-in methods, sessions, personal workspace, profile picture and data exports are deleted. The security events are kept for up to 12 months; they are no longer linked to the account, but they keep a one-way hash of your email address, so they can still be matched to that address.
Studio and catalogue
The studio (studio.jeex.org) and the catalogue (store.jeex.org) sign you in through your account and keep their own short session for up to 12 hours. They store what you create and upload there, such as projects, floor plans, photos and tours, so that you can work on them and publish them. A tour you publish is served from p.jeex.org to anyone who has its address.
Some studio features use AI models: for example, recognising the rooms of a floor plan you upload, or editing a scene from a request you type. For these features, the file or the text you send is passed to an AI model provider (see who else handles the data).
Your projects and uploads are kept until you delete them or ask us to. Deleting your account removes the account, not your studio projects or published tours: to have those removed, write to info@jeex.org.
The player
The JEEX player, on player.jeex.org and on any website that embeds it, can send a small amount of anonymous data about how it runs: which version is used, how fast it loads, which tour was opened (the tour's own id, the same for every visitor), roughly how long it was used (one of six coarse ranges, such as two to five minutes), which of its features are used, and which errors happen. It sets no cookies, uses no browser storage and sends no identifier of you or of your visit. The site owner can turn it off, and a browser that sends Global Privacy Control is never counted.
Every field it can send is listed on the player's telemetry page. At present the address that receives this data answers without storing it and keeps no access log.
Cookies and browser storage
The JEEX services use only the cookies they need to work and to remember your display choices. There are no advertising, analytics or third-party cookies, so there is nothing to consent to and no cookie banner.
| Name | Set by | Purpose | Lasts |
|---|---|---|---|
jeex_theme, jeex_locale | account, studio and catalogue, for all of jeex.org | Remember your light or dark theme and your interface language across the JEEX services. | 1 year |
profile.session_token | profile.jeex.org | Keeps you signed in to your account. | 30 days after last use |
__Host-studio_session, __Host-store_session | studio.jeex.org, store.jeex.org | Keeps you signed in to the studio or the catalogue. | 12 hours |
__Host-studio_login, __Host-studio_login_origin, __Host-store_login | studio.jeex.org, store.jeex.org | Carry one sign-in from the service to your account and back. | 10 minutes |
On https the account cookie's name starts with __Secure-, and the names of the studio and catalogue cookies start with __Host-, as in the table. The account service may also set short-lived cookies of its own while a sign-in is in progress.
The same services keep a local copy of your theme and language in your browser's storage (jeex-theme, jeex-locale), and the studio keeps there an access key you enter (jeex.studio.key). jeex.org itself sets and reads none of these.
You can delete cookies and site data in your browser at any time. You will then be signed out and the services will return to their default theme and language.
Why we may use this data
- To provide what you asked for: the account, the studio and the catalogue store and use your data because it is needed to perform the service you signed up for.
- Our legitimate interest in keeping the services secure and working, and in understanding how tours are used in aggregate: the server logs and the security events, and the player's anonymous telemetry.
Nothing is based on your consent today: there are no marketing or analytics cookies.
Who else handles the data
We do not sell personal data and do not share it for advertising. A few providers handle it on our behalf, only to run the services:
- Hosting: all JEEX services, their data and our mailbox run on one server we rent from Hetzner Online in Nuremberg, Germany.
- AI model providers, for the studio features described above:
- Z.ai, for editing a project from a request you type;
- OpenRouter, only when Z.ai is busy or unavailable, and the host of the model that OpenRouter passes the request on to;
- Anthropic, for recognising a floor plan you upload: the plan image and the text needed to read it.
The server that hosts the JEEX services is in Germany. The floor plans and text you send to the studio's AI features are sent for processing to the AI model providers named above, some of which are outside the European Union.
We may also disclose data when the law requires it.
Your rights
Depending on where you live, you have the right to:
- get a copy of the personal data we hold about you;
- have wrong data corrected;
- have your data deleted;
- object to, or ask us to restrict, a use of your data;
- receive the data you gave us in a machine-readable form.
You can do some of this yourself at profile.jeex.org: change your profile and download an export of your account data. Deleting the account there needs a confirmation email, and the account service cannot send email yet; until it can, write to info@jeex.org to have your account deleted. For anything else, or if a self-service step does not work for you, write to info@jeex.org. We may ask you to confirm that the account is yours, and we answer within one month.
You can also complain to the data protection authority of the country where you live or work.
Changes to this page
When what the JEEX services store changes, this page changes with it. The date at the top shows the current version.