1. Scope
This policy covers the JaMeet desktop application, the JaMeet service the application connects to, and the ja-meet.com website. “JaMeet”, “we” and “us” refer to the operator of that service. JaMeet is in public beta; this policy describes how the beta behaves today and will be updated as the product changes.
It does not cover the software you use alongside JaMeet — your DAW, plug-ins, virtual audio devices, or anything your collaborator runs on their own computer.
2. Information we collect
Account information
You only need an account to keep projects between sessions. When you create one we store a username, an email address, a display name, an avatar colour, and your password as a salted scrypt hash — never the password itself. You may optionally add a profile picture, phone number, location, role, main DAW, genres, a short bio, a website and a social handle. Everything optional stays empty until you fill it in.
We also keep account activity used to run the service: when the account was created, when you last signed in and were last active, how many sessions you have hosted, and the app version and platform your app last identified itself with.
Joining as a guest
If you join a session as a guest, you supply only a display name. A guest identity exists for the session and is not stored as an account afterwards. Your display name can appear in the other participant’s session history, because it records who they played with.
Projects and the work inside them
When you use projects, the service stores what you put in them so both collaborators see the same thing and it is still there next time:
- Project name and description, and who owns it
- Songs, lyrics documents, project notes, tempo and key, and song structure
- Production tasks and their status and assignment
- Collaborators on the project, identified by their display name and username
- An activity history of changes made to the project, and when
Session records
For signed-in users the service keeps a history of sessions you hosted or joined: the session code, start and end time, duration, whether you hosted, the other participant’s display name and username and whether they were a guest, the project the session was attached to, a factual summary of the workspace changes made during the session, and how many chat messages were sent. The text of chat messages is relayed between the two apps and is not stored on our servers.
If you schedule a session, we store its title and the time you chose.
Device and connection information
Requests from the app identify its version and platform (macOS or Windows), and the most recent values are kept on your account so we can tell which build a problem came from. Our servers also produce operational logs of requests, which include IP address, request path, timestamps and error information.
Diagnostic reports
If JaMeet crashes, the app can send a diagnostic report. This is on by default and you can turn it off in Settings › General. A report contains the time, which part of the app failed, the app, Electron and Node versions, your platform, processor architecture and operating-system release, an installation and session identifier, the session code if one was active, an error message and stack trace, and a small amount of technical context.
Reports are filtered before they leave your computer and again when they arrive: passwords, tokens, email addresses, lyrics and notes, IP addresses, ICE candidates and SDP, and your operating-system username inside file paths are replaced with a redaction marker. Filtering is pattern-based, so we cannot promise it catches everything; do not paste sensitive material into anything you send us.
Feedback you send us
The in-app “Report an Issue” and “Send Feedback” actions open a message you write yourself, pre-filled with your app version, platform and processor architecture. Nothing is sent until you send it. If you email us instead, we receive whatever you choose to include.
3. What JaMeet does not do
- JaMeet has no call recording. Your microphone, instrument, camera and screen share are not recorded or stored by us, and there is no session export.
- The short microphone test in Studio Sound Check is held in memory on your computer for local playback only. It is not uploaded and not written to a file.
- We do not store the text of session chat messages on our servers.
- The app and this website contain no advertising software, no analytics or product-tracking SDK, and no cross-site tracking. This website sets no cookies.
- We do not sell personal information, and we do not use your projects, lyrics, notes or media to train machine-learning models.
4. How we use information
We use the information above to:
- Create and authenticate your account and keep you signed in
- Set up sessions between two people and reconnect them when a network drops
- Store and synchronise your projects so both collaborators see the same work
- Show you your session history and scheduled sessions
- Keep the service working and secure — rate limiting, abuse prevention, error investigation and capacity planning
- Diagnose crashes and act on the feedback you send us
- Tell you about changes to the service, including security and account matters
We do not use your information for advertising or for automated decisions that produce legal effects.
5. Calls, media and WebRTC
Calls use WebRTC. The JaMeet service handles signalling — the messages that let two apps find each other and agree how to connect — and does not carry your audio, video or screen share.
During connection setup both apps contact STUN servers to discover how they are reachable from the internet. Today those include public STUN servers operated by Google and Cloudflare. A STUN server sees the network addresses of the device that contacts it; it does not see session content.
Where a direct connection is possible, media travels straight between the two computers. Where a network blocks that, media is relayed through a TURN server so the call can still connect. Media is encrypted in transit between the two apps using WebRTC’s DTLS-SRTP; a relay forwards that traffic without storing it. We do not record or retain relayed media.
A call reveals your network address to the person you are calling, and to the relay if one is used. That is inherent to WebRTC and is not something JaMeet can remove.
6. This website
ja-meet.com is a static site. It sets no cookies, includes no analytics or advertising scripts, and loads no third-party fonts, images or embeds — everything it needs is served from the site itself. Because it is delivered over the internet, our hosting and network providers process ordinary request information such as your IP address and the page you asked for.
Installer downloads are served from a separate release host. Requesting one is a normal HTTP request to that host.
7. Where information is processed
The JaMeet service runs on Render infrastructure in the United States, and account, project, session-history and diagnostic data is stored there. Backups of that data are stored in Cloudflare R2 object storage and are removed automatically on a rolling schedule.
If you use JaMeet from outside the United States, your information is transferred to and processed there. Data-protection law in the United States may differ from the law where you live.
8. Service providers
We use a small number of providers to run JaMeet. They process information on our instructions and for no purpose of their own:
- Render — hosting for the JaMeet service and this website, and storage for the service’s data
- Cloudflare — DNS and content delivery for the website; TURN relay for calls that cannot connect directly; R2 object storage for backups and for the files you download
- Public STUN providers — Google and Cloudflare STUN servers contacted during call setup
- Our email provider — messages you send to our support and privacy addresses
9. Security
Measures we actually apply: traffic to the service uses HTTPS; passwords are stored as salted scrypt hashes; sign-in tokens are stored hashed and expire; the app keeps your saved sign-in encrypted with your operating system’s keychain (macOS) or DPAPI (Windows) and refuses to save it when that encryption is unavailable; the API applies rate limits, request-size limits and origin restrictions; and logs and diagnostic reports are filtered for secrets and personal data before they are written.
No service can promise perfect security, and we do not. JaMeet is beta software; please do not use it for material you cannot afford to have exposed or lost. If you believe you have found a vulnerability, report it privately — see the Support page.
10. How long we keep information
- Account and profile information is kept while your account exists.
- Projects and their contents are kept until you delete them, or until the account is deleted.
- Session history is capped: the service keeps up to the 50 most recent sessions per account and drops older entries.
- Live session state, including the session code, exists only while the session is running and is discarded when it ends or expires.
- Sign-in tokens expire 30 days after they are issued.
- Diagnostic reports are held in a fixed-size store; older reports are removed as new ones arrive.
- Backups are deleted automatically after a limited retention period.
- Operational server logs are kept for a limited period set by our hosting provider and then rotated out.
Deleting a project removes it from the live service. Copies inside existing backups disappear as those backups age out.
11. Your choices and rights
You can do the following yourself, in the app:
- View and change your profile details, and change your password
- Turn diagnostic reports off in Settings › General
- Delete individual projects and scheduled sessions
- Use JaMeet without an account by joining a session as a guest
Depending on where you live, you may also have rights to ask for a copy of the personal information we hold about you, to have it corrected, to have it deleted, or to object to or restrict how we use it. To make a request, email privacy@ja-meet.com from the address on your account and tell us what you would like. We will ask for enough information to be sure the request is really yours, and we will not treat you differently for making one.
12. Deleting your account and data
There is no self-service account deletion in the beta yet. To have your account and the personal information attached to it deleted, email privacy@ja-meet.com from the address on your account with the subject “Delete my account”. Tell us your username so we can find the account.
We will confirm when the deletion is done. Deletion removes your account record, profile details, session history and scheduled sessions, and projects you own. Copies held in existing backups are removed as those backups age out on their normal schedule. We may keep the minimum needed to meet a legal obligation or to resolve a dispute, and we will tell you if that applies.
Content you contributed to a project owned by someone else may remain in that project. Ask the project owner to remove it.
13. Children
JaMeet is intended for adults and is not directed at children. We do not knowingly collect personal information from children. If you believe a child has given us personal information, email privacy@ja-meet.com and we will delete it.
14. Changes to this policy
We will update this policy as JaMeet changes. The effective and last-updated dates at the top of this page always reflect the current version. If a change materially affects how we handle your information, we will give notice in the app or by email before it takes effect.
15. Contact
Privacy questions, requests and deletion requests: privacy@ja-meet.com. Anything else: support@ja-meet.com.