Privacy Policy

1. Scope

This policy covers the JaMeet desktop application, joining a JaMeet session from a web browser at account.ja-meet.com/app/, the JaMeet service both of them connect to, and the ja-meet.com website. The service is operated by JaMeet, the company responsible for it and for your information, which can be contacted at privacy@ja-meet.com. “JaMeet”, “we” and “us” refer to that company as the operator of the service. JaMeet is in beta; this policy describes how the beta behaves today and will be updated as the product changes.

It does not cover the software you use alongside JaMeet: your DAW, plug-ins, virtual audio devices, or anything your collaborator runs on their own computer.

2. Information we collect

Account information

An account is required to use JaMeet, including to join a session, whether from the desktop app or from a web browser. The website, the desktop app and the browser use the same account. When you create one we store a username, an email address, a display name, an avatar colour, and your password as a salted scrypt hash, never the password itself. You may optionally add a profile picture, phone number, location, role, main DAW, genres, a short bio, a website and a social handle. Everything optional stays empty until you fill it in.

We also keep account activity used to run the service: when the account was created, when you last signed in and were last active, how many sessions you have hosted, and the app version and platform your app last identified itself with. If you created the account on this website after arriving through one of our links that carries a short tag naming where the link was posted (for example ?ref=reddit), we keep that tag with the account so we can see which places people find JaMeet from.

Signing in with Google

You can create an account or sign in with Google instead of a password, in the app or on this website. If you choose to, Google tells us your email address, whether Google has verified it, your name and an identifier for your Google account. We store that identifier with your account so that Google sign-in keeps working. We use your name as your display name only when Google sign-in creates a new account, and you can change it afterwards. If a JaMeet account already uses the same verified email address, the Google account is connected to it. We never receive your Google password and we do not store your Google profile picture. Google handles the sign-in itself under its own privacy policy.

Joining from a web browser (Browser Guest)

You can join a session someone else hosts from a web browser at account.ja-meet.com/app/, without installing the app. You sign in with your JaMeet account there too. The browser keeps your sign-in and a participant identifier for that tab in session storage, and both are gone when the tab is closed. The same session records, network information and WebRTC processing described in this policy apply to a browser call.

Projects and the work inside them

When you use projects, the service stores what you put in them so every collaborator sees the same thing and it is still there next time:

• Project name and description, and who owns it
• Songs, lyrics documents, project notes, tempo and key, and song structure
• Production tasks and their status and assignment
• Collaborators on the project, identified by their display name and username
• An activity history of changes made to the project, and when
• Project chat messages, meaning sender, text and time, kept as a bounded recent history and deleted with the project
• Files attached in project chat, such as pictures, audio, PDFs and voice notes, with their name, type, size and who sent them. Each file can be up to 8 MB, and a project holds a limited total amount
• Link previews in project chat: the link, title, short description, site name and picture of a page linked in a message, stored with that message
• A project cover image, if one is set: a small square picture stored with the project
• Song version history: the last few earlier versions of each song’s lyrics, notes and structure, with when each was saved and the display name of the person who made it, so a change can be taken back

A link preview is fetched by the sender’s JaMeet app, not by our servers, when a message with a link is about to be sent. The website behind the link therefore sees the sender’s IP address, as it would if they opened the link. What the app finds is sent with the message and stored with it, and everyone in the project can see it.

Session records

For signed-in users the service keeps a history of sessions you hosted or joined: the session code, start and end time, duration, whether you hosted, a collaborator’s display name and username, the project the session was attached to, a factual summary of the workspace changes made during the session, and how many chat messages were sent. The text of session chat messages is relayed between the apps and is not stored on our servers; project chat is separate and is stored, as listed above.

If you schedule a session, we store its title and the time you chose.

Device and connection information

Requests from the app identify its version and platform (for example macOS, Windows or a web browser), and the most recent values are kept on your account so we can tell which build a problem came from. Our servers also produce operational logs of requests, which include IP address, request path, timestamps and error information.

Diagnostic reports

If the JaMeet desktop app crashes, it can send a diagnostic report. This is on by default and you can turn it off in Settings › General. A report contains the time, which part of the app failed, the app, Electron and Node versions, your platform, processor architecture and operating-system release, an installation and session identifier, the session code if one was active, an error message and stack trace, and a small amount of technical context.

Reports are filtered before they leave your computer and again when they arrive: passwords, tokens, email addresses, lyrics and notes, IP addresses, ICE candidates and SDP, and your operating-system username inside file paths are replaced with a redaction marker. Filtering is pattern-based, so we cannot promise it catches everything; do not paste sensitive material into anything you send us.

Feedback you send us

The in-app “Report an Issue” and “Send Feedback” actions open a message you write yourself, pre-filled with your app version, platform and processor architecture. Nothing is sent until you send it. If you email us instead, we receive whatever you choose to include.

3. What JaMeet does not do

• JaMeet has no call recording. Your microphone, instrument, camera and screen share are not recorded or stored by us, and there is no session export.
• The short microphone test in Studio Sound Check is held in memory on your computer for local playback only. It is not uploaded and not written to a file.
• We do not store the text of session chat messages on our servers.
• The app and the browser client contain no advertising software, no analytics or product-tracking SDK, and no cross-site tracking. This website uses Google Analytics to count visits (section 6).
• We do not sell personal information, and we do not use your projects, lyrics, notes or media to train machine-learning models.

4. How we use information

We use the information above to:

• Create and authenticate your account and keep you signed in
• Set up sessions between the people you invite and reconnect them when a network drops
• Store and synchronise your projects so every collaborator sees the same work
• Show you your session history and scheduled sessions
• Keep the service working and secure: rate limiting, abuse prevention, error investigation and capacity planning
• Diagnose crashes and act on the feedback you send us
• Send the emails your account needs: confirming your email address, resetting your password, and beta access and account notices
• Tell you about changes to the service, including security and account matters
• Send you news and release updates by email, only if you subscribe to the mailing list

We do not use your information for advertising or for automated decisions that produce legal effects.

5. Calls, media and WebRTC

Calls use WebRTC. The JaMeet service handles signalling, which is the messages that let the apps in a session find each other and agree how to connect. It does not carry your audio, video or screen share.

During connection setup both apps contact STUN servers to discover how they are reachable from the internet. Today those include public STUN servers operated by Google and Cloudflare. A STUN server sees the network addresses of the device that contacts it; it does not see session content.

Where a direct connection is possible, media travels straight between the participants’ computers. Where a network blocks that, media is relayed through a TURN server so the call can still connect. Media is encrypted in transit between the apps using WebRTC’s DTLS-SRTP; a relay forwards that traffic without storing it. We do not record or retain relayed media.

A call reveals your network address to the other people in the session, and to the relay if one is used. That is inherent to WebRTC and is not something JaMeet can remove.

6. This website

ja-meet.com serves website pages and connects its account forms to the existing JaMeet service over HTTPS. It uses Google Analytics 4 to count visits, which pages are read, which link (for example a ?ref= tag) brought you, and whether you pressed a download or sign-up button or created an account. In the European Economic Area, the United Kingdom and Switzerland it sets no cookies and stores nothing on your device until you press Accept in the banner; Google may still receive a request without cookies, with ordinary information such as your IP address and browser details. Elsewhere, Google Analytics sets cookies that recognise your browser between visits unless you press Decline. Press Decline, or Cookie settings in the footer, to turn them off at any time; your choice is kept in local storage in your browser. We do not use Google Analytics for advertising, and turn off Google signals and ad personalisation. Signing in stores an authentication token in browser session storage for the current tab; signing out removes it and revokes that session on the server. If you arrive through one of our links with a ?ref= tag, that tag is kept in session storage for the current tab and sent with an account you create there; it is gone when the tab closes. Passwords are sent to the JaMeet service for authentication and are not saved in browser storage. Fonts and images are served from the website. Because it is delivered over the internet, our hosting and network providers process ordinary request information such as your IP address and the page you asked for.

Signed in, your account page reads your profile, the devices you are signed in on and, when you ask for them, your data export or the deletion of your account. Each of those is a request to the JaMeet service carrying your own sign-in token; the website stores none of the answers.

If you choose Continue with Google here, your browser goes to the JaMeet service, then to Google, and back to this website to finish signing in. For that sign-in the JaMeet service sets one strictly necessary cookie on its own address, which ties Google’s answer to the browser that started it and expires within ten minutes. This website keeps a one-time sign-in value in session storage for the current tab until the sign-in finishes or the tab is closed.

Installer downloads are served from a separate release host. Requesting one is a normal HTTP request to that host.

The mailing list on the home page is optional. If you subscribe, the email address you enter is sent from your browser directly to MailerLite, our email provider for the list. MailerLite records it with the time and IP address of the sign-up and asks you to confirm by email; nothing else is sent until you do. Our emails are about new releases and news about JaMeet, and every one has an unsubscribe link.

Some pages show our own videos from YouTube. Until you press play, the page shows a picture served from this website and sends nothing to YouTube. When you press play, your browser loads the video from YouTube’s privacy-enhanced player at youtube-nocookie.com. From then on YouTube, a Google service, receives ordinary request information such as your IP address and browser details, and may store information on your device, under its own privacy policy. If you open a video on YouTube itself, the same applies there.

7. Where information is processed

The JaMeet service runs on Render infrastructure in the United States, and account, project, session-history and diagnostic data is stored there. Backups of that data are stored in Cloudflare R2 object storage and are removed automatically on a rolling schedule.

If you use JaMeet from outside the United States, your information is transferred to and processed there. Data-protection law in the United States may differ from the law where you live.

8. Service providers

We use a small number of providers to run JaMeet. They process information on our instructions and for no purpose of their own:

• Render: hosting for the JaMeet service and this website, and storage for the service’s data
• Cloudflare: DNS and content delivery for the website; TURN relay for calls that cannot connect directly; R2 object storage for backups and for the files you download
• Public STUN providers: Google and Cloudflare STUN servers contacted during call setup
• Google sign-in: only if you choose Continue with Google. Google runs that sign-in as an independent service under its own privacy policy
• YouTube: plays our videos on this website, only once you press play. YouTube is run by Google as an independent service under its own privacy policy
• Our email provider: messages you send to our support and privacy addresses
• MailerSend: sends the emails the JaMeet service sends you, such as email confirmation, password resets and beta access notices. It receives your email address, your display name and the message itself, and keeps delivery records
• Slack: receives our internal operational alerts when something on the JaMeet service fails. An alert can contain technical error details, which are filtered for secrets and personal data before they are sent
• MailerLite: the optional mailing list, including your email address, when and from which IP address you subscribed and confirmed, and whether you open or click the emails we send

9. Security

Measures we actually apply: traffic to the service uses HTTPS; passwords are stored as salted scrypt hashes; sign-in tokens are stored hashed and expire; the app keeps your saved sign-in encrypted with your operating system’s keychain (macOS) or DPAPI (Windows) and refuses to save it when that encryption is unavailable; the API applies rate limits, request-size limits and origin restrictions; and logs and diagnostic reports are filtered for secrets and personal data before they are written.

No service can promise perfect security, and we do not. JaMeet is beta software; please do not use it for material you cannot afford to have exposed or lost. If you believe you have found a vulnerability, report it privately. The Support page says how.

10. How long we keep information

• Account and profile information is kept while your account exists.
• Projects and their contents are kept until you delete them, or until the account is deleted.
• Project chat is capped: only a bounded recent history is kept per project, and older messages are dropped as new ones arrive.
• Session history is capped: the service keeps up to the 50 most recent sessions per account and drops older entries.
• Live session state, including the session code, exists only while the session is running and is discarded when it ends or expires.
• Sign-in tokens expire 30 days after they are issued.
• Diagnostic reports are held in a fixed-size store; older reports are removed as new ones arrive.
• Backups are deleted automatically on a rolling schedule; under the standard retention schedule each backup is kept for 30 days. Backups hold account, project, project chat, cover image and song version data. Files attached in project chat, including link-preview pictures, are not included in backups.
• Files attached in project chat are kept until the message that holds them is deleted or drops out of the bounded chat history, or until the project is deleted. A file uploaded but never sent is removed after about an hour.
• Song version history keeps only the last few versions of each song; older versions are dropped as new ones are saved.
• Operational server logs are kept for a limited period set by our hosting provider and then rotated out.
• Mailing-list subscriptions are kept until you unsubscribe. An unconfirmed sign-up receives no emails.

Deleting a project removes it from the live service. Copies inside existing backups disappear as those backups age out.

11. Your choices and rights

You can do the following yourself, in the app, and the first four of them on your account page on this website too:

• View and change your profile details, and change your password
• Download a copy of your data from Settings › Account › Your data
• Delete your account from Settings › Account › Your data
• See the devices you are signed in on, and sign out of the others
• Choose who may invite you, in Settings › Account › Invitations
• Turn diagnostic reports off in Settings › General
• Delete individual projects and scheduled sessions
• Unsubscribe from the mailing list with the link in any email we send

Download your data gives you one file containing your profile, account activity, signed-in devices, session history, scheduled sessions, the projects you are in, the chat messages you sent and your project invitations. Files you uploaded are listed by name rather than included. It contains no passwords or access tokens.

Depending on where you live, you may also have rights to ask for a copy of the personal information we hold about you, to have it corrected, to have it deleted, or to object to or restrict how we use it. To make a request, email privacy@ja-meet.com from the address on your account and tell us what you would like. We will ask for enough information to be sure the request is really yours, and we will not treat you differently for making one.

12. Deleting your account and data

You can delete your account yourself, on your account page on this website, or in JaMeet 0.4.0 or later from Settings › Account › Your data › Delete Account. You confirm by typing your username, and your password if the account has one. If you still own a project that other people are in, JaMeet asks you to hand that project over or delete it before it will proceed. You can also email privacy@ja-meet.com from the address on your account with the subject “Delete my account” and your username, and we will do it for you and confirm when it is done.

Deletion removes your account record and profile details, the projects only you were in, with their chat, files, cover image, song versions and invite links, your place in other people’s projects, invitations waiting for you, your scheduled sessions and session history, and your access tokens, so every device is signed out. Your username is retired rather than released. Copies held in existing backups are removed as those backups age out on their normal schedule. We may keep the minimum needed to meet a legal obligation or to resolve a dispute, and we will tell you if that applies.

Content you contributed to a project owned by someone else remains in that project, including chat messages and files you sent, under the name you sent them with. Ask the project owner to remove it.

Other people’s session history is theirs: where it records that they played with you, your display name and username stay in their history after your account is deleted.

Deleting your account does not unsubscribe you from the mailing list, which is kept separately by MailerLite. Use the unsubscribe link in any email we send, before or after deleting your account.

13. Children

JaMeet is for people aged 16 and over, and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe someone under 16 has given us personal information, email privacy@ja-meet.com and we will delete it.

14. Changes to this policy

We will update this policy as JaMeet changes. The effective and last-updated dates at the top of this page always reflect the current version. If a change materially affects how we handle your information, we will give notice in the app or by email before it takes effect.

15. Contact

Privacy questions, requests and deletion requests: privacy@ja-meet.com. Anything else: support@ja-meet.com.