jumper.to

Legal

Privacy policy

Last updated

Draft for review. This text has not been checked by a lawyer yet and may change before launch.

Short version: Jumper links set no cookies and never store a visitor’s IP address or browser string. We keep what we need to run your links and nothing more, in the EU, and we never sell data or show ads.

Who is responsible

The controller under the GDPR is Rania Abdo, Berlin, Germany (Impressum). Write to hello@jumper.to about anything on this page.

People who tap or scan a Jumper link

  • No cookies and no other storage on your device: Jumper link addresses never set a cookie.
  • To send you to the right store we read your browser’s user-agent string and the country Cloudflare derives from your connection. We do not store your IP address or the full user-agent string. We record an anonymous count of the tap: day, device type (for example “iPhone”), country, the referring site’s host name, campaign tags in the link (utm_source and similar) and which store you were sent to.
  • Where we count unique visitors, we use a hash of your IP address and user agent with a random salt that changes every day; the salt is deleted after the day, so the hash cannot be linked to you or across days.
  • Legal basis: our legitimate interest (Art. 6(1)(f) GDPR) in delivering the link and giving its owner aggregate statistics.

Customers (people with a Jumper account)

  • Account: your email address, language, sign-in codes (stored hashed, valid for 10 minutes) and sessions (a hashed token, the browser family and dates). The session cookie lives only on the dashboard’s address, never on link addresses.
  • Links and pages: the destinations, names, QR styles, logos and hosted pages you create, and public app store details we fetch for them.
  • Email: sign-in codes, renewal reminders and notices about your links. No tracking pixels.
  • Screening: the result of each safety check of your links (below), kept as evidence of what was checked and decided.
  • Legal basis: performing our contract with you (Art. 6(1)(b) GDPR); screening and abuse handling rely on our legitimate interest in keeping the service safe (Art. 6(1)(f)).

Safety screening

When you save a link with a website address, we send that address to Google Web Risk to check it against lists of phishing and malware sites, and again every week. We also send the link’s name and address, the app names, the title, description and first 2 KB of text of the destination page, or the text of your hosted page, to TypeSafe AI’s classifier, which returns a category and a probability. Classifier results are recorded with the model version. A person reviews any decision you appeal.

People who report a link

The report form stores the reported link, the category, your description and, if you give it, your email address (only to confirm your report; never passed to the link’s owner). To count independent reports and to limit abuse of the form we keep a keyed hash of your IP address, never the address itself. We delete your email address and that hash after 180 days.

Who processes data for us

Cloudflare (hosting, database and storage, EU jurisdiction), Resend (email, EU region), Google (Web Risk) and TypeSafe AI (classifier). Stripe will be added when payments start. The full list with locations is on Subprocessors. Where a processor is outside the EU, transfers are covered by the EU Standard Contractual Clauses or an adequacy decision.

How long we keep it

  • Account data: until you delete your account; deleted accounts are purged after 30 days.
  • Links and hosted pages: while the link runs, and up to 12 months after it expires (so you can renew it).
  • Statistics: daily counts are kept 30 days on free links and 2 years on paid and launch links; they contain no personal data.
  • Sign-in codes: 10 minutes. Sessions: 30 days after last use.
  • Screening results, reports and the moderation log: as long as needed to handle the case and defend against claims, then deleted; reporter emails and IP hashes after 180 days.
  • Server logs at Cloudflare: a few days.

Your rights

You can ask for access to your data, correction, deletion, restriction, a copy in a portable format (Settings → Export gives you a JSON file of your links, pages and settings) and you can object to processing based on legitimate interest. Write to hello@jumper.to. You can also complain to a data protection authority; ours is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information), Alt-Moabit 59–61, 10555 Berlin.

Our own website

Jumper’s pages use no analytics and no advertising. Fonts are served from our own servers. The only third-party script is Cloudflare Turnstile on the sign-in and report forms, which keeps bots out. The dashboard sets one cookie, for your session, and only after you sign in.