Privacy Policy
Last updated: October 2026 · Effective: 24 October 2026
This policy explains how Javer Studios handles personal information under Japan's Act on the Protection of Personal Information (APPI). It covers every service listed in our Terms of Service. It is published in Japanese and English; if the two differ, the Japanese version applies.
1. Who is responsible
Javer Studios, run by Rehan Mohammad Sayeed, an individual business owner in Japan. We give our address without delay on request; email [email protected].
2. What we collect
| Information | Why |
|---|---|
| Email address, and the name or username you choose | Your account, sign-in, and messages about your account |
| Password (stored only as a hash) and two-factor authentication secret | Sign-in security |
| IP address and time of sign-in attempts | Detecting abuse, and locking an account after repeated failed attempts |
| Your public profile, friends, and messages you send in Javer ID | Showing your profile to others as you choose, and delivering your messages to the people you send them to |
| Google account ID and email, or a GitHub access token, if you link them | Signing in with Google; listing and deploying your GitHub repositories |
| Stripe customer and subscription IDs, plan and payment status | Billing. We never receive your card number. |
| What you host: code, files, environment variables, databases, virtual machine disks, game worlds, DNS records, and the mail in your mailboxes | This is the service we provide to you |
| Traffic statistics for your sites: visitor counts, country, device type, pages, and bots and AI crawlers | Your traffic charts. We keep hourly totals for each site, taken from Cloudflare's aggregate data. Nothing we keep identifies a visitor, and we add no script or cookie to your visitors' browsers. |
| API key activity (which key did what, and when) | Security and your activity log |
| Messages you send through the support and contact forms | Answering you |
| Free virtual machines: numbers about their network use (tries on mail ports, how many different addresses they connect to in a minute, DNS request counts, data sent and received, time at the speed limit) and a short note of any warning, how many virtual machines you create and delete per day, and a record that your email address was confirmed with a code when you asked for a free virtual machine. For all virtual machines: a monthly total of data sent and received. | Catching spam, scanning and attacks, preventing abuse of free virtual machines, and slowing a virtual machine that goes past its monthly allowance. We never read the content, and we do not record which addresses you connect to or what you look up. Only an administrator can see these numbers. |
| When you create or try to create a free virtual machine (nothing is recorded at sign-up): a one-way hash of the network part of your IP address (not the address itself), a one-way hash of your email address with dots and anything after a "+" removed, and flags for a person to review. | Stopping one person taking several of the limited free virtual machines with several accounts. We do not use browser or device fingerprints or ID cookies for this. |
The AI support assistant receives your question and, inside a panel, a read-only summary of your account so it can answer. Conversations with it are not stored unless you pass them to a person.
3. How we use it
- To provide, run and secure the services, including sign-in and two-factor authentication.
- For billing and receipts.
- To answer support requests.
- To prevent abuse, investigate security incidents and meet legal obligations.
- To tell you about your account, your bills and changes to our services.
- To improve the services, using statistics that do not identify anyone.
We do not sell personal information, build advertising profiles, or use your code or content to train AI.
4. Who we share it with
| Provider | What they do and receive | Where |
|---|---|---|
| Stripe | Card payments. Your card details go directly to Stripe. | United States |
| Resend | Sends our emails (verification, sign-in codes, notices). Receives your email address and the message. | United States |
| Cloudflare | Network, DDoS protection, the tunnel to our servers, support-form storage, the AI support assistant, and traffic statistics | United States (global network) |
| name.com | Registers the domains you buy. Receives the domain name only; domains are registered with Javer's details. | United States |
| Google, GitHub | Only if you link them. They send us your account ID and email (Google) or an access token (GitHub); we use GitHub's API with that token to list and deploy your repositories. If you connect a site to Google Search Console, we read that site's search data from Google. | United States |
| Akamai (Linode), Oracle Cloud | Servers in Tokyo that we rent and run ourselves: mailboxes, traffic relays and encrypted offsite backups. The providers do not handle the data on them. | Japan (Tokyo) |
Transfers outside Japan. Stripe, Resend and Cloudflare receive personal information from us and are in the United States. The United States has no single national privacy law like APPI; protection comes from state laws such as California's and from laws for specific sectors. Each of these providers has agreed data protection terms with us that require protection of personal information equivalent to APPI. On request, we tell you more about these measures.
We also disclose personal information when the law requires it, for example for a court order, and otherwise only with your consent.
5. How we protect it
- Organisation: one person runs Javer and is the only person with access to personal information.
- Technical: HTTPS everywhere; passwords stored only as hashes; two-factor authentication; each customer's apps, databases and virtual machines isolated from each other's; server access limited; backups encrypted.
- Physical: our own servers are in Tokyo in places under our control; rented servers are in the providers' data centres in Tokyo.
- Outside Japan: see section 4 for the countries involved and the protection in place.
6. How long we keep it
- Account data: while your account is open. 30 days after you delete an account, we permanently delete your personal information from our live systems.
- Billing records (account number, plan, payment IDs, dates and your acceptance of the terms): 7 years, as Japanese tax law requires.
- Backups: they expire on a rolling schedule, so deleted data disappears from them within 13 months.
- API key activity: 90 days.
- Removed mailboxes: 30 days, then deleted.
- Free virtual machine network numbers: 3 days.
- Monthly data totals of your virtual machines: while your account exists, and 30 days after you delete it.
- For free virtual machines only: records of warnings and actions taken, how many virtual machines you create and delete per day, the record that your email address was confirmed, and the network and email hashes and review flags: while your account exists, and 30 days after you delete it.
- Support messages: until you ask us to delete them.
7. Your rights
You can ask us to tell you what personal information we hold about you, and to correct, add to or delete it, stop using it, stop sharing it with third parties, or show you our records of sharing it. Email [email protected] from the address on your account. We may ask you to confirm who you are. There is no fee, and we reply without delay. Send complaints about how we handle your information to the same address.
8. Cookies and other technology
- Our panels use cookies only to keep you signed in (a session token and a CSRF protection token).
- Cloudflare runs a bot check on our sites and may set a security cookie, to block attacks.
- Stripe loads on billing pages and may set cookies to prevent fraud.
- Cloudflare Turnstile checks that the support form is used by a person.
We use no analytics or advertising trackers. javerstudios.com contains a Google AdSense ownership tag only; it loads no ad script.
9. Children
If you are under 18, a parent or guardian must agree to our terms for you (Terms, section 2).
10. Changes
We post changes to this policy here with the date. For significant changes, we also email you.