Plain-language policy

Privacy Policy

This policy explains how KJN and the KJN node you use handle information. Node settings can change storage and connection paths, so this page describes the settings of the node serving it. Questions or privacy requests can be sent to hello@kjn.app.

Information we handle

• Account and profile data: username, display name, avatar, salted password hashes, recovery-code hashes, session-token hashes, account tier, and account settings. If you add passkeys, KJN stores their credential identifiers, public keys, counters, and a random account handle; your authenticator keeps the private keys and biometric data. KJN does not store your raw password.
• Saved rooms and room history: If you're signed in, KJN keeps your pinned rooms and a list of rooms you've recently joined, and when (not who was there or what was said), so they follow you across devices. Rooms you pinned on a device before signing in are added to your account. Recent rooms are capped at 50 and drop off after 180 days. Disappearing rooms are never recorded, and guests have no saved rooms or history. You can clear recent rooms or remove any one of them anytime. "Remember rooms I visit," at the bottom of Settings, turns this off and deletes your recent rooms; pins stay until you remove them. For members under 18, it's off unless they turn it on.
• Age bracket: At signup KJN asks your date of birth to derive a coarse age bracket (13–15, 16–17, or adult) for legal compliance and child safety. KJN keeps only that bracket, not your birth date. KJN is for ages 13 and up and does not knowingly create accounts for children under 13. On supported platforms KJN uses the operating system's age-range signal as the primary indicator (California AB 1043); the signup question is the fallback.
• Content you submit: room chat, Wall posts and media, journal entries, suggestions, room details, and direct messages when this node has hub-stored DMs enabled. If you choose Report, this also includes the selected content, optional details, category, room, and packet receipt you send for private operator review.
• Connection and security data: IP address and connection metadata, device or browser details supplied by requests, room membership, SDP/ICE connection setup, cryptographic public keys, signatures, invites, access records, rate-limit events, and operational logs.
• Technical error reports: When a page error or call problem happens (for example, a microphone that stopped or a connection that failed), the app sends KJN an anonymous, content-free report for reliability: a fixed problem type, the error name and a scrubbed short error message, KJN code locations, the app build, and a coarse browser, operating-system, and phone-or-computer category. It contains no messages, names, usernames, room names, email addresses, or tokens and is stored without your account or IP address.
• Problem reports you send: When you use Report a problem, KJN stores the category you pick, what you write, an email address only if you give one, whether you were signed in (not who you are), and, only if you tick "include technical details", the app build, your browser description, screen size, the kind of room you were in (public, private, ephemeral, or none), the page path, and up to ten recent error lines. Room names, invite links, tokens and message text are not kept: links in what you write lose everything after the page path, and anything that looks like an invite or key is replaced with "[removed]". Screenshots are not accepted.
• Human check: To stop automated sign-ups, KJN may ask you to complete a Cloudflare Turnstile check on a separate page (/verify) before you create an account or sign in with a password. Cloudflare, already KJN's network provider, processes technical signals from your browser to tell people from bots; KJN receives only a pass/fail result, never those signals.
• Breached-password warning: When you create an account or change your password, KJN checks whether that password has appeared in known public data breaches, using the Have I Been Pwned "Pwned Passwords" service. KJN's server sends only the first five characters of a one-way hash of the password; your password, its full hash, your account name and your IP address are never sent, so the service cannot tell what was checked or for whom. If the password has appeared in a breach, KJN warns you and suggests choosing another; it does not stop you from using it.
• TAKE IT DOWN requests: If you ask us to remove an intimate image through /take-it-down, we keep your name, email address, the locations you list, and your statement for up to 400 days, to handle the request and to show it was handled. We do not store your IP address with it, and we never ask for the image itself.
• Payment data: When configured, payment providers such as Apple and Paddle handle checkout and payment-card details. KJN can receive account-token, customer, transaction, subscription, product, status, event, and paid-through metadata needed to manage access. An App Store notification UUID is retained only as a domain-separated SHA-256 hash; the raw signed notification payload is not retained.

How we use information

We use information to provide rooms, messages, media connections, Walls, journals, accounts, subscriptions, and support; authenticate users and enforce permissions; prevent abuse; troubleshoot and secure the service; preserve content when you choose a durable feature; and meet legal duties.

When information is shared

• People and agents in a room receive the content and presence information needed for that room. They may copy, record, or reshare what they receive.
• Node operators and administrators may access server-readable content, accounts, logs, and stored files to operate, secure, or support the node.
• Hosting, public STUN, configured TURN, and payment providers such as Apple and Paddle receive the information needed to provide their part of the service when configured. Cloudflare R2 stores encrypted offsite backups; it cannot read them.
• When GIPHY is configured, searching GIFs or viewing a GIPHY attachment connects your browser directly to GIPHY. GIPHY receives the search terms or GIF identifiers and ordinary connection data such as your IP address. KJN does not send your account credentials, room invites, or message text with these requests. The Wall stores GIPHY identifiers, not copies of GIPHY media.
• Information may be disclosed when reasonably necessary to comply with law, protect people, investigate abuse, or defend the service and its rights.

KJN does not sell application data or use it for behavioral advertising.

Global Privacy Control. KJN honors the Global Privacy Control (GPC) signal as a valid request to opt out of the sale or sharing of personal information. Because KJN never sells or shares personal information and runs no advertising or cross-site tracking, a browser that sends GPC gets the same treatment as every other visitor: nothing is sold or shared either way. Our machine-readable statement is at /.well-known/gpc.json.

Cookies and browser storage

KJN uses up to seven first-party cookies, all strictly necessary for authentication, account security, or secure room entry:

• kjn_account carries an account session and uses SameSite=Lax so a normal link to KJN can arrive signed in. Sign-in lasts at most twelve hours; activity does not extend it.
• kjn_passkey_challenge binds a passkey ceremony to this browser for up to five minutes and uses SameSite=Strict.
• kjn_mesh carries HMAC-derived operator access and uses SameSite=Strict. The raw operator secret is never stored in this cookie. Once staff sign in at admin.kjn.app, it is named __Host-kjn_mesh instead: the operator session for that site only (Secure, host-only), lasting at most eight hours and ending at sign-out.
• __Host-kjn_admin_pending holds the five-minute step between a staff member's password and their passkey when signing in at admin.kjn.app (SameSite=Strict, Secure, host-only). It ends when the passkey step finishes or the five minutes run out.
• kjn_join_bind binds a short-lived browser join ticket to the browser that requested it and uses SameSite=Strict.
• kjn_device is a long-lived random device marker set at sign-in (SameSite=Lax), used only to recognize a returning device for account-security checks. It contains no account data and is never used for analytics, advertising, or cross-site tracking.
• kjn_human_pass is set only by the KJN iPhone app after a human check, carries a 10-minute single-use pass for sign-in (SameSite=Strict, limited to account pages), and holds no account data.

All seven are HttpOnly, so page scripts cannot read them. The passkey cookie is always Secure for an HTTPS passkey origin. When an operator sets KJN_COOKIE_SECURE=1, all cookies are marked Secure; HTTPS production deployments should set it. Local plain-HTTP development may intentionally omit that attribute so the cookies can return over its loopback connection.

KJN sets no optional tracking cookies for analytics, advertising, or cross-site profiling, so it shows no optional cookie-consent banner. The browser can also keep your display name, room and device preferences, pinned items, media choices, a per-tab UUID label, and an encrypted passkey envelope in local or session storage. Private signing keys are not stored there. KJN also stores a bounded list of blocked UUIDs — no names or message content — in browser storage so the local hide survives a reload. Clearing cookies or browser storage may sign you out and remove local preferences.

How data flows on this node

Room chat

Live audio and video

Captions

Direct messages (1:1)

Reports and blocks

Audio & video

Who can enter a private room

What "verified" and "integrity" actually mean

How long information remains

• Ephemeral room chat stays in hub memory until the room empties; anchor room history remains in the node archive until it is removed.
• A short room link (such as /abc-defg-hij) is stored until it expires, at most 30 days. It stops admitting anyone once the room invite it stands for expires or is revoked. The hub keeps only a hash of the code and the room link sealed under a key derived from that code, so its stored copy cannot be read back without the code. Anyone holding the short link can use it exactly like the full link.
• When you join a private room with its link, the hub remembers that room's link for your browser so a reload or a phone reopening the tab can rejoin without it. It is kept in the hub's memory only (never on disk, and never sent back to your browser), tied to a cookie scripts cannot read, for at most 6 hours and never past the link's own expiry. It is dropped when you leave the room, and every entry is lost when the hub restarts. Revoking the link or closing the room stops it working at once.
• Main-lattice Wall content is deleted after 24 hours by default, although an operator can configure the window. Named-room Walls do not have that short automatic expiry.
• Safety report evidence and the operator resolution outcome and reason have a 400-day maximum and are deleted together by an hourly sweep after up to 400 days. On account deletion, all block edges linked to the account are deleted and structured report account links are replaced with random pseudonyms. Reporter-supplied labels or content and an operator-entered resolution reason can still contain identifying text. Browser block UUIDs remain locally until browser storage is cleared.
• Problem reports are deleted after 180 days.
• Hashed security and authentication telemetry is kept for up to 90 days. Administrative, billing, premium, abuse, and moderation action records can keep plaintext actor or target names for up to 400 days.
• After account deletion, delinked spent passcode hashes, delinked payment-provider account tokens, subscription and transaction identifiers (including Apple and Paddle where applicable), and hashed provider-event identifiers are retained indefinitely. They no longer carry the account username and are kept only to prevent credential replay, subscription rebinding, and duplicate provider-event processing.
• Shared room archives and content supplied by other people are not automatically deleted with an account. Anchor archives remain until the node operator removes them. Current and legacy archive formats lack durable account attribution, so KJN cannot reliably infer ownership for room packets, lattice envelopes, or suggestions stored without an account username.
• You can delete your KJN account immediately; KJN account deletion does not cancel an App Store or Paddle subscription. Cancel separately through the applicable payment provider or it may continue charging. Apple, Paddle, and other configured providers may retain their own payment and subscription records under their policies and legal duties. Backups on the server follow the node operator's rotation. Encrypted offsite backup copies, stored with Cloudflare R2, are locked for 90 days, so the KJN server cannot change or delete them early, and are then deleted automatically by a storage lifecycle rule 91 days after they were made (the provider normally removes them within a day after that). So data from a deleted account can remain in an encrypted offsite copy for up to about 92 days. The KJN server cannot read or restore those copies: they are encrypted to a key the operator keeps offline.
• Deletion removes active application records; it is not forensic erasure. SQLite write-ahead logs and free pages, filesystem journals and snapshots, and backups may retain remnants until the host overwrites or rotates them.

Security and its limits

KJN uses hashed account credentials, signed records, access controls, rate limits, private host storage, and other safeguards. Anchor archives use AES-256-GCM only when KJN_ARCHIVE_KEY is configured. Other node databases, media, and files are not application-layer encrypted and depend on operating-system permissions, host security, and backup controls. Network encryption also depends on the deployment. No system can promise absolute security.

Your choices

You can choose ephemeral or durable room features, report or block another participant, clear browser storage, sign out, revoke a device, and use the self-service account deletion control in Account settings. Permanent deletion requires a live session, your current password, and typing DELETE; it does not depend on email. It revokes all sessions and deletes the account, profile picture, journal, read markers, and active standing-room registrations and invites. Your username is then kept, with the deletion time only, in a list of retired names so it can never be registered again. Wall posts and media you published are part of the room's public record and are not deleted with your account: in a permanent room they stay up under your username, and in a temporary room they are removed on that room's own timer. Direct messages you sent stay with the people you sent them to. We remove a post or message whenever the law requires it, and you can ask for removal for legal reasons at hello@kjn.app. Cleanup spans separate databases and the media filesystem, so it cannot be one atomic transaction. If storage failure interrupts it, some data may already be gone while the account remains so you can sign in and retry the idempotent cleanup. Signed-in members can download a JSON copy of their account data from /account/export (a few exports per hour); it covers the account-linked records described above, not room chat archives. Contact hello@kjn.app about access, correction, deletion, or other rights that may apply where you live.

Children

KJN is a general-audience service and is not directed to children under 13. Do not use KJN if you are under 13. If we learn that a child under 13 supplied personal information, a parent or guardian can contact us so we can review and take appropriate action.

Relationship to the Terms of Use

Your use of KJN is also governed by the Terms of Use, including their disclaimer of warranties (“as is”), limitation of liability, indemnification, termination rights, and governing-law and dispute-resolution provisions (including binding individual arbitration and a class action waiver).

Changes to this policy

We may update this policy as KJN, node settings, or legal requirements change. We will publish a new version number and effective date above and provide additional notice when appropriate.

Contact

Privacy questions and requests: hello@kjn.app.