Draft. This document is not yet in effect: the operator's legal details are still being completed.
Privacy Policy
Last updated: [date]
This policy explains what personal information [operator name] ("we") collects when you use JellyRelay, why, who else handles it, how long we keep it and your rights. We collect as little as the service needs. We do not sell personal information, show ads or track you across sites.
The person responsible for the protection of personal information is [operator name], reachable at [contact email].
1. What we collect
| Information | What it is | Why |
|---|---|---|
| Account | The identifier our sign-in provider gives your login, and an internal account number. Your name and email are held by the sign-in provider; we do not store them. | To sign you in and keep your account separate from others. |
| Billing | Your Stripe customer and subscription identifiers, plan, subscription status and renewal date. Card details, billing address and invoices are held by Stripe; we never see your card number. | To give you the plan you pay for. |
| Servers | The servers you register: their identifiers, public addresses, the plugin's public key, which relay they use and their Jellyfin version. | To route viewers to your server, authenticate the plugin and warn you when your Jellyfin version has a known security problem. |
| Usage | For each server and day: data sent and received, number of requests and live connections. Not what was watched, by whom or from where. | To enforce your plan's limits, show you your usage and plan capacity. |
| Technical logs | Service events such as a server connecting or disconnecting, with its address and identifier, and errors. | To run, secure and troubleshoot the service. |
Traffic between viewers and your server
When someone opens your server's address, their connection is encrypted to one of our relays. The relay decrypts it in memory to pass it to your server through the plugin's encrypted connection, and does the same for the responses. Relays do not store, inspect, record or log this content, and we do not log viewers' IP addresses. Relays use a viewer's address only in memory, to slow down password guessing against your server, and pass it to your server so Jellyfin can apply your remote-access settings and show it in your own Jellyfin logs. Sign-in to your Jellyfin server and everything inside it is handled by Jellyfin on your server.
2. Cookies
The account pages use only cookies needed to keep you signed in and to protect sign-in and forms against forgery. There are no analytics or advertising cookies.
3. Service providers
We use these providers, which process information on our behalf or, for payments, under their own terms:
| Provider | Purpose | Location |
|---|---|---|
| OVHcloud | Servers that run the service and its database | Canada, and each region where we run relays |
| Auth0 (Okta) | Sign-in (holds your name and email) | United States |
| Stripe | Payments, invoices and tax | United States and other countries |
| Cloudflare | DNS for our domain (no customer data) | Worldwide |
| Mailgun | Service alerts sent to our operators, which may include server addresses | United States |
Some providers are outside [jurisdiction], so your information may be processed under other countries' laws. We choose providers that protect it adequately and limit what we share with them.
4. How long we keep it
We keep each kind of information only as long as its purpose needs. A daily job deletes what has reached its limit.
| Information | Kept |
|---|---|
| Account, servers, plan and billing link | While your account is active. If your subscription ends and you do not subscribe again, your account and all its data are deleted 90 days later. |
| Accounts that never had a plan | Deleted 90 days after you signed up if you never subscribed or registered a server |
| Daily usage totals | 90 days |
| Monthly data-allowance counters | Until 90 days after the end of the month |
| Payment page sessions and payment notifications from Stripe | 90 days |
| Technical logs | 14 days |
| Database backups | 7 days, inside our hosting provider's server backups |
| Invoices, payments and taxes | Kept by Stripe, not by us, for as long as tax and accounting law requires (in Canada, generally 6 years) |
When you delete your account, or it is deleted after your subscription ends, everything above is deleted at once from the live database and disappears from backups within 7 days. We keep only the fact that the account number was deleted, so it is never reused, and your server addresses, unlinked from you, so nobody else can take them over.
5. Security
All connections are encrypted. Credentials are stored as one-way hashes where possible, the database is reachable only from our control server, and access is limited to the people who run the service. If a privacy incident creates a risk of serious harm, we will notify you and the authorities as the law requires.
6. Your rights
In your account page you can download your data (everything we store about your account, as a JSON file) and delete your account. Deleting it also deletes your customer record at Stripe, which ends your subscription at once and removes your saved payment methods; Stripe keeps invoices and payments as legally required accounting records. Your sign-in account with the sign-in provider is separate: ask us to remove it too, or remove it with the provider.
You can also ask us to access, correct or delete your information, or to receive it in a portable format, by writing to [contact email]; we answer within 30 days. If you are not satisfied, you can complain to the privacy authority where you live.
7. Children
The service is not for people under the age of majority, and we do not knowingly collect their information.
8. Changes
We will post changes here and, for important ones, tell you by email or in your account before they take effect.