Privacy policy
Last updated
Jean is an AI assistant that runs in your browser. It keeps your tasks, files, settings and keys on your device. We, Warehouse SAS, publish Jean at jean.is, and we never receive what you write to it or the files you give it, except a copy you choose to share by link, which is sealed so that we can’t read it.
In short
- No account, no cookies, no analytics, no advertising.
- What you write, drop in and make stays on your device, unless you send it somewhere: to a brain in the cloud, a service you connect, a site you open.
- Our servers send you Jean’s files and relay to the services a browser can’t reach. They keep no record of either.
- When you share by link, our share host keeps a sealed copy it can’t read, for as long as you chose, and, as French law asks of every host, a sealed record of where each change came from. It records nothing about who opens a link.
- We don’t sell, rent or share anything about you. We have nothing to share.
Who is responsible
Warehouse SAS, 66 avenue des Champs-Élysées, 75008 Paris, France (RCS Paris 949 551 618), publishes Jean at jean.is and runs its gateway at gateway.jean.is and its share host at hst.ing. Write to arnaud@jean.is about anything in this policy. Using Jean is covered by our terms of service.
This policy covers jean.is, gateway.jean.is and hst.ing. Jean is open source: a copy served from another address, such as your organisation’s, is run by whoever serves it, and their policy applies to it.
What stays on your device
Jean keeps everything it works with in your browser’s storage for this site, on this device: your tasks and their files, projects, memory, skills, routines and settings, and the keys and sign-ins you add, which are encrypted. It uses the browser’s private file system, IndexedDB, local storage and an offline copy of the app. None of this is a cookie, none of it follows you to other sites, and none of it is sent to us.
- A backup (Settings › Your data) is a file you download. Your keys are never in it.
- If you turn on Sync, Jean copies your files to a folder you choose. If that folder is in a cloud drive (iCloud Drive, OneDrive, Dropbox, Google Drive…), that service carries them, under its own terms. Your settings and keys never go there.
- To delete everything, clear this site’s data in your browser’s settings. In a private window, nothing is kept once you close it.
What our servers see
The site. When your browser loads Jean from jean.is, our server receives what any web server receives: your IP address, the address of the file asked for and your browser’s request headers, such as its language and version. It uses them to send the file, and writes nothing down: no access logs, no cookies, no analytics.
The gateway. Some services refuse to be reached from a browser. When you connect one of them, Jean reaches it through our gateway, gateway.jean.is, which relays your requests to that service and its answers back to you, including, when you sign in, the codes that let Jean act for you. The gateway keeps none of what it relays: no logs, no copies, no database. Your sign-ins stay encrypted on your device. It relays only for Jean, and only to the services Jean knows.
Shared links. When you share a task, or a page, chart, slides or picture, by link, Jean makes a copy of it in your browser: the requests, the answers, the pictures made and the answers’ certificates, never your notes, memory or keys, and what Jean read only if you tick it. Jean seals that copy before it leaves your device. The key that opens it is in the link, after the #, which browsers never send to a server, so our share host, hst.ing, keeps the copy without being able to read it. It keeps it for 30 days or a year, as you choose, or until you stop sharing it, and then deletes it. For a link with a password, it keeps a fingerprint of a proof made from the password and the link, never the password itself, and counts failed attempts.
As French law asks of every host (article 6 of the Loi pour la confiance dans l’économie numérique and its decree of 20 October 2021), the share host records, for each share made, changed or stopped, the IP address and port it came from, the protocol, the share’s identifier, what was done and when. These records are sealed with a key we keep offline, kept for one year and then deleted, and opened only when an authority entitled to them asks. Nothing is recorded about the people who open a link.
Reports. If you report a share, we receive what you write and, if you choose, the whole link, so that we can see what was shared. We keep a report for as long as we need to deal with it.
Key requests. When an organisation asks for a key on jean.is, our server receives what its form says: the organisation, the addresses it serves Jean from, how many people will use it, your name and work email, what you add and, for a subscription, its country, VAT number and billing address. We keep each request in a file on that server and mail it to ourselves through Google Workspace, which carries our email, to answer you, send your key and, for a subscription, invoice it. We keep a request for three years after our last exchange, and an invoice for ten years, as French law asks.
The site is served by Bunny CDN, from BunnyWay d.o.o., a Slovenian company, which keeps jean.is’s files in Germany and sends them from its server nearest you, keeping no logs. The gateway, the share host and key requests run on a server we rent from OVHcloud (OVH SAS, a French company), in its Gravelines data centre in France. We use these data to provide the service you ask for (Article 6(1)(b) of the GDPR), to keep it running and secure, for our legitimate interest (Article 6(1)(f)), and, for the records of shared links and invoices, to meet our legal obligation (Article 6(1)(c)). Apart from shared copies, their records and key requests, kept as said above, they are kept only for the time it takes to answer each request.
What goes to others, when you choose
Jean sends something outside your device only for what you set up or ask for. Each of these companies receives it under its own terms and privacy policy, and is responsible for what it does with it. An organisation that set up your copy of Jean may change these addresses or turn them off.
- Brains in the cloud. When a brain in the cloud answers (through OpenRouter, or with your own key from OpenAI, Anthropic, Google, Mistral AI or another provider), your messages, the parts of your files and tasks that Jean gives it, and the results of what Jean did go to that provider. A brain on your device, or on a server of your own network, keeps all of this there; Keep on this device, in Settings › Brains, makes sure of it. Each answer’s About this answer says where it was done.
- Plans you pay for. If you use your Claude, Copilot or ChatGPT plan through This computer, your messages go to Anthropic, GitHub or OpenAI.
- Downloads. The brain on your device, Intuition and dictation are downloaded once from Hugging Face, which sees your IP address and nothing you write. Dictation runs on your device.
- Services you connect. A connection (Gmail, Slack, Notion, Qonto…) exchanges with its service what your requests need: what Jean reads there, and what it writes or sends after asking you first. Some pass through our gateway, as above.
- Web search. The words of a search go to whatever searches: Wikipedia (or Vikidia, or a library of your own), a search service you connected, or the brain’s provider. Beside a source from the web, Jean shows the site’s icon from DuckDuckGo, which receives the site’s name.
- Sites you open in Jean’s browser, and pages Jean reads for you, receive your IP address and what any visit sends, without cookies.
- Prices. To show what an answer from the cloud costs, Jean reads a list of prices from models.dev.
- Skills, maps and programs. Skills from elsewhere are read from GitHub; maps, once you say yes, come from OpenFreeMap; the packages the Computer installs come from PyPI, npm and jsDelivr.
- Certificates. If you choose to have an answer’s certificate dated or recorded, its signature and your device’s seal go to Sigstore. Its log is public and can’t be erased.
- Saved copies and shared links. A task saved as a web page, or opened from a link, loads what draws it from jsDelivr when it is opened; a shared map loads from OpenFreeMap. Both see the IP address of whoever opens it.
- Extensions you add are other people’s code: read what each says it does.
Google user data
If you connect Gmail, Google Calendar, Google Drive or Google Workspace, Jean asks Google only for what its tools need: to read, label, draft and send your email; to read and change your calendars’ events; to find and read your files, and to create documents.
- What Jean reads from Google is shown to you and given to the brain that answers you, only to do what you asked. It goes only to a brain whose service never uses it to train AI: one on your device, where it stays, or OpenRouter (asked for providers that keep nothing), OpenAI, Anthropic, Vertex AI, Groq, Cerebras, Together AI, Fireworks AI or xAI, whose terms rule it out. Jean refuses every other brain, for that task and for what comes of it.
- Gmail, Calendar and Drive are reached straight from your browser. Signing in, and Google Workspace’s own servers, go through our gateway, which keeps nothing.
- We never receive, store, sell or share your Google data, show it to anyone, or use it to train AI.
- Jean’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- You can take Jean’s access away at any time: remove the connection in Jean, or Jean in your Google Account.
Children
Apart from the records of shared links above, we collect nothing from anyone, children included. The brains and services you add through Jean set their own minimum ages, some 18: follow them.
Security
Jean runs within the limits your browser sets, keeps your keys and sign-ins encrypted, runs the code it writes in a walled-off space of its own, and asks you before it sends, shares or deletes anything. Everything between your browser and our servers is encrypted. No system is perfect: keep your browser up to date, and keep backups.
Your rights
Under the GDPR you may ask us to access, correct, erase or hand over your personal data, to limit its use or to object to it, and you may complain to the CNIL or to your own country’s data protection authority. Apart from the copies you share, which we can’t read, and the sealed records of shared links, our servers keep nothing, so we will usually hold nothing about you: your data is on your device, where you can see it, back it up and delete it yourself. You can stop sharing a link at any time, in Settings › Your data. For data held by a brain’s provider or a service you connected, ask them. Write to arnaud@jean.is; we answer within a month.
Changes
When this policy changes, we publish the new version here with its date. The French and English versions have the same value.