Privacy Policy

1.Introduction

This policy applies to personal information we process when you use the Joysts website, applications, and services (the “Service”). It should be read together with our Terms of Service. By using the Service, you acknowledge the practices described here.

2.Who we are & our role

Joysts is the controller responsible for your personal information under this policy. You can reach our privacy team at privacy@joysts.com.

For purchases, Stripe, Inc. processes your payment data under its own privacy policy. Card details go straight to Stripe. Please review Stripe's Privacy Policy for how it handles that data.

3.Information we collect

Information you give us

• Account information: your name, email address, password (stored hashed), and sign-in provider if you use SSO.
• Property information: the addresses you add and details about your home.
• Your Content: documents, photos, notes, and files you upload or forward by email (for example, inspection reports, deeds, permits, warranties, receipts, and appliance manuals), which may contain personal information you choose to include.
• Communications: messages you send us, including support requests and the questions you ask in Ask, our AI assistant.

Information we generate or collect automatically

• Derived record data: facts, findings, and summaries our systems extract from Your Content.
• Usage & device data: log data, device and browser type, approximate location (from IP), and interactions with the Service.
• Cookies & similar technologies: see Cookies & analytics.

Information from third parties

• Public property records: parcel, ownership, tax, and permit data retrieved for the addresses you add.
• Environmental & climate data: risk indicators based on the property's approximate location.
• Payment status: subscription and payment status from Stripe, Inc.. We do not receive or store your full payment card number.

4.How we use information

• To provide, maintain, and secure the Service and your home record;
• To read and organize Your Content into a structured record and to answer your questions;
• To retrieve and merge relevant public records and environmental data for your address;
• To send you service messages, maintenance reminders, and (if enabled) the Weekly Pulse;
• To process your subscription and prevent fraud and abuse (with our payment processor, Stripe);
• To provide support and respond to your requests;
• To understand and improve the Service through analytics; and
• To comply with law and enforce our Terms.

5.How we process documents with AI

To build your record and answer questions, we send the relevant parts of Your Content and your questions to AI providers acting as our processors. We've designed this pipeline to protect your data:

• Your documents, photos, and questions are processed by Anthropic through its commercial API. Under Anthropic's commercial terms, it does not use API inputs or outputs to train its models, and it automatically deletes them within 30 days. The one exception: if Anthropic's automated systems flag a request as breaking its Usage Policy, it may keep that request for up to 2 years. We do not use any Anthropic feature that stores your files with them for longer.
• We do not send your documents or photos to Google's Gemini. Google's AI is used only for non-personal reference data and classification tasks, and never for your uploaded files.
• We do not train our own models on your content, and we do not sell or share Your Content for advertising.
• Answers are grounded in your own documents, with citations, and the assistant is designed to indicate when it is uncertain. AI output can still be wrong. See the AI disclaimer in our Terms of Service.

6.Legal bases (EU/UK)

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases: performance of a contract (to provide the Service you request); legitimate interests (to secure, analyze, and improve the Service, where not overridden by your rights); consent (for optional cookies and certain communications, which you may withdraw); and legal obligation (to meet legal and accounting requirements).

7.How we share & sub-processors

We do not sell your personal information. We share it only as needed to run the Service: with the service providers (“sub-processors”) listed below, each under contract and limited to the purpose shown; with our payment processor, Stripe, to process payments; in connection with a merger, acquisition, or asset sale (with notice); and when required by law or to protect rights and safety.

We keep this list current as our infrastructure evolves. For questions about our sub-processors, contact privacy@joysts.com.

If a real-estate agent gifted your account

If you signed up through an agent's gift link, that agent sees your name, the date you joined, when your gift year ends, and whether you used Joysts in the last 30 days. You can hide that last item at any time in Settings → Privacy & data. The agent never sees your documents, findings, questions or home record unless you share a summary with them. The agent receives one email when you claim the gift. Once Joysts charges agents for gifts, the agent pays only after you upload your first document, so their bill shows that you uploaded one, never what it is. We do not share anything else about you with the agent, and no one pays the agent for your sign-up.

Where your address goes (public-records lookups)

When you add a home, our servers look up its address to start your record. These services receive the address, or only its map coordinates. They never receive your name, email, or documents, and because the lookups come from our servers, they don't see your device or IP address either. Here is what each one gets and what it says it keeps:

We never send these services anything that links the address to you. Product-recall checks send an appliance's brand and model to the US Consumer Product Safety Commission, with no address.

You can say no. When you add a home, untick “Look up public records for this address” and none of the services in this table receive that home's address or its map coordinates: no address check, no county records or permits, no flood, weather, radon or climate facts, and no map or street photo. We don't store coordinates for that home either. If you change your mind, the Property tab of the home's record has a button to turn lookups on, and only then does the address go out.

8.Cookies & analytics

We use strictly necessary cookies to keep you signed in and secure, and analytics (via PostHog) to understand how the Service is used so we can improve it. You can control non-essential cookies through your browser settings and, where required, a consent prompt. Disabling essential cookies may break parts of the Service. Session recording (screen replays) is turned off.

9.Data retention & deletion

We keep your personal information for as long as your account is active and as needed to provide the Service. You can:

• Export your data at any time from Settings → Privacy & data → Export your data. Download everything (ZIP) gives you one ZIP with every document and photo you uploaded, in a folder per home, plus a JSON file with the rest of your record. JSON file only gives you the record without the original files; and
• Delete your account from Settings → Privacy & data → Delete account, which permanently removes your account, properties, records, files, and analytics profile; or
• Delete one document from its Manage menu on the Documents page. That removes the stored file and everything Joysts read from it: its findings and its facts, including ones you confirmed or corrected. Home systems are rebuilt from what remains, and a system known only from that document is removed. The same request tells you how many findings and facts it removed. Copies held by our providers expire on the schedule below.

What happens when you delete your account

A step-by-step version, with the before-and-after receipt you get by email, is at What happens when you delete your account.

1. We cancel any active subscription first, so nothing keeps billing you.
2. We delete every file you uploaded (documents, photos, and cached map images) from our file storage, Cloudflare R2, right away, in the same request. Cloudflare states that deleting an object from R2 is irreversible: there is no recoverable copy.
3. We delete your account from our database, and with it your homes, records, extracted facts and findings, questions and answers, reminders, and notifications.
4. We ask PostHog, our analytics provider, to delete your analytics profile and the usage events linked to it. PostHog queues this and completes it in the background.
5. We send one last email to your account's address confirming the deletion. It lists what was deleted, gives a receipt (what your account held right before the delete, and the same count run again afterwards, which must be zero), says plainly if any step (file storage or the PostHog request) did not complete and will be finished by hand, and lists the provider copies below that expire on their own. That email is the only thing we send after your account is gone.

If file storage is unavailable at that moment, your account is still deleted. We are alerted, and we remove the leftover files with a cleanup tool, because each file's location is tied to your account ID and not to the deleted records.

Copies that expire on a fixed schedule

• Database history: our database provider, Neon, keeps a restorable history of recent changes for 6 hours. After that, your deleted data is gone from it too.
• AI processing: Anthropic deletes what we sent it within 30 days (up to 2 years only for a request its systems flag under its usage policy), as described in How we process documents with AI.
• Email:Resend, which sends our emails and receives the documents you forward to your home's address, keeps those messages for 30 days.
• Background jobs: Inngest, which runs document reading in the background, keeps job logs (which can include text read from your documents) for 24 hours.

What we keep

• Analytics, only if the automatic deletion fails: while your account is open, PostHog keeps usage events (pages viewed and actions taken, linked to your account ID and email address) for 1 year. Deleting your account deletes them, as described above. If that request to PostHog fails, we are alerted and delete your profile by hand. You can also email privacy@joysts.com to confirm it is gone. Session recording is turned off.
• Payments: Stripe, Inc. keeps its own payment records under its privacy policy and the law.
• AI cost log:a record of each AI call's model, token count, and cost. It holds no document content and no link to you once your account is deleted.
• Information we must keep to meet legal, tax, or accounting obligations, resolve disputes, or enforce our agreements.

10.Your privacy rights

Depending on where you live, you may have the right to access, correct, delete, or port your personal information; to object to or restrict certain processing; and to withdraw consent. Many of these you can exercise directly in the app (export and delete). For anything else, email privacy@joysts.com and we will respond as required by law. We will not discriminate against you for exercising your rights. If you are in the EEA/UK, you also have the right to complain to your local data protection authority.

11.How we protect your data

These are the specific measures in place today:

• Encryption in transit. Joysts is served only over HTTPS. Our host, Vercel, redirects every plain HTTP request to HTTPS and supports TLS 1.2 and 1.3 (Vercel). Our database provider requires TLS on every connection (Neon).
• Encryption at rest. Your files are stored in Cloudflare R2, which encrypts all objects and their metadata at rest with AES-256 (Cloudflare). Your records are stored in Neon Postgres, which encrypts customer data at rest with AES-256 (Neon).
• Account isolation in the database. The web app connects to the database with a role that cannot bypass row-level security, so each query only sees rows for the signed-in account and the home it is working on. Automated tests check this on every change.
• Short-lived file links. Files are never public. When you open a document or photo, we create a signed link that expires within an hour (15 minutes for opening a document), and upload links expire after 5 minutes.
• Passwords are stored hashed, never in plain text.
• No session recording. We do not record or replay your screen.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please use a strong, unique password and keep your credentials confidential.

Found a security problem? Our security page says how to report it, and what we have and have not had audited.

12.International transfers

We and our sub-processors are located primarily in the United States, so your information may be transferred to and processed in the US and other countries whose data-protection laws may differ from yours. Where required, we use appropriate safeguards for these transfers, such as the European Commission's Standard Contractual Clauses.

13.Children's privacy

The Service is not directed to children under 18, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact privacy@joysts.com and we will delete it.

14.US state privacy rights

Residents of California and other US states with privacy laws may have rights to know, access, correct, delete, and port their personal information, and to opt out of “sale” or “sharing” of personal information and certain targeted advertising. We do not sell your personal information and do not share it for cross-context behavioral advertising. To exercise your rights, use the in-app tools or email privacy@joysts.com. You may use an authorized agent, and you may appeal a decision by replying to our response.

15.Changes to this policy

We may update this Privacy Policy from time to time. We will revise the “Last updated” date above and, for material changes, provide additional notice. Please review it periodically.

16.Contact us

To exercise your rights or ask a privacy question, contact: