Privacy Policy
JOl: Join our Loop
This policy explains how this application handles information and how to contact us about privacy.
Information we process
JOl: Join our Loop stores the names and optional relationships and avatars you enter, imported photo copies, captions, capture dates or years, links between people and photos, story selections and selection progress on your device. The system photo picker gives the app only images you choose; JOl does not scan your entire library or recognize faces. The app reads available capture-date metadata, creates resized local copies and does not use location metadata. Optional backup sends an archive of this information and smaller image copies, encrypted on your device. Original-resolution photos are not sent. A random installation secret is kept in this device's Keychain. The server stores the encrypted archive, a one-way hash of a separate authorization credential identifying that installation, upload time and byte count. Requests to the backend and this public website necessarily expose network information such as IP address, request path and time to the hosting infrastructure. No account, email address, password, analytics identifier or advertising profile is requested.
How we use information
Local information is used to organize people, manually associate photos, filter your gallery, preserve selection progress and display chronological stories. Optional backup is used only to save and restore this installation's encrypted library and smaller photo copies. The installation secret derives separate authorization and encryption keys on your device. Request and operational information is used to deliver and secure the service and diagnose availability. We do not use your content for advertising, public feeds, face recognition or automated personal profiling.
Service providers and sharing
The backend and this website run on Railway. Railway and its underlying infrastructure process network requests and store encrypted backup files and operational metadata as hosting providers. JOl uses Apple's system photo picker and Keychain on the device, with no third-party analytics, advertising, messaging or social SDK. JOl does not publish your photos or provide a sharing feed. The application does not log image content, bearer secrets or readable archive data. Hosting infrastructure may maintain request and service logs; we do not claim that all infrastructure logging is disabled. Information may also be disclosed where legally required. No other external recipient is integrated into this application.
Data retention
Local records and imported image copies remain until you delete them in the app or remove the app's local storage. The app excludes its library directory from operating-system cloud backup. The Keychain secret uses device-only protection and may remain after app removal; uninstalling is not a reliable way to revoke a server backup. The server retains the latest encrypted backup until you replace or delete it. Replacement removes the prior application-managed backup file. There is no scheduled archive expiry. Railway's infrastructure logs or platform snapshots may follow provider-controlled retention that is not specified by this app. We do not promise a fixed retention period or immediate erasure of provider backups.
Deleting your information
Delete a photo in JOl to remove the imported app copy without changing the original in your photo library. Deleting a person removes their profile and photo associations while retaining the photos. Delete All Local Data clears the local library and imported image files, but keeps the installation secret and does not delete an existing server backup. Use Delete Server Backup in Settings to remove this installation's encrypted archive and database record. Server deletion is also available when the local library is empty as long as the Keychain secret remains. If the secret is lost, the app cannot retrieve or identify that private backup for recovery, and we cannot promise content-based deletion because the server cannot read the archive. Provider snapshots and logs may outlast deletion from active application storage; the app has no separate archive or outbound email system.
Permissions and your choices
Photo import uses Apple's privacy-preserving system picker. You choose the specific photos or cancel without giving JOl broad photo-library access. JOl does not request camera, microphone, contacts, location or notification access. Stop importing to withdraw further photo selection; remove already imported copies from JOl separately. Backup is optional and only runs when you tap Back Up Now. You may stop future uploads at any time and delete the existing backup in Settings. The main local features work without a network connection.
Your privacy rights
You can inspect and edit your local people, dates, captions and photo links, and delete local data or the server backup using Settings. Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing and to contact your privacy regulator. Privacy questions and rights requests may be sent to main@ashleybrooks.blog. This address is a public privacy contact, not an app account or delivery service. Please do not send your installation secret or private photos. We may be unable to link a request to encrypted server data without the installation's authorization, and cannot decrypt it for you.
Security
The app encrypts each backup with AES-GCM before upload, deriving a separate encryption key from the random 32-byte installation secret with HKDF-SHA256. It derives a different authorization credential using a separate HKDF context, so the master secret and encryption key are not sent to the server. Transport uses HTTPS. The master secret is stored in the device-only Keychain and is not embedded in the app or shared between installations. The server checks the derived bearer credential for every backup operation and stores only its hash. It stores encrypted files on a persistent Railway volume with restricted file permissions and a SQLite index. Local library files use iOS file protection. A compromised device may expose your data or secret, and compromised infrastructure may affect availability or replace encrypted data; no system guarantees complete security. Loss of the installation secret prevents restoration; there is no password reset or cross-device sign-in.
Children’s privacy
JOl is intended for adults organizing memories of themselves and people close to them, and is not directed to children under 13. Adults may include family photos, including children, only where they have appropriate permission and authority. JOl does not solicit information directly from children or create child accounts. Contact main@ashleybrooks.blog with concerns about children's information, without sending private photos or the installation secret.
Changes to this policy
This policy may change when the app's data practices or hosting arrangements change. The current policy is available through Settings and at this public privacy page, with its effective date shown above. Material changes will be described in the updated policy and, where appropriate, in the app. Review the policy before enabling backup after an update.