Privacy Policy

Last updated: October 2, 2026

This policy explains what data we collect when you use Jen's App Hub (the "Service"), why we collect it, who we share it with, and what choices you have. Throughout this policy, "we," "us," and "our" refer to Jen Built It LLC. App Hub is the account and Pro billing home for five apps: Dopamine Dealer, Side Hustle Garden, Subscription Graveyard, Energy Battery, and Emergency Fund Aquarium. Each of those apps has its own privacy policy for the data you put into it.

1. What we collect

• Account data. Your email address and a salted PBKDF2 hash of your password (100,000 iterations, a random salt for each user). We never store your password in plain text. We also store when you signed up, whether and when you verified your email, and whether you've turned off recap emails.
• Subscription data. If you upgrade to Pro, we store your Stripe customer ID, your Stripe subscription ID, your plan, and the date your Pro access runs through. For each Stripe event about your subscription (a payment, a renewal, a change, a cancellation) we keep a record with the event type, the amount, the currency, and the date. Card numbers and other payment details go straight to Stripe and never touch our servers.
• Gifted Pro. If you're given Pro through our affiliate program, we store your email, the date the gift runs through, where it came from, and when it was applied to your account. A gift can be issued before you sign up, so this record can exist before your account does.
• Referral code. If you arrive through an affiliate's link, the referral code in that link is saved in your browser (see section 6). If you buy Pro, the code is attached to your Stripe subscription so the right affiliate gets credit.
• Recap email log. If you have Pro, we log each recap email we send you: your email, which app it was about, the period it covered, and when it went out. This is how we make sure you never get the same recap twice.
• Security data. Short-lived rate-limit records keyed by a one-way hash of your IP address, your email address, or your user ID, and a record of failed logins keyed by your email. Email verification codes and password reset links are stored only as SHA-256 hashes.
• Security log. When someone logs in, fails to log in, changes or resets a password, or deletes an account, and when Pro is granted or taken back through our affiliate program, we write one line to our server log with the event type, your user ID or a one-way hash of your email, and a one-way hash of the IP address. It never holds your password, your login token, your raw email or your raw IP address.
• Feedback you send. If you use the feedback button while logged in, we receive your message, the type you picked, the email you typed (optional), the page address, and your browser's user agent string.

App Hub doesn't offer a newsletter. Your account record has a newsletter-consent field that stays off, and nothing in the Service turns it on.

2. Why we collect it

• To create and secure your account (legal basis: contract).
• To bill you for Pro, keep your Pro status current, and email you when a cancellation is scheduled or takes effect (legal basis: contract).
• To switch Pro on in all five apps and sign you in to them from the hub (legal basis: contract).
• To send Pro recap emails, which you can turn off at any time (legal basis: contract).
• To pay affiliates the commission they earned on a sale they referred (legal basis: legitimate interest).
• To prevent fraud, abuse, and password guessing (legal basis: legitimate interest).
• To read and answer feedback you choose to send (legal basis: legitimate interest).

3. Who we share it with

We use a small set of vendors and our own systems to run the Service. Each one only receives what it needs.

• Cloudflare hosts the Service and our database (Cloudflare Workers and D1). We also use Cloudflare Web Analytics to count page views. Cloudflare says it doesn't use cookies or local storage for this and doesn't fingerprint visitors.
• Stripe processes Pro payments. When you start checkout, we send Stripe your email, your App Hub user ID, and the affiliate referral code if you have one. Stripe's checkout page also collects your card, billing address, and name (and a tax ID if you add one) under Stripe's own privacy policy.
• Resend sends our emails: your verification code, password reset links, cancellation notices, and Pro recap emails.
• Our own n8n automation server (n8n.jen8nflows.cloud, run by Jen Built It LLC) receives four things. When you sign up, it gets your email, the app name, and the time, so Jen gets a new-signup notice. When a Pro subscription ends, it gets the Stripe subscription ID, the Stripe customer ID, and your App Hub user ID, for our affiliate tracking. When the server hits an error, it gets an error report with the request path, method, status code, and error message, never your account data. And it gets anything you send through the feedback button.
• The Jen Built It affiliate program (our own system at jenbuiltit.com, which keeps its records in Airtable). If you bought Pro through an affiliate's link, each paid invoice sends it the referral code, the sale amount and currency, the Stripe invoice, charge, and subscription IDs, and your email, so the affiliate can be credited. If a payment is refunded, we send the refund details so the commission is reversed.
• The five Jen Built It apps. See section 4.
• Google Fonts. Our pages load fonts from Google (fonts.googleapis.com and fonts.gstatic.com), which sends your IP address and browser details to Google when the page loads.

The Showcase and Builds pages read our own project list from Airtable. None of your data is sent there.

We don't sell your personal data. We don't share your data with advertisers. We don't transfer your data to third parties for their own marketing.

4. How App Hub works with the five apps

• Opening an app from the hub. The link carries a signed token with your email and your Pro end date (blank if you're on the free plan). The app uses it to sign you in. If you don't have an account there yet, the app sets one up under the same email.
• Logging in to an app directly. The app sends us your email, and we answer with whether you have Pro right now and, if you do, a signed token with your email and Pro end date.
• Checking a token. An app can send us a token to confirm it's real. We send back the email and Pro end date inside it.
• Recap emails (Pro). On recap days we send each app your email and the date range, and the app sends back a summary of your activity for that period (for example, totals you saved or habits you checked off). We turn that into the email and send it through Resend. We don't store the summary. Weekly recaps cover Energy Battery and Dopamine Dealer. Monthly recaps cover Subscription Graveyard, Emergency Fund Aquarium, and Side Hustle Garden. A period with no activity gets no email.

No payment details ever go to the apps.

5. How long we keep your data

• Account data, subscription data, payment event records, gifted Pro records, and your recap email log: as long as your account exists. When you delete your account, all of them are deleted right away.
• Verification codes expire after 30 minutes and password reset links after 1 hour. The hashed records stay until you delete your account.
• Rate-limit and failed-login records: these expire within 15 minutes and are cleared out automatically after that. A daily cleanup job also deletes any expired rows that are left, plus used or expired reset links and verification codes once they're 7 days past expiry.
• Security log lines: kept by Cloudflare's Workers Logs for 3 to 7 days, depending on our Cloudflare plan, then deleted.

Deleting your App Hub account cancels any active Pro subscription right away. It doesn't remove what's already been sent elsewhere: Stripe keeps its own customer and payment records, the affiliate program keeps any commission record that names your email, a signup notice already emailed to Jen stays in her inbox, and your data inside each app stays in that app until you delete it there.

6. Cookies and browser storage

To keep you logged in, we set one cookie named hub_session. It holds a signed login token, it's marked HttpOnly so scripts on the page can't read it, it's only sent to App Hub over HTTPS, and it lasts 30 days or until you log out, whichever comes first. On jenbuiltit.com it's limited to the App Hub pages under /app-hub, so the rest of that site never receives it. We don't keep your login in browser local storage anymore.

App Hub also saves these items in your browser's localStorage, and each one is needed for the part of the Service it belongs to:

• hub_pro_token: the signed token with your email and Pro end date that's passed to the apps.
• hub_tour_done: remembers that you've seen the guided tour.
• aff_ref and aff_ref_at: the affiliate referral code from the link you arrived on, if any, and when you clicked it. It's sent with your checkout so the right affiliate gets credit, and it's dropped 60 days after your last affiliate link click.
• qb_pin: only on the Builds page, and only for the site owner's admin PIN. Visitors never have it.

Logging out removes your login cookie and your Pro token. We don't use advertising cookies or tracking pixels.

7. Do Not Track

Some browsers can send a "Do Not Track" signal. App Hub doesn't use advertising or tracking tools that follow you across other websites, so it works the same whether or not your browser sends that signal. We don't let any third party collect information about your activity on App Hub to track you across other sites over time.

8. Your rights

Depending on where you live (GDPR, UK GDPR, CCPA/CPRA, and similar laws), you may have the right to:

• Access the personal data we hold about you and get a copy of it
• Correct inaccurate data
• Delete your account and your data
• Lodge a complaint with your local data protection authority

To delete your account, go to Account, then Delete my account under Danger zone. To turn off recap emails, use the toggle in Account or the unsubscribe link in any recap. For a copy of your data or anything else, email privacy@jenbuiltit.com from the address on your account. We respond within 30 days.

9. Children

The Service isn't meant for anyone under 18, and we don't knowingly collect personal data from them. If you believe a child has created an account, email privacy@jenbuiltit.com and we'll delete it.

10. International users

The Service is operated from the United States. By using the Service from outside the US, you consent to the transfer of your data to the US. We rely on Standard Contractual Clauses or equivalent safeguards with our sub-processors where required.

11. Security

We protect your data using TLS in transit, salted PBKDF2 password hashing, signed login tokens that are revoked when you change your password, hashed verification codes and reset links, rate limiting, and a lockout after repeated failed logins. No system is perfectly secure, but if we detect a breach affecting your data, we'll notify you and the appropriate authorities as required by law.

12. Changes to this policy

If we update this policy in a way that materially changes how we handle your data, we'll notify you by email or post a notice on the Service. The "Last updated" date at the top always reflects the current version.

13. California rights, Do Not Sell or Share My Personal Information

We don't sell your personal information and we don't share it for cross-context behavioral advertising. We never have. This statement is a required disclosure under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA).

California residents also have the right to know what personal information we hold, request a copy, request deletion, and request correction. Using these rights won't change your price or your service. To make any of these requests, email privacy@jenbuiltit.com from the email address on the account, or write to us at the address below. We respond within 45 days.

14. Contact

Questions about this policy or your data:

Jen Built It LLC
10800 S Lloyd Drive
Worth, IL 60482
USA
privacy@jenbuiltit.com