Privacy Policy
Last updated: October 2, 2026
Operator: Jen Built It LLC ("we," "us," "our") Address: 10800 S Lloyd Drive, Worth, IL 60482, USA Privacy contact: privacy@jenbuiltit.com
This Policy describes what personal information Jen Built It LLC collects when you use jenbuiltit.com (the homepage, the new-tool alerts list, and the affiliate program) and buildabio.com (Build a Bio, including Build a Bio Pro). Both sites run on the same system, so one Policy covers both.
We don't sell your personal information. We don't "share" it for cross-context behavioral advertising as that term is defined by the California Privacy Rights Act (CPRA). See our Do Not Sell or Share My Personal Information page for details.
1. What we collect, and why
1.1 If you visit any page
- Request logs through Cloudflare, our host: IP address, browser User-Agent string, timestamp, referring page, requested URL, and response code. We use them to keep the sites running and to debug errors.
- Cloudflare Web Analytics. Our pages load a small Cloudflare script that counts page views and page speed. Cloudflare says it doesn't use cookies or local storage and doesn't fingerprint visitors. We see totals, not individual people.
- Google Fonts. Our pages load fonts from Google (
fonts.googleapis.comandfonts.gstatic.com). When your browser fetches a font, Google receives your IP address and browser details, the same as for any file your browser downloads. - Short-lived spam counters. To stop floods of form posts, sign-in requests and clicks, we count requests per IP address (and per email address for sign-in links) in our database for a few minutes to a day at a time.
- No advertising or cross-site tracking. We don't use Google Analytics, Facebook Pixel, X Pixel, TikTok Pixel, or any other ad or retargeting tracker.
If something on a page crashes, the server sends an error report (the page address, the request type, and the error message) to our own automation server so Jen gets an email and can fix it.
1.2 If you join the new-tool alerts list
On the jenbuiltit.com homepage, or with the "Email me when Jen ships a new app or tool" box when you save a bio, we collect your email address, the time you signed up, where you signed up, your IP address, and your browser User-Agent.
Why: the email is where we send the alert, and the rest is the record that you asked for it. We only email this list when Jen ships a new app or tool, and every email has a one-click unsubscribe link. We don't hand the list to any third party except Resend, which delivers the emails.
1.3 If you build a bio with Build a Bio
What you give us:
- Your email address. There's no password. This email owns your bios, and we send sign-in links to it.
- The bio itself: display name, tagline, links, section titles, social handles, theme and colors, an optional public contact email, and (on Pro) your custom
/b/address, a featured card, font choice, custom CSS, and an affiliate code if you add one. - On Pro, an optional logo you upload. It's stored in Cloudflare R2 under a scrambled folder name made from your email, so your email isn't in the file's address. Your logo is public once it's on your page or share picture.
What we record while you use it:
- A sign-in record each time you open a magic link: your email and when the sign-in expires (60 days). Edit links stop working after 15 minutes.
- If you joined the alerts list, the record in Section 1.2.
- When your first bio is saved, Jen gets an email with your address and the app name, sent through our own automation server, so she knows a new person signed up.
Emails we send you: a "your bio is live" email, sign-in links when you ask for one, and on Pro, a welcome email and a cancellation notice if you cancel.
Why: to host your bio at its public address, let you edit it later without a password, and run your Pro plan.
1.4 If you buy Build a Bio Pro
Checkout runs on Stripe. We send Stripe your email address, the plan you picked, and, if an affiliate's link sent you, that affiliate's referral code. Stripe collects your card and billing details and calculates sales tax. We never see or store your card number.
Stripe sends us back your Stripe customer ID, subscription ID, plan status, and when the current period ends. We store those with your email so we know your bios are Pro.
If an affiliate referred you, we record the sale (your email, the amount, the product, and the affiliate's code) in our Airtable affiliate records so the affiliate gets paid the right commission and so we can catch someone buying through their own code.
1.5 If you visit someone's bio page
- View count. Each bio has a running total of views. We count per IP address so one visitor reloading can't inflate it, but we only keep the total, not who viewed it.
- Link click counts (Pro bios only). When you tap a link on a Pro bio, we store which bio, which link, and the time. No IP address, no name, nothing about you. The bio owner sees totals per link.
- Daily visit totals. We count visits to the Build a Bio homepage and builder once per browser per day, using a cookie that holds only the date (see Section 6). We keep only the daily total, never who visited.
1.6 If you report a bio
The report form collects the reason, any details you type, and an optional email address so we can follow up. Jen gets an email with the report and the bio owner's email so she can review it.
1.7 If you apply to the affiliate program
You submit:
- Your full name
- Your email address
- An optional website or social profile URL
- A description of who your audience is
- Where you'd share the apps and what you'd say about them
- A confirmation that you're a US person for tax purposes
- Your agreement to our Affiliate Terms
We store your application, with the date you applied, in our Airtable base.
Why: to decide whether to admit you. If you're approved, your record also holds your referral code, commission rate, your PayPal email once you add it, your W-9 status, your quest progress, and which apps you've been given free Pro on.
1.8 If you're an approved affiliate
- Sign-in. We create a session record with your email, a hashed session token, your browser User-Agent, your country (from Cloudflare's IP lookup), and timestamps. The token itself lives only in a cookie that page scripts can't read. Sessions last up to 30 days, and signing out ends yours right away. Sign-in links store the requesting IP address and stop working after 15 minutes (7 days for the welcome link).
- Free Pro. When you're approved, and when Jen approves a finished quest, we send your email to our own apps (App Hub, Resume Prune, Giveaway Widget, Porch Pile, and Build a Bio) so they can switch on your free Pro.
- Your coupon code. When you're approved or change your code, our automation server (n8n) creates or updates your discount code in Stripe.
- Quests. When you submit a quest finding, we store what you checked, the result, your notes, any steps to reproduce, and any screenshot or screenshot link you add. Screenshots are uploaded to our Airtable base.
- Emails. Your welcome email, quest approvals, commission alerts if you turn them on, and program updates (which have their own unsubscribe link) go through Resend.
- Payouts. We pay through PayPal using only the PayPal email you give us. When we need a W-9, Jen asks for it by email. This site has no W-9 upload.
1.9 If you click an affiliate link (/go/CODE)
We log: the time, the referral code, where you're being sent, any UTM tags on the link, the referring page, your country, and your browser User-Agent. We don't log your IP address with the click.
Why: to credit the affiliate who sent you and to spot fraud. We don't use this to follow you anywhere else.
1.10 If you send feedback
Signed-in Build a Bio pages have a feedback button. It sends your message, the feedback type, an optional email, the page address you were on, and your browser User-Agent straight from your browser to our automation server (n8n), so Jen can read it.
2. What we don't collect
- Card numbers. Stripe handles the whole payment, and we never see your card.
- Bank account or routing numbers. Affiliate payouts run through PayPal using only your PayPal email.
- Social Security Numbers or tax IDs through this site. There's no W-9 upload here. When a W-9 is needed, Jen requests it by email.
3. Who we share data with
| Service | What goes there | Why | Where they're based |
|---|---|---|---|
| Cloudflare | Every request, our D1 database, R2 file storage for Pro logos, Web Analytics page-view counts | Hosting, security, database, file storage, page-view totals | US |
| Google Fonts | Your IP address and browser details when your browser loads a font | Fonts on our pages | US |
| Airtable | Affiliate applications and records, quest findings and screenshots, referral clicks, sales credited to affiliates, payouts, coupons | Our records for the affiliate program | US |
| Stripe | Build a Bio Pro checkout (your email, plan, referral code if any), affiliate coupon codes | Payments, subscriptions, sales tax | US |
| Resend | Recipient email addresses and email content | Delivering our emails | US |
n8n (our own automation server, n8n.jen8nflows.cloud) | New-signup notices (email and app name), feedback messages, error reports, coupon-code requests | Automations that email Jen and set up affiliate coupons | Self-hosted by us |
| PayPal | Your PayPal email and payout amount | Paying affiliate commissions | US |
We don't share, sell, or rent your personal information to anyone else. We don't use your data to train AI models.
Jen Built It is a one-person company, so the only person who sees your data is Jen.
4. How long we keep your data
| Category | What really happens |
|---|---|
| Cloudflare request logs | Kept by Cloudflare under its own retention rules |
| Affiliate sign-in sessions | Stop working after 30 days. Deleted 7 days after that, or right away when you delete your affiliate account |
| Affiliate sign-in links | Stop working after 15 minutes (7 days for the welcome link). Deleted 7 days after that, or right away when you delete your affiliate account |
| Build a Bio sign-in sessions | Stop working after 60 days. Deleted 7 days after that |
| Build a Bio edit links | Stop working after 15 minutes. Deleted 7 days after that |
| New-tool alerts signup | Kept. When you unsubscribe, the record is marked unsubscribed and you get no more alerts |
| Your bio, its logo, and its link click counts | Kept until you delete the bio. Deleting it removes the bio, its edit links, its click counts, and its logo (unless another of your bios still uses that logo) |
| Build a Bio Pro billing record (email, Stripe IDs, plan status) | Kept, including after you cancel or delete your bios. Stripe keeps its own payment records |
| Bio reports | Kept |
| Daily visit totals | Kept (they're totals only, with nothing about you) |
| Affiliate application and record | Kept while you're active. When you delete your account it's deleted, or, if you have sales or payouts, cut down to what tax records need (see Section 5.2) |
| Referral click logs | Kept, because they're the record of which affiliate earns a sale. Nothing deletes them on a schedule |
| Quest findings and screenshots | Kept |
| Sales credited to affiliates and payouts | Kept for tax and accounting records |
| Feedback | Kept until you ask us to delete it |
| Spam counters | Each counter (keyed by IP address or email) is deleted by a daily cleanup once its window ends |
If you want something on this list deleted that isn't deleted automatically, email privacy@jenbuiltit.com and we'll take care of it, except records we need to keep for tax and accounting.
5. Your rights
You have these rights wherever you live, and we honor them even if your local law doesn't require it.
5.1 Access (Article 15 GDPR / Cal. Civ. Code §1798.110)
You can ask for a copy of the data we hold on you. We respond within 30 days. Affiliates: use "Download my data" on your account page. Everyone else: email privacy@jenbuiltit.com.
5.2 Deletion (Article 17 GDPR / Cal. Civ. Code §1798.105)
You can ask us to delete your data.
- Your bio: delete it from My Bios. Section 4 lists what that removes.
- Your affiliate account: use "Delete my account" on your account page. That signs you out on every device, cancels any open sign-in links, unsubscribes you from new-tool alerts, switches off your referral code, and removes your name from any quest reports you sent (the reports stay with the app they're about). If you've never had a sale or payout, your affiliate record is deleted. If you have, we keep only what tax and payout records need (your name, email, PayPal email, tax form status, referral code, and your sales and payout history), delete your application answers and alert settings, and mark the record archived.
- Anything else: email
privacy@jenbuiltit.com.
5.3 Rectification (Article 16 GDPR)
You can correct any data we hold on you. Change your bio from the builder. Change your PayPal email from your affiliate account page. For anything else, email us.
5.4 Portability (Article 20 GDPR)
Affiliates can download their data as a JSON file from the account page. Anyone else can email us and we'll send it.
5.5 Objection / opt-out
- New-tool alerts: the one-click unsubscribe link in every alert.
- Affiliate program updates: the unsubscribe link in those emails, or the setting on your account page.
- Affiliate program: delete your account from your account page.
- Bio: delete it from My Bios.
5.6 Do Not Sell or Share (CPRA §1798.135)
We don't sell or share your personal information. See Do Not Sell or Share My Personal Information.
5.7 No discrimination (CPRA §1798.125)
We don't charge you more or give you worse service for using any privacy right.
6. Cookies and browser storage
Everything below is first-party (set by our own sites) and needed for the feature it sits next to. We don't set advertising or third-party cookies, and we don't need a consent banner because nothing here tracks you.
Cookies
| Cookie | What it holds and why | Lifetime |
|---|---|---|
jbi_session | Keeps you signed in to the affiliate dashboard. Unreadable by page scripts. | 30 days |
bb_session | Keeps you signed in to Build a Bio. Unreadable by page scripts. | 60 days |
bb_ref | The referral code from an affiliate's link to Build a Bio, so that affiliate gets credit if you buy Pro. | 60 days |
bb_v_landing, bb_v_builder | Today's date only, so a visit to the Build a Bio homepage or builder counts once per day. | 1 day |
Browser storage (stays on your device, we never read it on our servers)
| Key | What it holds and why | How long |
|---|---|---|
bb_draft_v1_create, bb_draft_v1_edit_<bio id> | Your unsaved bio draft, so a closed tab doesn't lose your work | Until you save, or clear your browser data |
bb_tour_seen | Remembers you've seen the Build a Bio tour | Until you clear your browser data |
bb_done (session storage) | The bio you just saved, whether it's Pro, and your email, so the next page can show it | Until you close the tab |
jbi_aff_tour_seen | Remembers you've seen the affiliate dashboard tour | Until you clear your browser data |
jbi_aff_seen_<your code> | Your sales count and earnings from your last visit, so the dashboard can celebrate a new sale | Until you clear your browser data |
bumpCelebrated (session storage) | Makes the 30% celebration play once instead of on every page | Until you close the tab |
7. Do Not Track
Some browsers can send a "Do Not Track" signal. Our sites don't use advertising or tracking tools that follow you across other websites, so they work the same whether or not your browser sends that signal. We don't let any third party collect information about your activity on our sites to track you across other sites over time.
8. Security
We use hashed sign-in tokens, signed links, parameterized database queries, per-IP and per-account rate limits, secrets kept in Cloudflare's secret store (never in code), HTTPS with HSTS, and a content security policy. See our Security policy for reporting a vulnerability.
No system is 100% secure. If a breach occurs, we'll notify affected users within 72 hours per GDPR Art. 33 and applicable US state laws.
9. International transfers
Your data may be processed in the US (Cloudflare, Google, Airtable, Resend, Stripe, PayPal) wherever you live. We rely on standard contractual clauses with these processors for EU-US transfers.
10. Children
These sites aren't meant for anyone under 18, and we don't knowingly collect personal data from them. If you believe we have, email privacy@jenbuiltit.com and we'll delete it.
11. Changes to this Policy
We may update this Policy. We'll change the "Last updated" date at the top. For material changes affecting your rights, we'll email active affiliates a summary 14 days before the change takes effect.
12. Contact
- Privacy questions and data requests:
privacy@jenbuiltit.com - Everything else:
hello@jenbuiltit.com - Mailing address: Jen Built It LLC, 10800 S Lloyd Drive, Worth, IL 60482, USA
We respond within 30 days.