Legal
Privacy Policy
What we collect, why, and for how long. In brief: your email address, which you sign in with, and a record of who did what, which is your workspace's audit log. We use nothing for advertising.
1. Who this covers
This policy says how Jia Yang Inc., trading as Jiayang Cloud, handles personal data when you visit jiayang.cloud, sign in to the dashboard at app.jiayang.cloud, use the CLI or the API, or open an app someone has shared with you on jiayang-apps.cloud.
For the account data described below, we are the controller. For the data inside our customers' apps, such as what an app stores about the people who use it, the customer who deployed the app is the controller, and we are their processor under the Data Processing Addendum. If you have a question about an app's data, ask the app's owner. The dashboard shows their email address to everyone the app is shared with.
2. What we collect
Account
- Your email address. It is your identity on the platform: how you sign in, how apps are shared with you, and how you appear in audit logs. We don't collect a name unless you write one to us.
- Terms acceptance. Which version of the terms you accepted, and when.
Sign-in and sessions
- For every sign-in code we send and every session we create: the time, the IP address, the browser or CLI user agent, and the country the request came from, as Cloudflare reports it. A browser session lasts 12 hours and a CLI session 30 days, and neither can be extended. You can see your active sessions in the dashboard and revoke any of them.
- Sign-in codes themselves are stored hashed, expire after ten minutes, and are deleted after use.
- If you add a passkey: its public key, an ID for it, the name you give it, the browser that added it, whether it can be synced to your other devices, and when it was added and last used. The private key stays on your device or in your password manager. We never receive your fingerprint, face or PIN.
Workspaces and apps
- Workspace names and members.
- App names, addresses and versions.
- Each app's environment variables, names and values, which anyone who can edit the app can read.
- The names of secrets and where each is sent. A secret's value is encrypted and never shown back to a person.
- An app's public paths, and which provider signs the deliveries to each path that has a webhook verifier. The verifier's signing secret is encrypted and never shown back to a person.
- Bearer token names and when each was last used. The token itself is stored hashed.
- Which hosts each app sends requests to, how many each hour, and how many were refused for not being on the app's list of hosts. We count the host only, never the path, the headers or the body, and keep the counts for 90 days.
- A workspace's key for an AI provider (Anthropic, OpenAI, Gemini, Mistral, Groq, Cohere, Azure OpenAI or Amazon Bedrock), if an owner stores one, encrypted and never shown back to a person, the Azure resource or AWS region an Azure or Bedrock key is for, and what each app granted it has spent each month. Requests your apps send to those providers with the key pass through our outbound proxy. It reads only the usage counts in the provider's answer, to count the cost against the app's budget, and does not store the prompts, the answers or anything else in them.
- The lines your apps write to their logs, which Cloudflare keeps for us. Only the people who can change an app, and the workspace's owners and admins, can read them. If someone who can share an app sets up a log drain for it, we send its lines to the destination they chose, and hold them only until they are sent.
- The code and files you deploy, and the data your apps store, which we host on your instructions and do not read, except to look into a report of abuse or infringement about an app.
Audit log
- Every action on a workspace, such as a deploy, a share, a token or a change of settings, with who did it and when.
- Every request to an app: the time, the app, the path and method, the response status, and who the caller was. The caller is recorded as an email address, a token's id, or the webhook provider for a delivery whose signature the platform checked, with the identifier the provider gives that delivery where it gives one. Any other request to a public path is recorded with no caller. We also keep the IP address each request came from. The audit log the workspace sees doesn't show it. This is the audit log the workspace's owners and admins can see, and it is why the platform exists. From the same entries we count, for each person, app and day, how many visits and requests they made. The workspace's owners and admins see these counts as usage insights, and so do members the workspace gives a role that can view its audit log. An app's owners see that app's counts for the last 30 days, including who opened it and how often. The counts hold no address, path or device.
Usage
- For each app, by hour: its requests, the CPU time its code used, and the rows its database read and wrote, which Cloudflare reports to us. To measure CPU time, we briefly receive Cloudflare's record of each request to your Worker apps. It includes the request's headers, its address and your app's logs. Of that record, we keep only the CPU time and which app it was, and store and log nothing else from it.
Billing
- If a workspace is on a paid plan, we create a customer for it at Stripe, with the workspace owner's email address as the customer's email and the workspace's name as the customer's name. When someone pays at Stripe's checkout, the billing name they enter there replaces the workspace's name on the customer, so the invoices carry the name they gave, such as a business's own next to its tax ID. Stripe also collects your billing address, card details and tax information, including a VAT, GST or tax ID if you enter one. We never see the card number. We keep Stripe's customer and subscription identifiers, the plan, its status and the dates of the current billing month. We also keep the hourly counts we report to Stripe of requests, CPU time, database rows and database storage over the plan's limit. The allowances, and the charges past them, are worked out from those counts. Stripe issues and keeps the invoices. We keep a copy of each one's number, status, amounts, dates and its address at Stripe, so the Billing tab of an Enterprise contract can list them and our staff can see what was billed.
Support
- Emails you send us, and what we need to answer them.
- Copyright notices and counter-notices, and the contact details in them.
Status page updates
- If you subscribe to email updates from the status page, which needs no account: the email address you give, and whether you have confirmed it. For a day, a keyed one-way hash of that address and of the IP address the request came from, so we can limit how often anyone asks.
The website
- jiayang.cloud itself sets no cookies and runs no analytics. Cloudflare, which serves it, keeps standard access logs for a short time for security and operations. Everything the pages load, the typefaces included, comes from jiayang.cloud itself.
- Most of our emails show a small picture of Yun, our mascot, which your email app loads from jiayang.cloud. It is the same picture at the same address in every email of its kind, with nothing in the address that names you or the email. Cloudflare's access logs note the request like any other, and we don't use it to tell whether, or which, email you opened.
We don't buy data about you, add to your profile from other sources, or track you across other sites.
3. Why, and on what basis
| Purpose | Data | Basis (GDPR) |
|---|---|---|
| Signing you in, and keeping your account yours | Email, sign-in metadata, sessions | Performance of the contract; our legitimate interest in preventing account takeover |
| Running the platform: deploying, serving and sharing apps | Workspace and app data, your content | Performance of the contract |
| The audit log: showing a workspace's owners and admins who did what | Audit events, request logs | Performance of the contract; the customer's legitimate interest in knowing who used their apps |
| Usage insights: showing a workspace's owners and admins, members whose role can view the audit log, and each app's owners for their own app, who opens which app, and how often | Counts of visits and requests per person, app and day, made from the audit log | Performance of the contract; the customer's legitimate interest in knowing how its apps are used |
| Billing and tax | Billing records | Performance of the contract; legal obligation under tax and accounting law |
| Emailing people who subscribed to the status page when we post an incident or schedule maintenance | The subscriber's email address | Consent: you confirm by opening the link we email you, and you can withdraw it from any of the emails |
| Answering you | Support emails | Performance of the contract; legitimate interest |
| Security: detecting abuse, attacks and fraud, and reporting illegal content | Sign-in metadata, request logs, account details | Legitimate interest in keeping the Service and its customers safe; legal obligation |
| Handling copyright notices and counter-notices | The notice or counter-notice and the contact details in it | Legitimate interest in keeping the protection US copyright law gives hosts; legal obligation |
| Telling a workspace's owners what is happening to it: a payment failing, the move to Free that follows, the Free request allowance running out, a suspension, audit-log entries about to be deleted | Owners' email addresses; the workspace's plan, billing status and request counts | Performance of the contract |
| Telling a workspace's owners that it was deleted, deleted for good or restored, and by whom, and telling you that your account was deleted and what became of the workspaces you owned | Owners' email addresses, the workspace's name and short name, the email address of the owner who made the change, and the names of the workspaces you owned | Performance of the contract |
| Measuring and billing usage: requests, CPU time and database rows | Usage counts per app and hour; Cloudflare's record of each request to a Worker app, received briefly and not stored | Performance of the contract |
| Telling a workspace's owners about its usage: allowances, usage charges, the usage limit, an invoice during the billing month that failed, a credit | Owners' email addresses; the workspace's plan and usage counts | Performance of the contract |
| Telling you about changes to the Service, the terms or the prices | Performance of the contract; legal obligation |
We don't use your data for advertising, we don't send marketing email, and we don't make automated decisions about you that have legal or similarly significant effects.
4. Cookies
The dashboard and the apps use four cookies, and all of them exist only to sign you in. None is used for tracking, and there are no third-party cookies.
| Cookie | Set by | What it does | Lasts |
|---|---|---|---|
__Host-jiayang_session | app.jiayang.cloud, and each app's own address once you open it | Your signed-in session. We sign it, and the platform checks the signature on every request. | 12 hours, or until you sign out or revoke it |
__Host-jiayang_state | An app's address, during sign-in | Ties the redirect back from the dashboard to the browser that started it, so a sign-in link can't be replayed elsewhere. | Minutes. It is deleted once the sign-in completes |
__Host-jiayang_signed_in | app.jiayang.cloud, with your session | Holds only the number 1, so the dashboard's page can tell you are signed in without asking our servers. It says nothing about who you are and lets nobody in. | As long as your session. It is deleted when you sign out |
__Host-jiayang_oauth | app.jiayang.cloud, when you start signing in with an account at another provider | Ties the provider's answer to the browser that started the sign-in, so it can't be used from anywhere else. | 10 minutes at most. It is deleted once the sign-in completes or fails |
These cookies are strictly necessary to provide the service you asked for, so they need no consent banner. The website at jiayang.cloud sets none. Apps deployed by our customers may set their own cookies, and those are the app owner's responsibility.
5. Who we share it with
We share personal data only with:
- Our subprocessors: the providers that host the platform, store data, send and hold email, and take payment. The current list, with what each does and where, is on the Subprocessors page. Each is bound by a contract that limits what it may do with the data. We tell workspace owners 30 days before adding one.
- The people in your workspace. Your email address is visible to the other members of a workspace you belong to. If an app is shared with you, your email address is on its access list, which everyone in the app's workspace who can open the app can see. Your actions in a workspace and its apps are visible to that workspace's owners and admins, in the audit log. That is what the product does.
- Our own staff. A small number of Jiayang Cloud staff can see account information to run the service and help customers: your workspace's name, plan, billing status and usage totals, its members' email addresses and when they last signed in, and the names of its apps. They can't see your apps' code, data, logs, secrets or anything your apps store, and they can't sign in as you. Every time staff look up or change a workspace, we record who did it, when and why, and we keep that record for seven years. Changes staff make to your workspace also appear in its own audit log. To report on how the service is used, we keep daily totals per workspace (counts and sums, not content) under the workspace's ID; these stay after a workspace is deleted, but no longer name it or anyone in it.
- Authorities, in two cases. The first is when a law, a court order or a binding request obliges us to, and then only as far as it does. The second is when we report illegal content on the Service. That includes reporting child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC), as US law requires, with the account and app details the report needs. We may also report other illegal content on the Service to law enforcement, with the details they need to act on it. Where we are allowed to, and it puts no one at risk, we tell the affected customer first.
- The other side of a copyright complaint. If you send us a copyright notice, we send a copy, with your contact details, to the owners of the workspace it is about. If you send a counter-notice, we send a copy, with your name, address and phone number, to the person who sent the notice. The terms describe the process.
- A successor, if the business is sold or merged. The successor takes over this policy, and you are told.
We don't sell personal data, and we don't share it with advertisers or data brokers.
6. Where it is processed
The platform runs on Cloudflare's global network, so a request is handled at the Cloudflare location nearest the person making it. Stored data lives in the United States: account data and most audit-log entries older than 30 days with Cloudflare, the control-plane database with Neon in AWS us-east-2 (Ohio), and billing with Stripe. The exception is email you send us, which Proton holds in Switzerland, Germany or Norway. The platform's email, meaning sign-in codes, invitations, notices to workspace owners and status page updates, is sent through Resend from eu-west-1 (Ireland). The Subprocessors page has the detail.
Where data about people in the European Economic Area, the United Kingdom or Switzerland goes to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses and the UK Addendum, agreed with each provider, together with the safeguards in section 9. You can ask us for a copy of the clauses we have in place.
7. How long we keep it
| Data | Kept |
|---|---|
| Account (email, terms acceptance) | Until you delete your account, then removed within 30 days |
| Sign-in codes | 10 minutes, or until used. The record that one was sent stays an hour longer, for rate limiting |
| Browser sessions and their metadata | Until they expire after 12 hours, or are revoked. The record of the session is kept for 30 days after it ends, for security |
| Passkeys | Until you remove them or delete your account |
| CLI sessions and their metadata | Until they expire after 30 days, or are revoked. The record of the session is kept for 90 days after it ends, for security |
| Apps and your content (code, files, databases, containers) | Until the app or the workspace is deleted. We may keep a deleted app or workspace for up to 30 days so that it can be restored, and then delete it for good. Deleted for good, it is removed from Cloudflare at once. That is permanent, and nothing is restorable |
| The control plane's records of a deleted app | Its configuration, versions, sharing grants, secrets and environment variables are kept with the app while it can be restored, and removed when it is deleted for good. Its tokens are revoked at once. Its entries in the workspace's audit log, including the one that records the deletion, stay there. The workspace's owners and admins can still see them, and its owners can export them. They are deleted with the rest of the log, as below |
| The emails about a deleted or restored workspace, or a deleted account, while they wait to be sent | The email address, the workspace's name and who made the change until the email is sent, or until we stop trying after 3 days. Then only a one-way hash of the address and of who made the change, so nobody gets the same email twice or too many in a day, removed 30 days after the change. Once you delete your account, your address is taken out of the ones still waiting |
| The control plane's records of a deleted workspace (names, members, configuration, billing status) | 30 days after the deletion, then removed. While the workspace can be restored they come back with it. Once it is deleted for good they are kept only for accounting, and can't be restored |
| Audit log | 3 months on Free and Team, 12 months on Business and Enterprise, measured from the event, then deleted within two days. Most entries older than 30 days are kept in Cloudflare R2 object storage in the United States, encrypted with a key that belongs to the workspace, and are shown, exported and deleted like the rest. After any change of plan, events older than the new plan's retention are deleted 30 days after the plan changed. A deleted workspace's log goes with its other records, 30 days after the deletion. A workspace owner can export it on every plan |
| Usage insights | As long as the audit log they are counted from, as above. An app's counts go when it is deleted for good |
| App logs: what your apps print, the exceptions they throw and a container's output | Kept by Cloudflare for 7 days, then deleted. They can be read back for 1 day on Free and 7 days on Team, Business and Enterprise |
| Log lines waiting to go to a log drain | Deleted once the destination takes them. A batch that fails for a day is kept up to 7 days so it can be sent again, then deleted |
| A hash of a webhook delivery's signature, on a verified public path, so a replayed copy can be refused | Deleted within an hour |
| Usage counts | While the workspace exists. They go with its other records |
| Billing records | 7 years after the transaction, as tax and accounting law requires. Stripe keeps its own records under its policy |
| Support email | 2 years after the last message in the thread |
| Status page subscriptions | Until you unsubscribe, when we delete the address. An address never confirmed is deleted 48 hours after we sent the link to confirm it. The hashes kept to limit asks are deleted after a day |
| Copyright notices and counter-notices | 3 years after the last notice about the same account, so that we can tell a repeat infringer |
| Security and access logs at the edge | Up to 30 days |
| Our own record of account and workspace events: terms accepted, an account or workspace deleted, a workspace suspended | 7 years, like billing records. Once you delete your account, your email address in these records, and in our log of your sign-ins and sessions, is replaced by a one-way hash of it |
| Backups of the control-plane database | Neon's point-in-time restore, on the plan we run: up to 7 days of history (Launch plan, neon.com/pricing, checked 22 September 2026). A deletion is gone from it within that time. The restore history is for disaster recovery, and is never used to restore a deleted workspace or app |
| Point-in-time history of each app's database | A Workers app's database is Cloudflare D1, which keeps a point-in-time history of the last 30 days (Time Travel, on the Workers Paid plan we run: developers.cloudflare.com/d1/reference/time-travel, checked 23 September 2026). Cloudflare maintains it, it is always on and it cannot be switched off, so a row an app deletes or overwrites stays in that history for up to 30 days. A workspace owner can put the database back as it was at a moment in that history. Nothing else restores from it |
Where a legal hold, a dispute or an investigation requires it, we keep the relevant data for as long as that requires, and no longer. A report to NCMEC, and what it covers, is kept for one year after we make it, as US law requires.
8. Your rights, and how to use them
Wherever you are, you can ask us what we hold about you, and ask us to correct or delete it. If you are in the EEA, the UK, Switzerland or another place with similar law, you also have the rights to restrict or object to processing, to data portability, and to complain to your supervisory authority. You can do most of this yourself, straight away, in the dashboard:
- Access and portability. On every plan, a workspace owner can export the workspace as one JSON document from the workspace's Settings. It holds the workspace's configuration, members, sharing grants, the names of its tokens, secrets and environment variables, and the audit log the plan retains. Each app's database can be exported on its own, as SQL, from the dashboard or with
jiayang db export. A static site is the files you uploaded. Your sessions are listed in the account menu. - Correction. Your email address is your identity, so it can't be edited in place. Sign in with the new address and move your workspaces across, or ask us.
- Erasure. Delete an app from its page, or a workspace from its Settings, with a typed confirmation. We may keep a deleted app or workspace for up to 30 days so that it can be restored. To erase it at once, delete it for good: the dashboard offers that for a deleted app or workspace it keeps, and the CLI has
jiayang app delete --for-good. Deletion for good is immediate and permanent. The app's data is removed from Cloudflare right away, and its records with it, except its entries in the workspace's audit log, which stay for the log's retention. Only the control plane's records of a deleted workspace linger, for 30 days for accounting, and they are never restorable, so export first. Deleting a workspace on a paid plan cancels its subscription at once, with no refund for the rest of the billing month. Delete your account from the account menu. Deleting it is refused while you are the sole owner of a workspace or of an app, and while the law requires us to keep the data of a workspace you are in, of one that shares an app with you, or of one you left or lost access to while we had to keep its data. While the law requires us to keep a workspace's data, as above, it and its apps can't be deleted. - Objection and restriction. Email us. The audit log is kept in the interest of the workspace whose apps you used. We will weigh your objection against that interest, and tell you what we decided and why.
For anything you can't do yourself, write to privacy@jiayang.cloud from the address on your account. We answer within 30 days. We don't charge for it unless a request is plainly unfounded or repetitive.
If you are unhappy with our answer, you can complain to the data protection authority where you live. We would rather you told us first.
9. Security
The Security page says how the platform is built to protect your data: every app behind one door, signed identity on every request, row-level isolation between workspaces, secrets encrypted with a platform key, and revocation within a minute. Data is encrypted in transit, and the providers that store it encrypt it at rest. Our staff's access to production is limited to what operating the service needs, and is logged.
If we learn of a breach affecting your personal data, we tell you without undue delay, and the affected workspace owners within 72 hours of confirming it, with what we know and what we are doing about it.
10. Children
The Service is for businesses and professional use, and is not directed at children. We don't knowingly collect data about anyone under 18. If you think we have, tell us and we will delete it.
11. Changes
When this policy changes in a way that affects you, we email workspace owners at least 30 days before it takes effect, and the date at the top changes. Clarifications take effect when published. Earlier versions are available on request.
12. Contact
Privacy questions and requests: privacy@jiayang.cloud. Everything else: support@jiayang.cloud, or by post to the address above.