Jaybit Logo
jayb.it bit by bit
Home Jaybit Copy Beta Portal Terms
EN PL

Privacy & Data Protection Policy

Last Updated: September 2, 2026 (for Jaybit Copy v1.0.0-beta.2+)

🛡️ Three Core Privacy Principles of Jaybit

1. Jaybit Copy is a 100% local application: All operations (media scanning, copying, on-the-fly BLAKE3 cryptographic verification, and history) run entirely on your local machine. Your file contents never leave your device.

2. No analytics or profiling: The app does not track your behavior, does not profile you and sends no marketing data. It collects anonymous crash reports and transfer summaries only (§ 4), and attaches a persistent installation identifier only with your consent — both can be turned off in Settings.

3. Strict network transparency: The app connects to the network exclusively across 5 precisely defined technical scenarios (§ 3).

§ 1. Data Controller

The Data Controller under Regulation (EU) 2016/679 (GDPR) is the creator of the jayb.it website and Jaybit Copy desktop software (Marcin Sojka, Apple Developer ID: Marcin Sojka (T6N8N6Z44H)).

For any privacy inquiries or to exercise your GDPR rights, contact us at:

  • General inquiries & website: contact@jayb.it
  • Jaybit Copy desktop app & technical feedback: copy@jayb.it

§ 2. Overarching Principle: 100% Local Data (Zero-Cloud)

Jaybit Copy is engineered strictly according to Privacy by Design and Privacy by Default principles:

  • Local Data Storage: The SQLite database (jaybit.sqlite), import profiles, job history, and logs reside exclusively in your local application directory (on macOS: ~/Library/Application Support/it.jayb.copy/).
  • Zero Webview Network Access: The UI layer (WebView) enforces a strict Content Security Policy (connect-src 'self'), technically preventing any front-end scripts from communicating with external servers.
  • Local Metadata Parsing (EXIF, ID3, MP4): Camera models, shooting dates, and media tags are parsed in volatile RAM purely for folder organization and deduplication. No metadata is uploaded to any cloud.
  • File Paths: Local paths stored in your local SQLite database may reflect your macOS user account name (e.g., /Users/name/...). These records remain strictly on your local disk.

§ 3. Network Communication

Jaybit Copy communicates with the jayb.it server strictly over encrypted HTTPS protocols across the following 5 scenarios:

Scenario Endpoint & Protocol Transmitted Data Legal Basis & User Control
1. Checking for updates GET https://jayb.it/api/update.php Installed version, platform (e.g. darwin-aarch64), language (en/pl), release channel (beta/stable). Zero user identifiers. Art. 6(1)(f) GDPR (Legitimate interest — software security and integrity).
Can be disabled in: Settings → General.
2. Beta build validity check (Kill-Switch) GET https://jayb.it/copy/beta/version-status.json No payload data (fetches static JSON file). Applies strictly to pre-release beta builds. Art. 6(1)(f) GDPR (Legitimate interest — safeguarding beta testing program from outdated builds).
3. Diagnostic Feedback & Error Report POST https://jayb.it/api/report.php OS/App version header, user-written description, error trace, and optional user-selected screenshots. Art. 6(1)(a) GDPR (Explicit User Consent).
Triggered ONLY upon deliberate user action with full preview displayed prior to submission.
4. Activity heartbeat (Dataset B) POST https://jayb.it/api/heartbeat.php Installation identifier (UUID), app version, OS name and CPU architecture. Zero personal data (details in § 4). Art. 6(1)(a) GDPR + ePrivacy (Dataset B consent).
Can be disabled in: Settings → Diagnostics.
5. Crash reports and transfer metrics POST https://jayb.it/api/telemetry.php Dataset A (default): anonymous crash trace, duration, volume and transfer speed (no UUID, no OS version). Dataset B (with consent): attaches UUID and OS version (details in § 4). Dataset A: Art. 6(1)(f) GDPR (Legitimate interest).
Dataset B: Art. 6(1)(a) GDPR (Consent).
Can be disabled in: Settings → Diagnostics.

§ 4. Technical Telemetry & Diagnostics (Two Data Tiers)

To maintain copy reliability and swiftly diagnose fatal crashes, the application uses a dual-tier telemetry model strictly separating anonymous metrics from pseudonymous installation data:

1. Dataset A — Default Technical Diagnostics (Anonymous Data)

Comprises solely technical crash reports (panics, UI errors) and aggregated job metrics (transfer speed in MB/s, duration, file count, total bytes, generic source/destination device type).

  • No identifier: In Dataset A, the installation_id field is completely absent.
  • No OS version: The os_version field is excluded to eliminate unique device fingerprinting.
  • Legal basis: Art. 6(1)(f) GDPR (Legitimate interest in maintaining software reliability and safety).

2. Dataset B — Extended Telemetry (Strictly With Informed Consent)

If you grant voluntary consent on the welcome screen or in Settings, reports include a random pseudonymous installation ID (UUID) and transmit a periodic 24-hour heartbeat with macOS version and CPU architecture.

  • Legal basis: Voluntary consent (Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy Directive).
  • Default state: Disabled by default. The installation identifier is never generated without consent.

⛔ What We Never Collect:

The app never collects or uploads: contents of copied files, file names, full local disk paths (stack traces are automatically scrubbed of usernames and home directories), license keys, or personal contact info. IP addresses in telemetry endpoints are automatically masked (last octet zeroed out).

Data Retention

All telemetry records (heartbeats, crash dumps, job events) are retained in our database for a maximum rolling window of 90 days, after which they are permanently and irreversibly purged.

How to Opt-Out

You can revoke consent and disable telemetry at any time inside the app: navigate to Settings → Diagnostics and toggle off „Anonymous Telemetry”. Once disabled, zero telemetry network requests are made.

Data Erasure Procedure (Right to be Forgotten)

Users in Dataset B (with an active installation identifier) possess the right to permanently purge all associated telemetry records across all server tables. Due to the persistent nature of the device identifier, the erasure procedure requires the following steps:

  1. Step 1: First, disable telemetry in the app under Settings → Diagnostics (this prevents a subsequent heartbeat from recreating records with the same ID).
  2. Step 2: Copy your Installation ID (found in Settings → Diagnostics using the "Copy" button).
  3. Step 3: Send an email to copy@jayb.it with the subject "GDPR: Telemetry Erasure" and your Installation ID.

Your request will be fulfilled within 30 days (pursuant to Art. 12(3) GDPR) and includes total removal across all telemetry tables (installations, crashes, job metrics).

§ 5. What Jaybit Copy and jayb.it Do NOT Do

  • No Third-Party Trackers: Zero third-party analytics SDKs (no Google Analytics, Firebase, Sentry, Mixpanel, etc.).
  • No Mandatory Accounts: Using the desktop app requires no account, email, or registration.
  • Zero Cloud File Tracking: Your photos, videos, media files, and document contents remain strictly on your local machine.
  • No Data Selling: We never sell, rent, or monetize your data with third parties.

§ 6. Website Newsletter Data Processing (Double Opt-in)

If you voluntarily sign up for notifications from the Jaybit workshop on the website:

  • Collected Data: Email address, optional greeting/name, submission timestamp, Double Opt-in confirmation timestamp, anonymized IP address, preferred interface language, and two-letter country code (e.g. PL, US, DE) determined at country level upon submission.
  • Purpose: Delivering notifications regarding new software tools, hobby projects, and updates in the appropriate language and optimal delivery time zone.
  • Legal Basis: Voluntary consent confirmed via Double Opt-in (Art. 6(1)(a) GDPR) and legitimate interest in language and time-zone optimization (Art. 6(1)(f) GDPR).
  • Retention: Retained until you unsubscribe (available anytime via the 1-click link in the footer of every email).

§ 7. Data Recipients & Hosting Infrastructure

The website and API infrastructure are hosted on European cloud infrastructure (OVHcloud) within the European Economic Area (France / Poland). No data is transferred outside the EEA.

§ 8. Your GDPR Rights

You have full statutory rights under the GDPR:

  • Right of access and copy of your personal data,
  • Right to rectification (correction),
  • Right to erasure ("right to be forgotten"),
  • Right to restriction of processing,
  • Right to object to processing,
  • Right to withdraw consent at any time,
  • Right to lodge a complaint with a data protection supervisory authority (PUODO in Poland or your local EU supervisory authority).

To exercise your rights, email us at: copy@jayb.it.

§ 9. Cookie Policy & Local Storage

The jayb.it website follows strict data minimization principles:

  • Local Storage: Used exclusively to persist your language preference (jaybit_lang).
  • Technical Session Cookies: Used strictly for securing administrative panel sessions.