Privacy policy

Who this covers

This policy covers www.jackzhaojin.com and its subdomains (the website), and the apps, tools and demos I build and operate (my apps), including any that use Sign in with Google or other Google APIs. I am Jack Jin, an individual in Columbus, Ohio, in the United States. This is a personal website, not a business. In this policy, "I" and "me" mean Jack Jin, and "you" means anyone who visits the website or uses one of my apps.

Some of my apps are personal software I build and run for myself, including brain-jzj, a private assistant that prepares my own daily brief. These tools have one user: me. They are not offered to the public, and no one else can sign in to them. Others are public demos that anyone can try, such as the Google sign-in at the edge demo from my adaptTo 2026 talk. This policy says what each kind does with your information.

What this website collects

The website asks you for nothing: it has no accounts, forms or comments. It does collect the following automatically.

• Analytics. On www.jackzhaojin.com, a few seconds after a page loads, the website loads Google Analytics 4. It records the pages you view, how you arrived (such as the site that linked to the page), your device and browser type, and an approximate location derived from your IP address. Google Analytics sets first-party cookies (_ga and _ga_ followed by an ID) to tell repeat visits apart. I use it only to see which pages people read. I do not use it for advertising, and I do not combine it with other information about you. If your browser sends a Global Privacy Control signal, Google Analytics does not load at all.
• Operational telemetry. The website runs on Adobe Experience Manager Edge Delivery Services, which samples about 1 in 100 page views to check that pages load quickly and correctly: the page address, timings and similar technical events. It sets no cookies and does not identify you.
• Delivery and security logs. Cloudflare, Adobe and GitHub, which host the website and some of its project pages, receive your IP address and browser details when they deliver a page, and use them to deliver it and keep the website secure, under their own privacy policies.
• Your browser's storage. If you choose Light or Dark, the website remembers that choice in your browser (local storage, under jj-theme), and during a visit it notes that its fonts have loaded (session storage). Neither leaves your browser.
• Embedded content. Videos come from YouTube in its privacy-enhanced mode (youtube-nocookie.com). A player loads from YouTube when it comes into view or when you choose to play it, and YouTube's privacy policy then applies. One article loads fonts from Google Fonts to demonstrate them. Links to other websites lead to sites with their own policies.

Your choices

• Turn on Global Privacy Control in your browser, or in an extension that supports it. The website treats it as a decline, and Google Analytics does not load.
• Block or delete cookies in your browser settings, or install Google's Analytics opt-out browser add-on.
• Clear this website's storage in your browser at any time to remove your theme choice.

Apps that use Sign in with Google or Google APIs

When one of my apps asks for access to your Google account, Google's consent screen shows exactly what it requests, and you decide whether to allow it. My apps request only the access their features need.

Sign in with Google

A demo that uses Sign in with Google receives the basic profile Google shares when you sign in: your name, email address and profile picture, in a token Google has signed. In the Google sign-in at the edge demo, that token stays in a cookie in your browser for at most one hour. It is checked on each request to show that you are signed in, and it is cleared when you sign out. It is not stored on any server.

Personal tools with access to Google account data

With my consent, brain-jzj reads my own Google account with read-only permissions:

• Gmail (read-only): recent message headers and short snippets, and a full message only when I ask for it.
• Google Calendar (read-only): event titles, times, and places for a short window around today.

It cannot send, delete, label, or change email, and it cannot create or change calendar events.

The data is used only to prepare reminders and a daily summary for me. Account numbers, card numbers, one-time codes, and passwords are removed in code before anything else sees them. Summaries are stored in my own private repository.

How Google user data is used

• Only to provide the feature it was requested for, as shown on Google's consent screen.
• Google data is never sold, never used for advertising, and never shared with anyone else, except a service provider that helps an app do what you asked, or when the law requires it.
• It is never used to develop, improve or train generalized artificial intelligence or machine learning models.
• No person reads it unless you ask me to (for example, to help with a problem), it is needed for security or to comply with the law, or it has been aggregated and anonymized.
• To write my summary, text may be processed by the AI model provider I use (Anthropic), under that provider's terms, solely to produce output for me.

Limited Use

The use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

Sharing

I do not sell personal information, and I do not share it for advertising. Information reaches others only in these cases:

• Service providers that host or run the website and my apps: Cloudflare, Adobe, GitHub, Google (for analytics and sign-in) and the AI model provider an app uses, each only to provide its service.
• When the law requires it, or to protect the safety, rights or property of me or others.

Retention and deletion

• Analytics data is kept for the retention period set in Google Analytics, then deleted by Google.
• The sign-in demos keep nothing once their session cookie expires, after one hour at most.
• Access tokens are stored only on my own machine and in my own encrypted cloud secrets. Access can be revoked at any time from Google Account permissions, which stops all further reads.
• You can remove any app's access to your Google account at any time from your Google Account permissions. Ask me, and I will delete any data an app holds about you.

Security

I protect information with reasonable safeguards: encrypted connections, access tokens kept in encrypted storage, and the least access each app needs. No system is perfectly secure, so I cannot guarantee absolute security.

Children

The website and my apps are not directed to children under 13, and I do not knowingly collect personal information from them. If you believe a child has shared personal information with me, contact me and I will delete it.

Your rights

Depending on where you live, including the European Union, the United Kingdom and California, you may have the right to know what personal information I hold about you, to correct or delete it, to object to or limit how it is used, and to withdraw your consent. I treat a Global Privacy Control signal as a request to opt out. To make a request, contact me as below. I will respond within a reasonable time, and I will not treat you differently for asking.

Where information is processed

I am in the United States, and the providers named above may process information in the United States and other countries, under their own safeguards.

Changes

If this policy changes, I will update it here and change the date at the top. If a change affects how an app uses data you have already shared, I will say so before it applies.

Contact

Questions or requests about this policy: reach me through GitHub.