Privacy Policy
Last updated: 21 July 2026
This Privacy Policy explains how JigsawLabs ("we") handles personal data when you use jigsawlabs.tools and our web tools. JigsawLabs is operated as a sole proprietorship based in Jordan and is the data controller for the processing described here. We designed the Services to collect as little personal data as possible.
1. Your documents are not stored
This is our most important commitment: content you submit to a tool (text, documents, files) is processed in memory, only for the duration of your request, to produce your result. It is not saved to disk, not stored after the request completes, not used for analytics, and never used to train any model. If a tool ever needs to retain something (e.g., a template you choose to save), it will say so explicitly and ask you first.
For our browser-only tools such as DocForge, this guarantee is even stronger: your text and the finished document are created entirely on your own device and are never transmitted to us at all — not even in transit. Your documents stay in your browser.
2. Information we collect
- Account data — no tool requires an account today. If you previously signed in with an identity provider (e.g., Google), we hold your name, email address, and a provider account identifier. We do not receive your password.
- Contact details you submit via our contact form (name, email, message).
- Technical log data — short-lived request logs (e.g., IP address, timestamp, endpoint) used only to operate, secure, and rate-limit the Services. Logs do not include the content of your documents.
- Aggregate usage statistics — anonymous, cookieless counts such as page views and how many times a tool was used. These contain no identifiers, no personal data, and are never linked to you.
3. Purposes and legal bases
- Providing the Services (tool processing, and accounts where they exist) — performance of a contract.
- Security, abuse prevention, rate-limiting — legitimate interests.
- Responding to your enquiries — legitimate interests or steps prior to a contract.
We do not sell personal data and do not use advertising trackers. For measurement we use only privacy-first, cookieless analytics (Cloudflare Web Analytics, which builds no personal profiles and does no cross-site tracking) and our own anonymous aggregate counters — never advertising or profiling analytics.
4. Payment data
We collect no payment data: everything on the site is currently free and nothing is sold here. If we ever introduce paid features, this policy will be updated first, before any payment is taken.
5. Processors we use
We use a small number of providers to run the Services: Cloudflare (hosting, compute, and security) and Google (sign-in only, if you choose it). They process data on our behalf under their data-processing terms. We add no others without updating this page.
6. Cookies
We use only strictly necessary cookies — the ones required to provide a feature you actively asked for (signing in). We set no advertising, tracking, analytics, or profiling cookies, and we load no third-party marketing scripts. Because essential cookies are exempt from prior consent under the EU ePrivacy Directive and UK PECR, there is no cookie-consent banner; there is nothing non-essential to consent to. If we ever introduce a non-essential cookie, we will ask for your consent first, in advance.
| Cookie | Purpose | Duration | Type |
|---|---|---|---|
jl_session | Keeps you signed in after you choose to sign in with Google. HttpOnly & Secure; the page never reads it. | Up to 24 hours | Strictly necessary · first-party |
jl_oauth | Protects the sign-in redirect against cross-site request forgery. Set only during the moments you are signing in. | 10 minutes | Strictly necessary · first-party |
| Cloudflare security cookie | Our hosting provider (Cloudflare) may set a short-lived cookie to distinguish humans from bots and protect the Services from abuse. | Up to 30 minutes | Strictly necessary · provider |
For traffic measurement we use only cookieless analytics that set no cookies and build no profile. Our free browser tools and DocForge run without any cookie at all — the cookies above appear only if you sign in.
7. Data retention
- Submitted content: not retained (see section 1).
- Account data: kept while your account exists; deleted within 30 days of a deletion request.
- Contact-form messages: kept up to 24 months, then deleted.
- Technical logs: kept briefly (days, not months) for security, then deleted automatically.
8. Your rights (GDPR and similar laws)
Depending on your location, you have the right to access your personal data, correct it, delete it ("right to be forgotten"), receive a portable copy, restrict or object to certain processing, and complain to your local data-protection authority. None of these cost anything.
To exercise any right — including deleting your account and all associated data — email admin@jigsawlabs.tools from the address linked to your account. Erasing your account removes your profile records from our systems. We respond within 30 days.
9. International transfers
We are based in Jordan and our providers (Cloudflare, Google) operate globally, so your data may be processed outside your country. Where GDPR applies, transfers rely on appropriate safeguards such as the providers' Standard Contractual Clauses and equivalent mechanisms.
10. Security
All traffic is encrypted in transit (TLS). Access to account data is restricted and protected by scoped credentials. Submitted content is processed transiently and never written to permanent storage.
11. Children
The Services are not directed at children under 16, and we do not knowingly collect their data.
12. Changes
We may update this policy; changes are posted here with a new "Last updated" date.
13. Contact
Privacy questions or requests? Email admin@jigsawlabs.tools.