Privacy Policy

Junk Drawer Journal ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains what information we collect when you use our service at thejunkdrawercollective.ca (the "Service"), how we use it, and the choices you have. Please read it carefully.

By creating an account or using the Service, you agree to the practices described in this policy. If you do not agree, please do not use the Service.

1. Information We Collect

1.1 Account & Profile Information

When you register, we collect:

• Email address and hashed password (managed by Supabase Auth)
• Display name and avatar image, if you choose to provide them
• Account creation date and last-updated timestamp
• Subscription tier (free or premium) and subscription start date

1.2 Content You Create

Your creative work is stored on our servers, including:

• Journal titles, descriptions, and page canvas data (layout, text, element positions)
• Page thumbnails generated from your canvas
• Media files you upload — photos, images, and PDFs — along with their metadata (file name, type, size, dimensions, and any capture date embedded in the file)
• Tags you apply to media items
• Media folder names and organisation

1.3 Usage & Analytics Data

We collect limited usage signals to operate and improve the Service:

• Ad impression logs (which ad placement was shown, timestamp) — used to measure ad performance and enforce premium ad-free status
• Storage consumption to enforce plan limits
• Number of PDF exports used (to enforce free-tier limits)

1.4 Payment Information

When you upgrade to Premium, payment is processed by our third-party payment provider (Stripe). We do not store your full card number, CVV, or bank details. We retain a transaction record containing: amount, currency, payment method type, provider transaction ID, and status (succeeded / failed / refunded).

1.5 Technical Information

Like most web services, our infrastructure (Supabase and Vercel) may automatically collect IP addresses, browser type, operating system, and referrer URLs in server logs for security and diagnostic purposes. We do not combine this data with your account information for profiling.

2. How We Use Your Information

• To provide the Service — storing your journals, rendering pages, and exporting PDFs.
• To manage your account — authentication, subscription status, and storage quota enforcement.
• To display advertising — free-tier users see sponsored placements. We log impressions internally; we do not sell your personal data to advertisers. If we integrate a third-party ad network (e.g., Google AdSense), their own privacy policies will apply to their data collection.
• To process payments — fulfilling Premium upgrades and issuing refunds.
• To communicate with you — account-related emails (password reset, billing receipts). We do not send marketing emails without your consent.
• To improve the Service — understanding aggregate usage patterns to prioritise features and fix bugs.
• To ensure security — detecting abuse, preventing unauthorised access, and complying with legal obligations.

3. Sharing Your Information

We do not sell your personal information. We share it only in these limited circumstances:

• Service providers — Supabase (database and file storage), Vercel (hosting), and Stripe (payments) process data on our behalf under their own privacy policies and data-processing agreements.
• Legal requirements — We may disclose information if required by law, court order, or to protect the rights and safety of our users or the public.
• Business transfers — If we merge with or are acquired by another company, your information may be transferred. We will notify you before your data is subject to a materially different privacy policy.

4. Data Retention

We retain your account data and content for as long as your account is active. If you delete your account, we will delete your personal information and media files within 30 days, except where retention is required by law (e.g., payment records, which we keep for 7 years for tax purposes).

5. Your Rights & Choices

Depending on your location, you may have the right to:

• Access — request a copy of the personal data we hold about you.
• Correction — update inaccurate or incomplete information via your account settings.
• Deletion — request deletion of your account and all associated data.
• Data portability — request an export of your journals and media.
• Withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting prior processing.
• Opt out of advertising — upgrade to Premium to remove all ads and ad impression logging.

To exercise any of these rights, email us at thejunkdrawercollective@gmail.com. We will respond within 30 days.

6. Cookies & Local Storage

We use cookies and browser local storage strictly for operating the Service:

• Authentication cookies — set by Supabase to keep you logged in. These are essential and cannot be disabled without logging you out.
• Editor state — zoom level and sidebar preferences are stored in browser memory only (Zustand) and are never sent to our servers.

We do not use third-party tracking cookies for behavioural advertising. If a third-party ad network is added in the future, we will update this policy and provide opt-out instructions.

7. Security

We use industry-standard safeguards including TLS encryption in transit, row-level security policies in our database so users can only access their own data, and hashed password storage. No system is perfectly secure; please use a strong, unique password and contact us immediately at thejunkdrawercollective@gmail.com if you suspect unauthorised access to your account.

8. Children's Privacy

The Service is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

9. International Transfers

Our infrastructure is hosted in data centres operated by Supabase and Vercel, which may be located outside your country of residence. By using the Service, you consent to your information being processed in those jurisdictions. We take steps to ensure appropriate protections are in place.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date at the top of this page and, where appropriate, notify you by email or an in-app notice. Continued use of the Service after changes become effective constitutes acceptance of the revised policy.

11. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at: