Privacy Policy

1. Who we are

JEM MEDIA LTD is a private limited company registered in England and Wales (company number 16287434). Our registered office is 195-197, Suite Ra01 Wood Street, London, United Kingdom, E17 3NU.

We are the controller of the personal data described in this policy under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. For anything about your data, email privacy@jemedia.xyz.

2. What this policy covers

This policy covers:

• our website, jemedia.xyz;
• JEMEDIA Accounts, our sign-in service at auth.jemedia.xyz. It lets you use one account to sign in to the services that support it (“connected services”);
• Verified Handles (verifiedhandles.org). Its privacy notice adds detail specific to Verified Handles;
• the emails we send you.

Each connected service has its own privacy policy explaining how it uses the data it holds. This policy covers your JEMEDIA account itself, and the information we pass to a connected service when you sign in to it.

3. Information we collect

Information you give us

• Your email address and name.
• Your profile picture, if you add one or it comes from Google.
• Your password. We store it only as a one-way hash (Argon2id), so we cannot read it.
• Passkeys: the public key, the name you give it, the type of authenticator, and when it was last used. The private key never leaves your device.
• Two-step verification: your authenticator app secret (stored encrypted) and your recovery codes (stored hashed).
• Anything you send us when you contact us.

Information from Google

If you use Sign in with Google, see Sign in with Google.

Information collected when you use JEMEDIA Accounts

• Your IP address and browser details (user agent), recorded with your sessions and with security events.
• When you sign in, and when your sessions were last active.
• A security log of account events, such as sign-ins, failed sign-ins, password and two-step verification changes, and permissions you grant.
• Short-lived counters of failed sign-ins, keyed by email address and IP address, to stop password guessing.
• The result of a CAPTCHA check on the sign-in page (Cloudflare Turnstile).

Information from your use of connected services

• Which connected services you have signed in to, and when.
• The permissions you approved for each one.
• Your membership of organisations on JEMEDIA Accounts, and your role in each.
• Which version of a service’s terms and privacy policy you accepted, when, and from which IP address and browser.
• Invitations sent to your email address, including who sent them.

Information from our email provider

Whether our emails to you were delivered, bounced, or reported as spam.

Our website

jemedia.xyz has no accounts, analytics or cookies. GitHub, which hosts it, records visitors’ IP addresses in its server logs for security.

4. Sign in with Google

When you choose Sign in with Google, Google sends us a signed token containing your Google account ID, your email address, whether Google has verified that address, your name and your profile picture. We use this only to:

• sign you in;
• create your JEMEDIA account, or link Google to your existing account;
• fill in your name and profile picture.

We do not ask for access to Gmail, Google Drive, your contacts or any other Google service. We do not receive or store Google access tokens or refresh tokens.

We store your Google account ID so we can recognise you next time, and your name and picture as part of your profile. When you sign in to a connected service, it receives your name, email address and picture only after you approve its consent screen. We never sell Google user data or use it for advertising. Our staff do not look at it except where needed for security, to comply with the law, or with your permission.

You can unlink Google in your account settings at any time, and remove our access from your Google Account at myaccount.google.com/connections. Deleting your JEMEDIA account erases your Google account ID and the profile details that came from Google.

The sign-in and registration pages load Google’s sign-in button from Google, so Google receives your IP address and may set its own cookies there, whether or not you use the button.

JEMEDIA’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. How we use information, and our lawful bases

We do not profile you, show you advertising, or make decisions about you by automated means that have legal or similarly significant effects. Where we rely on legitimate interests, you can object (see Your rights).

6. Who we share information with

• Connected services you sign in to. After you approve its consent screen, a service receives what the screen shows: an identifier for you and, depending on what it asks for, your email address and whether it is verified, your name and picture, your organisation and role, and whether you are an administrator. You can withdraw a service’s access in your account settings.
• Organisation administrators. If you join an organisation on JEMEDIA Accounts, its administrators can see your name, email address, role and membership details.
• Our service providers, listed below, who process data only on our instructions.
• Authorities and others where the law requires it, or where needed to protect the rights, safety or security of our users, us or others.
• A buyer or successor, if JEM MEDIA LTD is involved in a merger, acquisition or sale of assets. Your data would stay protected by this policy, and we would tell you.

We never sell personal data or share it for advertising. Our own access is limited to what is needed for support, security and legal reasons, and administrative actions on accounts are logged.

7. Service providers

When you choose a new password, we check it against the Have I Been Pwned list of breached passwords. Only the first five characters of a one-way hash of the password leave our servers, which cannot identify you or reveal the password.

8. International transfers

Our servers are in Germany, which the UK recognises as giving adequate protection to personal data. Some of our service providers are based in the United States or work globally. When data leaves the UK or the European Economic Area, we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, where the provider is certified), or on the Information Commissioner’s International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses. Email privacy@jemedia.xyz for details of these safeguards.

9. How long we keep information

Deleted data disappears from backups as they expire. We never restore a deleted account from a backup. For Verified Handles, see its privacy notice.

10. Cookies

JEMEDIA Accounts uses only cookies that are strictly necessary to sign you in and keep your account secure. We do not use analytics or advertising cookies, so we do not ask for cookie consent. If you block these cookies, signing in will not work.

On the sign-in page, Google’s sign-in button and Cloudflare’s CAPTCHA load from those companies, which may set their own cookies under their own policies.

jemedia.xyz sets no cookies. It remembers your light or dark theme choice in your browser’s local storage. Verified Handles lists its cookies in its privacy notice.

11. How we protect information

• Encrypted connections (HTTPS) for every service.
• Passwords stored only as Argon2id hashes, and checked against known breaches.
• Passkeys and two-step verification for your account.
• Authenticator secrets and other credentials encrypted at rest.
• Rate limits and CAPTCHA against password guessing and abuse.
• When you sign out everywhere or delete your account, connected services are told to end your sessions.

12. Your rights

Under UK data protection law, you have the right to:

• get a copy of your personal data;
• have inaccurate data corrected;
• have your data erased;
• restrict how we use your data;
• receive your data in a portable, machine-readable format;
• object to our use of your data where we rely on legitimate interests;
• withdraw consent, where we rely on it.

You can do most of this yourself:

• Download your data: auth.jemedia.xyz/account/export
• Correct your details, unlink Google, or withdraw a connected service’s access: auth.jemedia.xyz/account
• Delete your account: auth.jemedia.xyz/account/delete (see Deleting your account)

For anything else, email privacy@jemedia.xyz from the address on your account. We may need to confirm your identity. We reply within one month, or tell you within that month if a complex request needs up to two more months. It is free.

If you are unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint/ or on 0303 123 1113.

13. Deleting your account

You can delete your JEMEDIA account at auth.jemedia.xyz/account/delete. Step-by-step instructions, and what to do if you can no longer sign in, are at jemedia.xyz/accounts/delete.

When you delete your account:

• you are signed out everywhere, and connected services are told to end your sessions;
• we erase your profile, sign-in methods (password, passkeys, two-step verification and Google link), organisation memberships, permissions you granted and records of the terms you accepted;
• your email address is freed, so it can be used again.

We keep a placeholder record with no email address, name, picture or password, so that other records stay consistent. Security logs are kept for up to 1 year and backups expire within 1 year, as described in How long we keep information. Deletion is permanent and cannot be undone.

Connected services hold their own data about you, which deleting your JEMEDIA account does not remove. The deletion page lists the services you have used, with links to delete your data from each. This includes Verified Handles, where you can delete your data at verifiedhandles.org/management-console/account. Do this first, because you need your JEMEDIA account to sign in there.

If an organisation you belong to requires its administrators to approve deletions, your request is completed automatically within 30 days if they do not act sooner.

14. Emails

We send only emails connected to your account or to something you asked for. We do not send marketing. Our emails include:

• email address verification and sign-in links;
• password resets;
• invitations to join an organisation, and reminders;
• a welcome email;
• security alerts, such as when a recovery code is used or, where an organisation turns it on, when someone signs in to your account (these include the device and IP address);
• confirmation that your account has been deleted;
• updates on your Verified Handles applications.

Emails are sent through Amazon SES. If an email to you bounces permanently or is reported as spam, we stop sending to that address. You cannot turn off essential account, security and invitation emails. JEMEDIA Accounts sends no optional emails. Optional notifications from other services, such as Verified Handles application updates, can be turned off in that service’s settings or with the unsubscribe option in your email app.

15. Children

You must be at least 13 to create a JEMEDIA account. If you are under 18, please check with a parent or guardian first. We do not knowingly collect data from children under 13. If we learn that an account belongs to someone under 13, we will delete it. Parents or guardians can contact privacy@jemedia.xyz.

16. Changes to this policy

The date at the top shows when this version took effect. If we make material changes, we will tell you by email before they take effect, and may also ask you to accept them when you next sign in. Previous versions are listed in the version history below.

17. Contact us

Data protection questions and requests: privacy@jemedia.xyz

Anything else: support@jemedia.xyz

Post: JEM MEDIA LTD, 195-197, Suite Ra01 Wood Street, London, United Kingdom, E17 3NU

Version history

• 7 October 2026 (current): First version.