# Privacy Policy

> AI agents: start with [Judt's llms.txt](https://judt.ai/llms.txt). llms.txt explains what Judt is, links every page of this site, and describes what you can do with Judt, including how to get access for your user.

Effective October 19, 2026.

## What you most need to know

- We collect what we need to run Judt: your account, the Apps you build, and logs that keep them working. [More](https://judt.ai/privacy#collect)
- We don’t sell your personal information, and we don’t use it for advertising. [More](https://judt.ai/privacy#use)
- When you use the Judt agent, we send your request and the parts of your App it needs to AI companies. Neither they nor we train AI models on it. [More](https://judt.ai/privacy#ai)
- Everyone in your Judt organization can see its Apps, logs and agent conversations. [More](https://judt.ai/privacy#share)
- If your App collects information from its own users, you’re responsible for telling them how you use it. [More](https://judt.ai/privacy#apps)
- You can delete your account yourself, on your Account page. You can also ask us for a copy of your personal information, or to correct it. [More](https://judt.ai/privacy#rights)

## Who we are and what this policy covers

**This policy covers the Judt website, the Judt product and messages you send us. Judt is based in Millbrae, California.**

Judt hosts Apps for you and your agents. Each App has a sandbox, which is a private computer where its source lives and its dev server runs. Each App also has a production version that you publish to the web.

You and your agents work with Judt through the dashboard at judt.ai, the API at api.judt.ai, the MCP server, the `judt` CLI and the Judt agent. This policy covers all of them, our website, and anything you send us.

**Words we use in this policy:**

- **“Personal information”** means information that identifies you or could reasonably be linked to you, such as your name, email address or IP address.
- **“Your content”** means everything you or your agents put into Judt: App source files, commits, Secrets, App data and agent conversations.
- **“Your organization”** means the Judt organization your account belongs to. Everyone in it is a **member**.
- **“Service providers”** means the companies that help us run Judt, listed under [who we share it with](https://judt.ai/privacy#share).
- **“We”** and **“Judt”** mean the company that runs Judt. **“You”** means anyone who visits our website or uses Judt.

**How to read our promises.** “We do” and “we don’t” describe what we always do. “You can” describes a right or choice you have. “May” means something can happen, not that it will.

**Our two roles.** For your account, your billing and our website, we decide how personal information is used. Privacy laws call this being the “controller” (or the “business” in California).

For your content, including information your Apps collect about their own users, we only follow your instructions. Privacy laws call this being a “processor” (or a “service provider” in California).

## What do we collect?

**We collect what you give us, such as your account details and your content, and some information automatically, such as your IP address and logs.**

**Information you give us:**

- **Your account:** your name, email address and password. We store your password only in a scrambled form (a one-way hash) that no one can turn back into the password.
- **Sign-in with GitHub or Google:** if you sign in this way, that company tells us your name, email address, profile picture and account ID. We never see your password for it.
- **Your organization:** which organization you belong to, its members and their roles.
- **Billing:** your plan and billing history. Our payment company, Stripe, collects your card details directly. We never see or store your full card number.
- **Your content:** your Apps’ source files, commits, Secrets, settings and domains; data your Apps store; and your conversations with the Judt agent. Conversations include your messages, the agent’s replies, and the commands it runs and their output.
- **Messages to us:** what you send through our contact form (your name, which is optional, your email address and your message). This also covers feedback you or your agents send through the API or MCP, and support emails.

**Information we collect automatically:**

- **Sign-ins:** the IP address and browser for each sign-in, so we can spot sign-ins that aren’t yours. An IP address is the number that identifies your device’s internet connection.
- **Service logs:** a record of each request to our website and API. It includes the IP address, the time, the page or endpoint, our response and any error. We also record account events, such as sign-ups and password changes.
- **App logs and telemetry:** records of what your Apps do, from their sandboxes and production versions. This includes your App’s own log messages and a history of previews, commands, commits and deployments.
- **Usage:** how much of Judt you use, such as the number of Apps, sandbox time and AI usage. We use this to apply limits and bill correctly.
- **Connected agents and apps:** the API tokens you create, the agents and apps you allow to use your account (through OAuth), and which of them made each request.

We don’t ask for sensitive personal information, such as health data, precise location or government ID numbers. Please don’t put it in messages to us. If your Apps handle it, see [people who use your Apps](https://judt.ai/privacy#apps).

## How do we use it?

**We use personal information to run Judt, keep it safe, improve it, talk to you, bill you and follow the law. We never sell it or use it for advertising.**

- **To run Judt:** create your account, start sandboxes, build and publish your Apps, run the Judt agent, show you your logs and manage your organization.
- **To keep Judt safe:** detect and stop abuse, spam, attacks and sign-ins that aren’t yours; limit how fast requests can be made; and investigate problems.
- **To fix and improve Judt:** we read error reports and service logs to find bugs. We use feedback and totals across everyone who uses Judt (for example, how often deployments fail) to decide what to build next.
- **To talk to you:** we send account emails, such as email checks, password resets and security notices. We also reply to your messages and tell you about changes to Judt or this policy.
- **To bill you:** manage your plan, take payments through Stripe and keep the records that tax law requires.
- **To follow the law:** answer valid legal requests, enforce our terms and protect people’s rights and safety.

We don’t sell your personal information. We don’t use it for targeted advertising or build profiles of you for anyone else.

If we ever send product news, every email will have an unsubscribe link. Before we use personal information for a new purpose, we’ll update this policy and, where the law requires, ask you first.

## What happens when you use the Judt agent?

**The agent sends your request and the parts of your App it needs to AI companies. Neither they nor we train AI models on it.**

The Judt agent builds and changes Apps for you. To answer you, it sends an AI company your message, earlier messages in the conversation, and the parts of your App it needs. These parts can include files, command output and logs.

When you choose the **Auto** model, we first send your request and recent messages to OpenAI. OpenAI picks the right model for the job, and we then send the request to that model.

We use these companies’ business services, whose terms don’t let them train AI models on what we send. We don’t train AI models on your content either.

We store your conversations with your App. Every member of your organization can read them. They stay until you delete the conversation, the App or your account.

## Who do we share it with?

**We share personal information only with the companies that help us run Judt, with your organization, with people you choose, and when the law requires it.**

**Service providers.** These companies handle personal information for us. Our contracts with them let them use it only to do this work for us.

| Company | What they do for us | What they receive |
| --- | --- | --- |
| Google Cloud (US) | Hosting, databases, file storage and Secret storage | Everything stored in Judt |
| E2B (US) | The sandboxes where your Apps’ dev servers and commands run | App source, files and command output |
| Anthropic (US) | AI models for the Judt agent | Agent requests and the parts of your App they need |
| OpenAI (US) | Picking a model when you choose Auto | Agent requests and recent messages |
| Google Gemini (US) | AI models for the Judt agent, when you choose one | Agent requests and the parts of your App they need |
| Stripe (US) | Payments and subscriptions | Name, email address, plan and card details |
| Resend (US) | Sending account and notice emails | Name, email address and the email |
| Sentry (US) | Error and performance monitoring | Error details, service logs and IP addresses |
| GitHub and Google (US) | Sign-in, if you choose it | Your sign-in request |
| Mintlify (US) | Hosting our docs website, docs.judt.ai | Visits to the docs website, under Mintlify’s privacy policy |

**Your organization.** Every member of your organization can see its Apps, files, logs, deployments and agent conversations. Organization owners can also manage members and billing.

**People you choose.** When you publish an App, anyone with its web address can use it. Agents and apps you connect can act as you, within the access you give them, until you disconnect them.

**When the law requires it.** We give personal information to authorities when we believe the law requires it, such as for a valid court order. We also do so to protect someone’s safety or to investigate fraud or abuse. Where the law allows, we tell you first.

**If Judt is sold or merges.** Personal information may move to the new owner. We’ll tell you before a different privacy policy applies to it.

**When you ask us.** We share personal information in any other way only when you ask us to or agree to it.

## What about people who use your Apps?

**Information your Apps collect belongs to you. You’re responsible for telling your App’s users how you use it.**

Your Apps can collect information from the people who use them, for example through a sign-up form. That information belongs to you, the App’s owner. We store it only to host your App, and we don’t use it for anything else.

As the App’s owner, you decide what your App collects. You must tell its users how you use their information, usually in your own privacy policy. You must also get any consent the law requires.

**If you use an App hosted on Judt:** contact the App’s owner about your information. If you contact us instead, we’ll pass your request to the owner when we can.

## Which cookies do we use?

**Only cookies that sign you in and remember your settings. No analytics or advertising cookies.**

A cookie is a small file a website stores in your browser. The Judt website and dashboard use only these:

| Cookie | What it does | How long it lasts |
| --- | --- | --- |
| Session | Keeps you signed in | Until you sign out, or about 7 days after you last use Judt |
| Session cache | Saves a database lookup on each page | 5 minutes |
| Password check | Remembers that you just entered your password, before a sensitive change such as a new email address | 10 minutes |
| Sidebar | Remembers whether the dashboard sidebar is open | 7 days |
| Agent panel (browser storage, not a cookie) | Remembers whether the agent panel is open | Until you clear your browser’s data |

We don’t use analytics, advertising or social media cookies, and we don’t let other companies track you on our website. You can block cookies in your browser settings, but you can’t sign in without the session cookie.

Apps hosted on Judt can set their own cookies. Each App’s owner decides which.

## How long do we keep it? (retention)

**Most personal information stays while your account is open. App logs go after 30 days, and deleted Apps are gone 30 days after you delete them.**

| Information | How long we keep it |
| --- | --- |
| Account and organization information | While your account is open. When you delete your account, we delete your profile at once, and everything else within 30 days. |
| Sign-ins (IP address and browser) | Until the sign-in ends. We delete them all when we delete your account. |
| Apps and their content | Until you delete the App. We then keep it for 30 days, so you can recover a mistake, and then delete it. |
| Agent conversations | Until you delete the conversation, its App or your account. |
| App logs and telemetry | 30 days. |
| Service logs and error reports | Up to 90 days. |
| Contact messages and feedback | While they help us support you or improve Judt. When we delete your account, we remove the link between your feedback and your account. |
| Billing records | As long as tax law requires, usually 7 years. |
| Database backups | Up to 7 days. Our backups replace themselves daily, so deleted information is gone from them within 7 days. |

We keep personal information longer only when the law requires it or to settle a dispute. We then use it only for that reason.

## How do we protect it?

**We encrypt personal information, keep each App separate from the others, and limit who can reach our systems.**

- We encrypt all connections to Judt (with TLS) and all stored data.
- Each App’s sandbox runs on its own separate virtual computer. Each App can reach only its own storage, with keys that expire quickly.
- We keep Secrets in a dedicated secure store. The dashboard and API never show a Secret’s value after you set it.
- We scramble passwords (with a one-way hash), limit sign-in attempts, and ask for your password before an email change. We email you when your password or email address changes.
- Only the people who run Judt can reach our production systems, and only when their work needs it.

No system is perfectly secure, so we can’t promise your personal information will never be exposed. If a security breach affects it, we’ll tell you and the authorities as the law requires.

## Where do we store it? (international transfers)

**In the United States. If you live elsewhere, your personal information is moved to the United States.**

Judt is based in the United States, and we store and use personal information there. Privacy laws in the United States may differ from those where you live.

When we move personal information out of the European Economic Area, the United Kingdom or Switzerland, we use contracts approved by the European Commission (Standard Contractual Clauses). We use the UK and Swiss versions too. These contracts require the receiver to protect it. Write to us for a copy.

## What are your rights?

**Wherever you live, you can see, correct, export or delete your personal information. You can delete your account yourself. For anything else, write to us, and we’ll reply within 30 days.**

**Everyone can ask us to:**

- **See** the personal information we have about you, and get a copy in a format other software can read.
- **Correct** personal information that’s wrong. You can change your name and email address yourself, in your account settings.
- **Delete** your account and personal information. You can do this yourself, on your Account page. You can also delete Apps and agent conversations at any time.
- **Stop** an optional use of your personal information, such as product news emails.

**Deleting your account** removes your profile, sign-in methods, API keys and connected agents, and takes you out of every organization. It also deletes the Apps of any organization where you’re the only member. If you’re the only owner of an organization that has other members, make someone else an owner first.

**How to make a request:**

1. Email [russ@judt.ai](mailto:russ@judt.ai) from the email address on your Judt account.
2. Tell us what you want us to do, for example “Send me a copy of my personal information.”
3. We confirm it’s you. If you write from another address, we may ask you to sign in or answer a question about your account.
4. We do what you asked, or explain why we can’t, within 30 days of your email.
5. If we say no, reply to our answer to appeal. We’ll answer your appeal within 45 days.

Using your rights is free, and we won’t treat you differently for using them. Someone else can make a request for you if you give them written permission.

Sometimes the law requires us to keep personal information, such as billing records. If that stops us deleting something, we’ll tell you.

**If you live in the European Economic Area, the United Kingdom or Switzerland,** you can also ask us to limit or stop using your personal information. You can withdraw any consent you gave us. You can also complain to your local data protection authority, but we’d like the chance to fix things first.

These laws require a reason for each use of personal information (a “legal basis”). Ours are:

- **We need it to give you Judt** (contract): your account, Apps, billing and the Judt agent.
- **We have a fair business reason that doesn’t override your rights** (legitimate interests): keeping Judt safe, fixing bugs, improving Judt and replying to messages.
- **The law requires it** (legal obligation): tax records and valid legal requests.
- **You agreed** (consent): for example, to optional emails.

**If you live in California or another US state with a privacy law,** you have the rights above. You can also tell a company not to sell your personal information or use it for targeted advertising.

Those laws use “sell” and “share” to mean giving personal information to others for money or for targeted advertising. We do neither, so you don’t need to opt out. We still treat a Global Privacy Control signal (a browser setting) as an opt-out.

We use sensitive personal information only to give you Judt, such as your password to sign you in. In the past 12 months, we collected these kinds of personal information, for the reasons in [how we use it](https://judt.ai/privacy#use):

| Kind | Examples | Who receives it |
| --- | --- | --- |
| Identifiers | Name, email address, IP address, account IDs | Service providers |
| Commercial information | Plan and billing history | Stripe |
| Internet activity | Sign-ins, service logs, usage | Service providers |
| Account sign-in | Email address and password (stored as a hash) | No one |
| Content you give us | Apps, messages and agent conversations | Service providers, including AI companies |

## Can children use Judt?

**No. Judt isn’t for anyone under 16.**

Judt is a tool for developers and businesses. We don’t knowingly collect personal information from anyone under 16. If you think a child has given us personal information, write to us and we’ll delete it.

## What about other websites?

**Their own privacy policies apply, not this one.**

Judt links to websites we don’t run, including Apps that other people publish on Judt. Their owners decide how they handle personal information.

## How will we tell you about changes?

**We update the date at the top. For a big change, we tell you at least 30 days ahead.**

A big change is one that affects your rights or what we do with personal information. For example, using it for a new purpose or giving it to a new kind of company.

For a big change, we email you or show a notice in Judt at least 30 days before it takes effect. If you keep using Judt after that, the new policy applies. Write to us for any earlier version.

## How can you contact us?

**Email [russ@judt.ai](mailto:russ@judt.ai). We reply within 30 days.**

You can also use our [contact form](https://judt.ai/contact), call +1 925-876-2598, or write to the address below.

Judt  
603 Santa Florita Ave.  
Millbrae, CA 94030  
United States