We collect only what we need to provide the service:

• Account data (name, email, job role, company) to identify and personalise your account
• Conversation data (messages, attachments, AI responses) to power your sessions
• Session metadata (IP address, browser type, timestamps) to maintain security and performance
• Usage analytics (clicks, scrolls, and page navigation) to understand how the product is used and improve it
• Support data (escalated tickets) to resolve issues linked to your account

We do not collect data speculatively. If we do not need it, we do not ask for it.

There is no indefinite retention of sensitive operational content unless you choose it. Attachments are always removed within a short, bounded window by design, and you can delete any individual chat yourself at any time.

Every third-party service we use receives only the minimum data required for its specific function, nothing more. Each provider is contractually bound by a Data Processing Agreement. The table below summarises exactly what each provider receives, their certifications, and where you can review their security controls independently.

We chose our infrastructure partners because they meet the same standards we hold ourselves to. Every provider listed above holds independent SOC 2 Type IIcertification at minimum, meaning an external auditor has verified that their security controls work in practice, not just on paper. Several hold additional certifications including ISO 27001, GDPR compliance, and HIPAA. You can review each provider's security documentation directly using the links in the table above.

File uploads are restricted to an explicit allowlist of nine file types: txt, png, jpg, jpeg, webp, log, eventlog, pdf, and json. The eventlog type is the TOP Server industrial log format, and jsoncovers TOP Server project exports, reflecting jonjon.ai's focus on operational engineering data.

Validation is applied at the content level, not just by filename. Image files (png, jpg, jpeg, webp) and PDFs are verified against their magic bytes to confirm the file genuinely matches its declared type. JSON is parsed to confirm it is well-formed, and TOP Server project exports are condensed to a summary before use. Text files undergo binary-content detection. Filenames are sanitised across all types to prevent path traversal attacks.

Rather than a separate cap for each file type, each conversation carries a cumulative attachment budget of 128MB across every file uploaded to it. A single file may use as much of that budget as remains; once the budget is exhausted, further uploads to that conversation are rejected.

Uploaded attachments have a 48-hour retention window. After that window, files are permanently deleted from storage by an Azure Storage Lifecycle Policy configured at the infrastructure level. This operates independently of application activity, meaning deletion is guaranteed regardless of whether a file is accessed again after upload.

Passwords are hashed using Argon2id, the algorithm currently recommended by OWASP as the gold standard for password storage. Your plaintext password is never written to disk, not even briefly. Session tokens are generated with 256-bit entropy and hashed before storage, so even in a hypothetical breach of our token store, your session could not be hijacked. Accounts automatically lock after five consecutive failed login attempts, and every session carries a hard expiry that you can also trigger immediately on logout.

Every byte exchanged between your browser and our servers is encrypted over HTTPS/TLS. We enforce this through HSTS (HTTP Strict Transport Security) so that your browser will refuse to connect to us over an unencrypted channel, even if someone attempts to downgrade the connection. Security headers are applied to every response to prevent clickjacking, content sniffing, and referrer leakage.

If you are based in the European Economic Area, you have the right to:

• access a copy of your personal data
• have inaccurate data corrected
• request full deletion of your account and associated data
• receive your data in a portable machine-readable format
• object to processing based on legitimate interests
• withdraw consent at any time without affecting anything processed prior to that withdrawal

To exercise any of these rights, contact us at privacy@softwaretoolbox.com. You also have the right to raise a complaint with your local data protection authority at any time.

If you believe you have found a security vulnerability in jonjon.ai, please report it to security@softwaretoolbox.com. We commit to acknowledging your report within 48 hours and ask that you allow us a reasonable opportunity to investigate and address the issue before any public disclosure.