Privacy
Policy

We collect information you provide directly, information collected automatically, and information from third parties.

1.1 Information You Provide

Name is optional. Email is required to create an account. Age confirmation is required for all users.

1.2 Information Collected Automatically

When you use the Services, we and our service providers automatically collect:

For full detail on cookies and tracking technologies, see Section 4 below.

1.3 Information from Third Parties

• Google OAuth: If you sign in with Google, we receive your name, email address, and profile picture from Google, subject to your Google account permissions.
• Gmail (optional): If you choose to connect Gmail, we read your purchase, reservation, and travel messages to derive lifestyle signals for your taste profile. We do not store the messages themselves. Section 3.5 describes this in full.
• Analytics Providers: We use PostHog and DataDog to collect analytics and performance data. These providers may collect information directly through their SDKs integrated into our Services.

We use the information we collect for the following purposes:

• Providing and operating the Services. To create and manage your account, process requests, display personalized content, and deliver core platform functionality.
• Artificial intelligence and machine learning. We use your information — including User Content, usage behavior, and interaction data — to deliver personalized AI-powered features such as product matching and personalized recommendation models, and to train, fine-tune, and improve Jelly’s AI models. Each registered user’s data may contribute to a personalized model unique to that user. By using the Services, you consent to this use. Information received from Google APIs is excluded from model training entirely and is used only as described in Section 3.5.
• Analytics and product improvement. To understand how users interact with the Services, diagnose issues, monitor performance, and improve features and functionality. We use PostHog and DataDog for these purposes.
• Communications. To send transactional emails (account confirmations, password resets, support responses) and, with your consent, marketing communications by email and text message.
• Security and fraud prevention. To detect, investigate, and prevent unauthorized access, abuse, fraud, and violations of our Terms of Service.
• Legal compliance. To comply with applicable laws, respond to legal process, and enforce our legal rights.

Jelly’s core product is AI-powered. We use both proprietary models and third-party AI services. Here is how your data relates to AI:

3.1 Training Data

Your User Content (including photos and text), usage patterns, and interaction signals may be used as training data for Jelly’s proprietary AI models. This helps improve recommendation quality, image analysis accuracy, and personalization over time. This never includes information received from Google APIs, or anything derived from it — see Section 3.5.

3.2 Personalized Models

For registered users, Jelly may maintain a personalized model that reflects your preferences and behavior. This model is used to tailor outputs specifically to you. It is built from your photos, music, and activity in Jelly. Information received from Google APIs is used to produce your taste profile but is not used to train any model, including your personalized one.

3.3 Third-Party Models

We use third-party AI model providers to process inputs — currently Google (Gemini) and OpenAI — reached through a gateway we operate. Each provider acts as our processor under API terms that do not permit the provider to use our inputs or outputs to train or improve its models. Data shared with these providers is governed by their data processing agreements, and we take reasonable steps to ensure they maintain appropriate data protections.

3.4 No Regulated Data

The Services are not intended to process sensitive categories of data such as health information, financial account numbers, precise geolocation, biometric identifiers, or children’s data. Do not submit such data to the Services.

3.5 Google User Data and Limited Use

If you choose to connect Gmail, Jelly requests read-only access to your Gmail messages (the gmail.readonly scope) and nothing else. Here is exactly what we do with that access, and what we do not do.

• What we read. We ask Gmail only for messages in the purchases, reservations, and travel categories, and we read those message bodies for one purpose: to extract a small set of lifestyle signals — for example a destination and dates, a venue, or a merchant and item — that inform your personal taste profile alongside your photos and music.
• What we keep. Only those derived signals, tied to your account. Each signal keeps the merchant or venue name and brand, the sender’s domain, the date, the city and region when the message states one, the total amount when present, and a message identifier we use to avoid counting the same email twice. We do not store message bodies, subjects, or the addresses of senders or recipients, and we never display your mail to you or anyone else. Where a theme in your profile drew on your inbox, the app shows you the derived signal (for example a merchant, a place, and a month), never the message. No person at Jelly reads your mail, except with your explicit permission for a specific message, to investigate a security incident, or as required by law.
• What we never do. We never send, modify, label, or delete mail; never export your mailbox; never use Google user data for advertising, marketing, or analytics about you; never sell it; and never transfer it to anyone except the processors named in Section 3.3, who act on our instructions and may not use it for any other purpose.
• Artificial intelligence. Google user data, whether raw, aggregated, or derived, is processed by AI models only to produce your own taste profile. It is never used to create, train, fine-tune, or improve any generalized or foundational model — ours or a provider’s — and the providers in Section 3.3 are contractually prohibited from training on it.
• Your control. Disconnecting Gmail in Connected Platforms revokes our access with Google and deletes the signals we derived from your mail. Deleting your account removes everything. You can also revoke Jelly’s access at any time from your Google Account permissions page.

4.1 What Are Cookies?

Cookies are small text files placed on your device when you visit a website. They allow the site to recognize your device, remember your preferences, and gather information about your interactions. We also use similar technologies including:

• Local storage / session storage: Browser-based storage used to retain data within a session or across sessions.
• Pixel tags / web beacons: Tiny, invisible images embedded in pages or emails used to track whether content was viewed.
• SDKs (mobile): Software development kits embedded in our mobile apps that collect usage data similarly to cookies on the web.
• Server-side logging: Server logs that record device and request information.

All such technologies are referred to collectively as “cookies” in this policy.

4.2 Who Sets Cookies?

• Ray’s Deli and Supplies (first-party): Cookies set directly by us for operational and analytics purposes.
• Third-party providers: Cookies or SDKs set by our service providers operating on our behalf, including PostHog and DataDog.

4.3 Categories of Cookies We Use

PostHog collects behavioral and event data via a JavaScript snippet and/or mobile SDK. Learn more: posthog.com/privacy. DataDog collects application performance data and error logs via its monitoring SDK. Learn more: datadoghq.com/legal/privacy.

4.4 Cookies in Our Mobile Applications

Our iOS and Android applications use mobile SDKs that perform functions equivalent to cookies, including:

• PostHog mobile SDK: Tracks in-app events and user behavior.
• DataDog mobile SDK: Monitors performance and captures error reports.
• Device identifiers: We do not use mobile advertising identifiers (IDFA on iOS, AAID on Android).

You can limit mobile tracking through your device’s privacy settings (e.g., “Limit Ad Tracking” on iOS or “Opt out of Ads Personalization” on Android).

4.5 Managing Cookie Preferences

Browser settings: Most browsers allow you to block or delete cookies through their settings:

• Chrome: Settings > Privacy and Security > Cookies
• Safari: Preferences > Privacy
• Firefox: Options > Privacy & Security

Disabling essential or functional cookies may prevent certain features from working correctly.

Opt-out tools for analytics providers:

• PostHog: posthog.com/privacy — PostHog honors “Do Not Track” browser signals.
• DataDog: Contact legal@imjelly.com to request DataDog data opt-out.

Email tracking: You can disable email images in your email client to prevent email tracking pixels from loading.

4.6 Do Not Track

Some browsers transmit a “Do Not Track” (DNT) signal. PostHog is configured to honor DNT signals. Jelly does not currently respond to DNT signals separately from PostHog’s implementation. We will update this section as practices evolve.

4.7 Cookie Retention

• Session cookies: Deleted when you close your browser.
• Persistent cookies: Retained for the period noted in Section 4.3, or until you delete them.
• Server-side logs: Retained for a limited period for security and debugging purposes.

5.1 Service Providers

We share information with vendors and service providers that support the Services, including:

• Cloud hosting and infrastructure providers
• Analytics providers (PostHog, DataDog)
• AI/ML model providers
• Email and SMS delivery providers

Service providers are contractually bound to use your information only as directed and to maintain appropriate security.

5.2 Business Transfers

In connection with a merger, acquisition, financing, or sale of all or substantially all of our assets, your information may be transferred to the acquiring entity. We will provide notice before your information is subject to a materially different privacy policy.

5.3 Legal Requirements

We may disclose information as required by law, court order, or government request; to enforce our Terms; or to protect the rights, property, or safety of Ray’s Deli and Supplies, our users, or the public.

5.4 With Your Consent

We may share information for purposes not described here with your prior consent.

5.5 Aggregated / Anonymized Data

We may share aggregated or de-identified data that cannot reasonably be used to identify you. This never includes information received from Google APIs or anything derived from it.

We retain your information for as long as your account is active and as needed to provide the Services. Upon account deletion:

• Account data and User Content are deleted or anonymized within a commercially reasonable period, subject to legal hold obligations.
• Aggregated, anonymized, or de-identified data derived from your use may be retained indefinitely. This never includes information received from Google APIs or anything derived from it; those signals are deleted when you disconnect Gmail or delete your account.
• Information incorporated into AI model training weights is not separately deletable from the model; however, we will not use identifiable information attributable to you after deletion.
• We retain information as required to comply with legal obligations, resolve disputes, and enforce agreements.

We implement reasonable technical and organizational measures designed to protect your information against unauthorized access, disclosure, alteration, or destruction. These measures include encryption in transit, access controls, and monitoring. However, no security system is impenetrable, and we cannot guarantee the security of information transmitted to or stored on our systems.

8.1 Access and Correction

You may access and update your account information through your account settings or by contacting support@imjelly.com.

8.2 Account Deletion

You may request deletion of your account by contacting support@imjelly.com. We will process deletion requests within a commercially reasonable time, subject to retention obligations described in Section 6.

8.3 Marketing Opt-Out

You may opt out of marketing emails by clicking “unsubscribe” in any marketing email, or by contacting support@imjelly.com. You may opt out of marketing text messages by replying STOP to any marketing text.

8.4 Cookie Preferences

You may manage cookie preferences as described in Section 4.5.

8.5 California Residents

California residents may have additional rights under the California Consumer Privacy Act (CCPA), including the right to know, right to delete, and right to opt out of the sale or sharing of personal information. See Section 10 — California Privacy Rights.

8.6 Do Not Track

See Section 4.6.

The Services are not directed to individuals under the age of 21. We do not knowingly collect personal information from individuals under 21. If you believe we have inadvertently collected information from a person under 21, please contact us at support@imjelly.com and we will promptly delete such information.

To the extent the CCPA applies, California residents have the following rights:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources, our business purpose, and the categories of third parties with whom we share information.
• Right to Delete: Request deletion of personal information we have collected, subject to certain exceptions.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt Out of Sale/Sharing: We do not sell personal information. To the extent we engage in “sharing” of personal information for cross-context behavioral advertising, you may opt out.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To submit a CCPA request, contact: support@imjelly.com.

We will respond to verified requests within 45 days (extendable by an additional 45 days with notice).

Ray’s Deli and Supplies is based in the United States. If you access the Services from outside the United States (e.g., Canada), your information will be transferred to and processed in the United States. By using the Services, you consent to this transfer. We are not targeting EU or UK users and the GDPR and UK GDPR do not apply at launch.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and updating the “Last Updated” date. For material changes, we may also send an email notification to registered users. Your continued use of the Services after the effective date constitutes your acceptance.

For questions, concerns, or to exercise your rights:

• Email: support@imjelly.com
• Legal / Privacy requests: legal@imjelly.com
• Mailing address: Ray’s Deli and Supplies, Inc., 38 Keyes Ave, Suite 200, San Francisco, CA.