Privacy

Jimothy is a private beta. Things may change as the service improves.

What Jimothy stores

Spotify-linked users have a Jimothy user record in Azure SQL containing a Spotify external identifier, display name, email when Spotify provides it, and encrypted Spotify access and refresh tokens. Guest sessions use a server-issued HttpOnly cookie and are not stored as a user record in this version.

Beta capacity

To keep the private beta available, Jimothy may temporarily maintain a random guest-session identifier or an authenticated internal user identifier with session and activity timestamps. These records are used only to manage short-lived beta access and do not store conversation content.

AI and conversations

Prompts are sent to the configured Azure AI service to generate responses. Conversations currently live in browser memory and are not persisted as a conversation history by the application.

Cookies and integrations

Jimothy uses secure cookies for authenticated and guest sessions, CSRF protection, and Spotify OAuth state/PKCE. Spotify tokens remain server-side and are protected at rest; they are not returned to the browser.

Third parties and deletion

The service uses Microsoft Azure and Spotify when you connect Spotify. Their terms and privacy practices apply. There is no self-service data deletion feature yet; contact the beta operator to request account-data deletion. Do not share sensitive personal information in beta prompts.