Privacy

Hedule is a service of ONCHAIN GAME RESEARCH LTD, which also runs JustSee. This text applies to Hedule. Where it says JustSee, it also means Hedule.

Which data JustSee processes, why, and what rights you have. Last updated: 17 October 2026.

1. Controller

2. Visiting the website and 3D world

When you visit, our hosting provider processes technically necessary connection data: IP address, time, requested address, browser and device type. This serves delivery and security (Art. 6(1)(f) GDPR). Logs are kept only briefly.

In your browser we store settings and progress, for example language, the city’s time of day, recently entered websites and onboarding state (local storage or session storage). This is necessary for the function you request (§ 25(2) no. 2 TDDDG). This data stays in your browser. You can delete it at any time in your browser settings.

We count visits, taps on the free video offer and opened sign-in forms as daily totals, also by the source named in the address (for example an ad’s utm values). We store no person, no IP address and no identifier in your browser for this.

We use no third-party advertising, tracking or analytics cookies and embed no third-party fonts or scripts. The only exception, with your consent, is described in section 8b.

JustSee World: saved game and usage

Your own builds, inventory and saved game stay in this browser. While you actively play, JustSee World sends a small heartbeat to our own server at most about every 30 seconds. It contains only a random session identifier and whether the session is active. This identifier lives only in the page's memory, not in an analytics cookie or browser storage. It changes on reload and daily. The server keeps its daily hash until the next day and aggregate daily counts for 30 days. Account names, positions, builds and chat messages are not sent for this purpose. To limit abuse, a hash of the connection address is held in memory for at most two minutes. The operator overview counts sessions, not uniquely identified people.

3. Free website scan

When you enter a website address, our server fetches publicly available pages of that website. An AI model can create notes and example ideas from them. The result is cached for up to 24 hours so a repeat visit is fast. To limit misuse we briefly process your IP address (Art. 6(1)(b) and (f) GDPR). Please only enter public websites.

4. Account and sign-in

For an account we process your email address or a recovery key, an account ID and sign-in times. We send the sign-in code by email through our sign-in service. After sign-in we set a necessary session cookie (“__Host-justsee-session”, HttpOnly, up to 90 days). The legal basis is performance of the contract (Art. 6(1)(b) GDPR) and § 25(2) no. 2 TDDDG.

In the account area you see where you are signed in (browser and device type, for example “Safari · iPhone”, or the app's device name) and can sign out single devices. We do not store the full browser identifier for this. The JustSee app keeps its sign-in key in the iPhone's Keychain.

If you choose “Sign in with Google”, Google asks for your consent and sends us, through our sign-in service, your confirmed email address and a Google user ID. We keep only the email address, the account ID and sign-in times; your name or profile picture are not used. During this step a short-lived cookie (“__Host-justsee-oauth”, at most 10 minutes) protects the sign-in. Google processes data under the Google Privacy Policy. The legal basis is performance of the contract (Art. 6(1)(b) GDPR).

While you are signed in and use the visible page, it sends a short activity signal about once a minute. From it we store only when you were last active and how many minutes you were active on which day, for 90 days. We do not store page content, clicks, IP addresses or device data for this. It helps us run and improve JustSee (Art. 6(1)(f) GDPR). You can object at any time.

4a. The JustSee app for iPhone

If you choose “Sign in with Apple”, Apple sends us, through our sign-in service, a stable Apple user ID and your email address (or an Apple relay address, if you hide your email). We keep only the email address, the account ID and sign-in times (Art. 6(1)(b) GDPR).

Messages (“Your video is ready”, “Uploaded to YouTube”) are sent only if you allow them on your iPhone. iOS then gives the app a device token; the app sends it to our server with the iPhone's language and Apple's environment. We use it only to deliver these two messages through the Apple Push Notification service. We delete it when you sign out on that device, delete your account or Apple reports the token as invalid. You can withdraw your permission at any time in the iPhone's settings (Art. 6(1)(a) GDPR).

For the free first video the app keeps a random identifier of this installation; it is used like the browser identifier in section 8a. Credits in the app are bought through Apple's in-app purchase. Apple processes the payment; we do not receive your payment details. We receive Apple's signed confirmation with product, price, currency, storefront, purchase date and transaction number, and book the credits once (Art. 6(1)(b) and (c) GDPR). Apple's measurements of the app (MetricKit) stay on your iPhone.

5. Projects, content and AI

For your orders we process project data: website, details about your offer and audience, uploaded images, conversations with the agents, drafts and results. For AI processing we send the content needed to OpenAI. According to OpenAI, data sent through its API is not used for training and is kept at most for a limited time for abuse monitoring. The legal basis is performance of the contract (Art. 6(1)(b) GDPR).

When you talk to agents, an AI answers. There is no automated decision with legal effect within the meaning of Art. 22 GDPR. AI results are suggestions; you decide how to use them.

6. Payments

Payments are processed by Stripe. You enter your full payment details directly with Stripe; we do not receive them. We receive payment status, amount, package, billing name and address, invoice and a payment reference. The legal bases are performance of the contract and statutory retention duties (Art. 6(1)(b) and (c) GDPR).

JustSee Checkout. If you publish a checkout, we store your products, payment links and imprint details and show them publicly, because you trigger this. The legal basis is performance of the contract. When someone opens a checkout page, we set no cookies and run no scripts; our server only processes the technically necessary access data. The purchase takes place directly at Stripe on the seller's account, and JustSee does not receive buyer or payment data from it. The seller is responsible for the sale. When you take the checkout offline or delete your account, we remove the public page.

Product workshop. If you order a draft, we send your topic, your notes and the website and film texts you selected to OpenAI, which writes and checks the text. We store your draft until you delete it, and we store the finished PDF with its cover and private address. Anyone who has the address can download the file. When someone opens the download page, we set no cookies, run no scripts and do not record who downloaded the file; our server only processes the technically necessary access data. The legal basis is performance of the contract. When you delete the product, the project or your account, we remove the file and the address.

7. Connected platforms

When you connect accounts such as Instagram, WordPress or other platforms, we store the access data encrypted. We only use it for actions you trigger or allow in automatic mode, for example publishing an approved post. For this we send the content needed to the platform. Further processing there is governed by that platform’s privacy terms. You can disconnect at any time.

YouTube. JustSee uses the YouTube API Services. When you connect a YouTube channel, JustSee reads its public name, its videos and their view counts, and, only if you allow it and press Publish, uploads the video you approved with its title and description to that channel. By connecting a channel you agree to the YouTube Terms of Service; Google processes data under the Google Privacy Policy. We store the access data encrypted and keep channel data only while the channel is linked; when you disconnect or remove the channel, we delete its access data and stored channel data. You can also revoke JustSee's access at any time in your Google security settings.

8. Optional measurement links

For explicitly enabled project measurement links, the redirect server temporarily processes the IP address and browser identifier to filter known bots and repeats. We do not store raw IP addresses, browser identifiers or referrers, only project, house and content attribution, time, event reference and verification status. A daily pseudonym supports repeat filtering and is removed after 48 hours. No tracking cookies are set.

8a. Free first video and where your account came from

For the free first video we check whether it was already used: by your account, your mailbox (without any “+” addition), your internet connection and a random identifier in your browser. From the internet connection we keep only an encrypted check value (hash), never the IP address; it counts for 30 days. The browser identifier contains nothing about you. Purpose: preventing misuse of the gift (legitimate interest, Art. 6(1)(f) GDPR; the browser identifier is necessary for the gift you request, § 25(2) no. 2 TDDDG).

When you sign up we also note which source your visit came from (for example an ad on Instagram and the campaign name) to see which advertising works (Art. 6(1)(f) GDPR). In the operator overview this is shown only as totals.

8b. Measuring ads (only with your consent)

If you arrive from an ad on Meta (Facebook, Instagram, Threads), TikTok, Google/YouTube, LinkedIn, Pinterest or X, we show you a small question. Only if you choose “Allow”: we keep the ad’s click identifier (for example fbclid or gclid) in your browser for up to 90 days. When you sign up, start your free video or buy credits, our server reports exactly this event to that one platform. Sent are: the kind and time of the event, the click identifier, your email address only as an irreversible SHA-256 hash, for a purchase the amount and currency (no payment details), and for the sign-up also your IP address and browser identifier (user agent) for matching (not to Google). No other platform receives anything. We load no platform scripts on our pages.

Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time under “Ad settings” in the account area; after that we send nothing more and delete the kept identifiers. The platforms process the data under their own responsibility to measure and deliver their ads; for Meta and Google joint controllership may apply. We delete sent events after at most 30 days; after sending we keep only the count without personal details.

9. Service providers

• Vercel Inc., USA: website hosting and delivery
• Railway Corporation, USA: server and database for accounts, projects and orders
• Supabase Inc., USA: sign-in and sending sign-in codes
• Apple Distribution International Ltd., Ireland: the iPhone app’s App Store, in-app purchases, messages and “Sign in with Apple” (section 4a)
• OpenAI (OpenAI Ireland Ltd. or OpenAI, L.L.C., USA): AI processing
• Stripe Payments Europe, Limited, Ireland (with Stripe, Inc., USA): payments and invoices
• Platforms you connect, for example Meta Platforms Ireland Ltd. (Instagram) or your WordPress provider: only on your instruction
• Only with your consent (section 8b) and only the platform whose ad brought you: Meta Platforms Ireland Ltd., TikTok Technology Limited (Ireland), Google Ireland Limited, LinkedIn Ireland Unlimited Company, Pinterest Europe Ltd. (Ireland) or X Internet Unlimited Company (Ireland)

We have contracts under Art. 28 GDPR with our processors. Transfers to the USA rely on the adequacy decision for the EU-US Data Privacy Framework where the provider is certified, otherwise on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

10. Retention

We keep account and project data until you delete it or have your account deleted. Payment and invoice records are kept for the statutory periods, usually six to ten years. Server logs and the scan cache are deleted after a short time. Content can remain briefly in backups.

You delete your account yourself in the account area of the website or the app (“Delete account”, with a code sent to your email). We sign you out on every device at once. Videos in progress are finished first; within 24 hours we delete your projects, made videos and pictures, platform connections and account data, including your login at our sign-in service. We keep only payment and invoice records (statutory retention) and a check value (hash) of your email address, connection and browser so that the free first video is given only once per person (legitimate interest, Art. 6(1)(f) GDPR). Videos already on YouTube or other platforms stay in your account there; you can also remove JustSee's access in your Google settings. On request we refund unused purchased credits first.

11. Your rights

You have the right of access, rectification, erasure, restriction of processing and data portability (Art. 15 to 20 GDPR). You can object to processing based on legitimate interests (Art. 21 GDPR). You can withdraw any consent at any time with effect for the future. Write to hello@justsee.ai.

You can complain to a data protection supervisory authority, in particular in your country of residence or to the Cyprus Commissioner for Personal Data Protection (Iasonos 1, 1082 Nicosia, Cyprus, www.dataprotection.gov.cy).

12. Obligation to provide data, minimum age

Without an email address or recovery key no account is possible; without payment details no purchase. Accounts are for people aged 16 and over, purchases for adults.

13. Security and changes

Connections are encrypted (TLS). We store platform access data encrypted. We update this policy when features or service providers change.