blockversewordysbillionaire.aiyourlistWhiteboardAppquizieunschoolThis is an archived version, no longer in effect. Read the current Privacy Notice or all previous versions.
We built IJR.ai to sharpen thinking, not to harvest data. This policy explains what we collect, why, and the controls you have over it. It applies to every IJR product and surface — ijr.ai, open.ijr.ai, the product subdomains (inbox, drive, focus, projects, studio, circles, pulse, earn), and the sub-products they serve: Chat, Pulse, Inbox, Drive, Focus, Projects, Studio, Channels, Games, Journals, and Earn (together, the “Services”). The Services are operated by IJR AI, Inc.
We use the information we collect to:
We do not sell your personal information. We do not use your conversation content or connected-account data to train our own models without your explicit opt-in.
Several Services work by connecting accounts you already use — for example Gmail and Google Calendar, Google Drive, Google Contacts, Microsoft 365, Slack, Notion, GitHub, Dropbox, Facebook, Instagram, TikTok, and X. Connections are made through OAuth: you grant permissions on the provider’s own consent screen, and access tokens are held and refreshed by our secure connection infrastructure (Nango and Unipile) — encrypted, never exposed to your browser. You can disconnect any account at any time from Settings, which revokes our access and deletes associated tokens.
Google user data — Limited Use. IJR.ai’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the features you request (for example, triaging your inbox or scheduling on your calendar), is not used for advertising, and is not transferred to third parties except as necessary to provide those features, for security, or to comply with law.
The Services are built on large language models and related AI systems. When you use an AI feature, the relevant content — your prompt, and where the feature requires it, context such as the email or document being worked on — is sent to the model provider that powers that feature (for example Anthropic, OpenAI, Google, or xAI, routed through Vercel’s AI Gateway). These providers process the data to generate the response and are bound by agreements that restrict use of your data for their own purposes. Submitted content may also be screened by automated moderation systems to enforce our acceptable-use rules and safety protections.
We share your information only in the following circumstances:
Some Services are public by design. Journal posts you publish, community answers you contribute, characters and games you share to the community shelves, comments and reactions on Pulse stories, your reader profile, and chat threads you explicitly share by link are visible to anyone — including on open.ijr.ai, where public content is indexable by search engines. Your private account details are never included; only the content you chose to publish. Think before you post: content you make public may be copied or redistributed by others.
The Services are not directed to children under 13, and we do not knowingly collect personal information from them outside a parent-managed family account. Family features let a parent or guardian link a child’s account to their own, apply parental controls and a safe-content baseline, and manage the child’s experience across the Services (including Games). Parental-control settings are protected by a PIN held only in hashed form. If you believe a child under 13 is using the Services without a managing parent, contact us at legal@ijr.ai and we will take appropriate action.
We use a small set of first-party cookies for sign-in, guest rate limiting, and marketing/Earn attribution, plus privacy-respecting product analytics. The full list of cookies, what each one does, and how long it lasts is in our Cookie Policy.
We retain your account data and content for as long as your account is active or as needed to provide the Services. Connected-account data is generally fetched at the time you use a feature rather than copied into our systems; where any of it is stored, disconnecting the account deletes it. If you delete your account, we will delete or anonymize your personal information within 30 days, except where retention is required by law (e.g. billing and payout records) or needed to prevent abuse. Content you published publicly may remain visible where others have interacted with it (for example, remixes of a game you shared), but is disassociated from your identity. Anonymized, aggregated data that cannot be linked back to you may be retained indefinitely.
We implement industry-standard security measures including encryption in transit (TLS) and at rest, AES-256-GCM encryption for stored connection tokens, least-privilege access controls, and continuous automated security scanning of our code and dependencies. No system is perfectly secure. In the event of a data breach affecting your information, we will notify you as required by applicable law.
Depending on your jurisdiction, you may have the right to:
To exercise any of these rights, email us at legal@ijr.ai. We will respond within 30 days.
The Services are operated from the United States, and your information is processed and stored there. If you access the Services from outside the U.S., you understand that your information will be transferred to and processed in the United States, where data protection laws may differ from those of your jurisdiction. Where required, we rely on appropriate safeguards for such transfers.
We may update this Privacy Policy from time to time. We will notify you of material changes by email or by a prominent notice within the Services before the change takes effect. The “Effective date” at the top of this page will always reflect the most recent revision. Continued use of the Services after the effective date constitutes acceptance of the updated policy.