Privacy Policy

Last updated: October 2, 2026

This policy explains what data we collect when you use Energy Battery (the "Service"), why we collect it, who we share it with, and what choices you have. Throughout this policy, "we," "us," and "our" refer to Jen Built It LLC.

1. What we collect

• Account data. Your email address and a salted PBKDF2 hash of your password. We never store your password in plain text.
• Check-in data. The energy levels (1–10) you log, the time of day you choose (morning, afternoon, evening), any tags you select, any short notes about what charged or drained you, and the date of each check-in.
• Profile data. Your timezone preference. Energy Battery doesn't offer a newsletter, so the newsletter field on your account always stays off.
• Security data. The IP address of your request (used for rate-limiting and abuse prevention) and counts of failed login attempts. We don't store request IPs long-term; they live only inside the rate-limit window (typically minutes to an hour).
• Email verification and password reset tokens. Short-lived one-time tokens stored as SHA-256 hashes so a database read cannot replay them.

2. Why we collect it

• To create and secure your account (legal basis: contract).
• To save your check-ins so you can review your energy patterns over time (legal basis: contract).
• To verify Pro status when you upgrade through Jen's App Hub (legal basis: contract).
• To prevent fraud, abuse, and credential stuffing (legal basis: legitimate interest).
• To send the emails your account needs, like email verification and password resets (legal basis: contract). Energy Battery doesn't send marketing email.

3. Who we share it with

We use a small set of vendors to operate the Service. Each vendor only receives the minimum data they need.

• Cloudflare hosts the Service and our database (Cloudflare Workers + D1).
• Resend sends transactional emails (verify-your-email, password reset).
• n8n (self-hosted at n8n.jen8nflows.cloud) receives an internal operator notification when you sign up. The notification carries your email address and the app's name, and Jen uses it to keep track of signups. It doesn't add you to any mailing list. The notification endpoint is authenticated with a shared secret. If the Service hits a server error, that same n8n server also gets a short error report (the page address, the error code, and the error message) so Jen hears about it. That report doesn't include your email or your check-ins.
• Feedback button: if you use the in-app Feedback button, your message, the page you were on, your browser's user-agent string and, if you choose to enter it, your email address are sent to that same n8n server and emailed to Jen. Nothing is sent unless you press Send.
• Jen's App Hub issues a signed entitlement token if you have a Pro subscription. Energy Battery verifies that token itself, and no payment details ever reach this Service. When you log in, Energy Battery sends your email address to the App Hub to ask whether you have Pro, so Pro follows your account to a new device.
• Google Fonts: the Service loads its fonts from Google (fonts.googleapis.com and fonts.gstatic.com). When your browser fetches them, Google receives your IP address and basic browser details, the same as for any website that uses Google Fonts.
• Cloudflare Web Analytics counts page views so Jen can see how many people visit. It's privacy-friendly page-view counting: Cloudflare says it doesn't use cookies or local storage and doesn't fingerprint visitors (cloudflare.com/web-analytics).

We do not sell your personal data. We do not share your data with advertisers. We do not transfer your data to third parties for their own marketing.

4. Cross-app Pro verification

If you have an active Pro subscription on Jen's App Hub, the Hub issues your browser a short-lived signed JWT. Energy Battery verifies that JWT locally using a shared secret to confirm your Pro status (which unlocks the full Patterns view and 90-day history). The only data passed in that token is your email address and the date your Pro access runs through. No payment data, no credit card information, no profile data is shared with Energy Battery.

5. Cookies and local storage

To keep you logged in, we set one cookie named eb_session. It holds a signed login token, it's marked HttpOnly so scripts on the page can't read it, it's only sent to Energy Battery over HTTPS, and it lasts 30 days or until you log out, whichever comes first. We don't keep your login in browser local storage anymore. Energy Battery also keeps a few items in your browser's storage so the app works:

• hub_pro_jwt (localStorage): your Pro entitlement token from the App Hub, only if you have Pro. It's removed when you log out.
• eb_was_pro (localStorage): a flag that remembers you had Pro, so the app can tell you if Pro lapses.
• eb_timezone (localStorage): your timezone, so dates show correctly. Your timezone is also saved to your account.
• eb_milestones (localStorage): which milestone celebrations you've already seen, so they don't repeat.
• eb_tour_done (localStorage): a flag that you've finished or skipped the welcome tour.
• eb_deleted (sessionStorage): a one-time flag that shows a "your account was deleted" notice after you delete your account. It goes away when you close the tab.

We don't use advertising cookies, third-party tracking pixels, or cross-site analytics. The only analytics is Cloudflare Web Analytics (see section 3), which sets no cookies and stores nothing in your browser.

Do Not Track. Some browsers can send a "Do Not Track" signal. Energy Battery doesn't use advertising or tracking tools that follow you across other websites, so it works the same whether or not your browser sends that signal. We don't let any third party collect information about your activity on Energy Battery to track you across other sites over time.

6. How long we keep your data

• Account and check-in data: until you delete your account. When you delete your account, your user record, all check-ins, all password reset tokens, and all email verification tokens are removed in a single batch operation.
• Rate-limit / security records: typically minutes to one hour; never more than a day. A daily cleanup job deletes any that have expired.
• Password reset and email verification token hashes: they stop working when they expire or once they're used, and the daily cleanup job deletes them 7 days after they expire.
• Security log entries: when you log in, fail a login, change or reset your password, or delete your account, the server writes a short log line with your account ID (or, for a failed login, a one-way hash of the email typed) and a one-way hash of your IP address. No passwords, tokens, raw email addresses or raw IP addresses are logged. Cloudflare keeps these logs for up to 7 days.

7. Your rights

Depending on where you live (GDPR, UK GDPR, CCPA/CPRA, and similar laws), you may have the right to:

• Access the personal data we hold about you (open Account settings in the app footer and use Export my data, or request via email)
• Correct inaccurate data (change your timezone in Account settings in the app footer, and for email changes contact support)
• Delete your account and your data (open Account settings in the app footer and use Delete my account). You'll confirm with your current password, or, if you signed up through the App Hub and never set a password, by typing DELETE while signed in to the App Hub on that device.
• Export a copy of your data in a portable format (GET /api/account/export while authenticated, or request via email)
• Opt out of any sale or sharing of personal information, although we do not sell or share personal information for cross-context behavioral advertising (see Do Not Sell or Share My Personal Information)
• Lodge a complaint with your local data protection authority

To exercise any of these rights, use the in-app controls described above, or email privacy@jenbuiltit.com. We respond within 30 days.

8. Children

The Service isn't meant for anyone under 18, and we don't knowingly collect personal data from them. If you believe a child has created an account, email privacy@jenbuiltit.com and we will delete it.

9. International users

The Service is operated from the United States. By using the Service from outside the US, you consent to the transfer of your data to the US. We rely on Standard Contractual Clauses or equivalent safeguards with our sub-processors where required.

10. Security

We protect your data using TLS in transit, salted PBKDF2 (100,000 iterations) for passwords, parameterized SQL queries, role-scoped database access, IP and per-user rate limiting, per-account lockout after repeated failed logins, signed HS256 session tokens with revocation versioning, SHA-256-hashed-at-rest verification and reset tokens, CSRF origin checks on sensitive mutations, and least-privilege secrets management. No system is perfectly secure, but if we detect a breach affecting your data, we will notify you and the appropriate authorities as required by law.

11. Changes to this policy

If we update this policy in a way that materially changes how we handle your data, we will notify you by email (for account holders) or post a notice on the Service. The "Last updated" date at the top will always reflect the current version.

12. Contact

Questions about this policy or your data:

Jen Built It LLC
10800 S Lloyd Drive
Worth, IL 60482
USA
privacy@jenbuiltit.com