Privacy policy

The short version

If you are only reading the marketing pages, we do not directly collect any personal information from you. We measure traffic in aggregate — page views, roughly where in the world they came from, and what kind of device — but that measurement is anonymous and sets no cookie. There are no advertising trackers and no social embeds. Our hosting provider still keeps ordinary server logs, which include your IP address — that is described under “What we collect when you browse” below, and it is the one thing that happens whether or not you interact with anything. If error and performance monitoring is switched on for a deployment (see below), it may send anonymous technical telemetry from your browser through our own servers — never your IP address, and nothing that names you. We still do not set any cookie on you before you sign in, which is why there is no cookie banner here — there would be nothing to consent to.

There are three places we collect personal information, and all of them are things you have to choose to do: joining the waitlist, requesting a demo, and the account pages (sign in and password reset). If you do none of them, the only record of your visit is an ordinary server log.

Who we are

This site is operated by Jagger Storage, LLC, a limited liability company organized in Kentucky and doing business as Jagger. We are responsible for the personal information described here, and you can reach us about anything on this page at support@jaggerstorage.com.

What this policy covers

This policy covers the public website: the marketing pages (the home page, Features and About), the waitlist form, the demo request page, these legal pages, and the account pages for both staff and the customer portal. It also covers the demo itself, at demo.jaggerstorage.com.

Apart from the demo, it does not describe what happens inside the Jagger application, because the application is not open to the public and is not being offered to customers. When that changes, this policy will be replaced with one that describes it.

What we collect when you browse

Nothing directly from you. Apart from the waitlist and demo request forms, which are described below, nothing on the marketing pages asks you to type anything. They load no tag manager and no advertising or social pixels, and the fonts and images come from our own servers. The only script loaded from anywhere else is the traffic measurement described next.

We do measure traffic, using Vercel Web Analytics. It records a page view with the time, the address of the page, the site that referred you if there was one, an approximate location derived from your connection — country, region and city, not a street — and your device type, operating system and browser version. It does not set a cookie, does not store your IP address, and does not follow you to any other website. Visits are grouped using a hash of the request that is thrown away after 24 hours, so we cannot tell that today's visitor and yesterday's were the same person.

Our hosting provider keeps ordinary server logs for every request, as essentially every web host does. Those logs include your IP address, your browser's user-agent string, the page requested, the time, and the response. We use them to keep the site running and secure, and for nothing else.

If you join the waitlist

Joining the waitlist is optional. It is separate from requesting a demo: doing one does not sign you up for the other.

The form itself asks for two things: your email address, and roughly how many facilities you operate. Neither is verified, and we do not ask for your name.

Alongside them we record, automatically: the IP address the submission came from, your browser's user-agent string, the page you were on when you submitted, the address of the site that referred you if there was one, and any campaign parameters in the link you followed. We also store a copy of the exact consent wording you agreed to, the version of it, and the fact that it was a ticked checkbox on a web form — so that if you ever ask what you agreed to, we can show you rather than paraphrase.

We keep a one-way fingerprint of your address as well as the address itself. That fingerprint is what lets us honour an unsubscribe without keeping a readable list of people who have left.

We use this to email you about Jagger: build updates, product news and, as the consent says, promotional messages. We do not use it for anything else, we do not sell it, and we do not share it with anyone beyond the mail provider named below.

You can leave at any time. Every email carries an unsubscribe link, and most mail apps also offer a one-click unsubscribe of their own, which we honour. Leaving stops all list email immediately. If you would rather be erased entirely rather than suppressed, write to us and we will remove the record.

If you request a demo

The demo request form asks for one thing: your email address. It is not verified, and we do not ask for your name or your company.

When you send it, we create a guest account for you in the demo, email you a one-time sign-in link, and send ourselves a short note containing your address so that we know who asked. We may reply to you personally about the demo. Requesting a demo does not add you to the waitlist or to any mailing list, and we do not send you marketing email because of it.

Your address is not stored in the demo. The guest account is created under a code worked out from your address with a one-way function and a secret key, so that other people using the demo cannot see who you are, and the account's name is simply “Guest”. Alongside that code we keep the dates you first and most recently asked, how many times you have asked, and when your access ends. Asking again with the same address produces the same code, which is how we renew your access rather than creating a second account.

To stop the form being used to flood someone's inbox, we count requests by the IP address they came from and by a one-way fingerprint of the address, and cap how many links any one address can receive in a day. Those counters are used for nothing else and are deleted in routine cleanup.

Inside the demo

The demo is a copy of the application filled with made-up information about a fictional storage facility. The people, units, payments and messages in it are invented.

It is shared. Everything you type into it can be seen by anyone else using the demo at the same time, and all of it is erased when the demo is rebuilt, every night at 4 a.m. Central. Please do not enter real information about yourself or anyone else.

Nothing in the demo reaches the outside world. Emails you send from it are recorded inside the demo but never delivered, and texting and card payments are switched off.

Signing in to the demo is recorded in the demo's own security log, the same way as on the account pages: the time, the IP address and your browser's user-agent string, filed under your guest code rather than your email address. The demo uses the same essential sign-in cookies described below and nothing more.

What we collect on the account pages

Signing in asks for your email address and your password. Requesting a password reset asks only for an email address. Public account creation is closed, so there is no sign-up form here to fill in; accounts are issued directly. If we open sign-up later, creating a staff account will also ask for your full name, and creating a customer portal account will ask for your full name, email address, password, and an organization code that links the login to a storage account your facility already has on file.

Your password is passed straight to our authentication provider to be checked or stored. Our own code never stores it and never writes it to a log.

Separately, we keep a security log of authentication events: signing in, signing out, a failed sign-in, an account lockout, creating an account, requesting or completing a password reset, sending a verification email, and second-factor activity. A record holds, where we have them, the email address (as it was typed, normalised to lowercase), the IP address the request came from, the browser's user-agent string, the type of event, and the time. A lockout record is the exception — it stores only the email and the time. A password-reset record also notes whether the reset email was actually sent.

Because the address is recorded when the request is made, an attempt using a mistyped, borrowed, or invented email address still creates a record containing that address and the IP address it came from — even though no account exists for it.

Submitting the sign-up or password-reset form also causes an email to be sent to whatever address was entered. We limit how often that can happen from one address or one network, but we cannot verify in advance that the address belongs to the person typing it.

Why we collect it

To let people we have authorized sign in, and to keep them signed in.

To protect the account pages from abuse. The security log is what lets us rate-limit by IP address, lock an account after repeated failures, and tell whether someone is trying to break into an account.

To keep the site working, and to fix it when it breaks.

To email the people who asked to be told when Jagger opens, and to prove — if it is ever questioned — that they asked.

To give people who ask a working demo, to know who asked, and to keep the demo request form from being abused.

We do not use any of it for advertising, we do not build profiles from it, and we do not send marketing email to anyone who has not asked for it. We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

Cookies and browser storage

We use essential cookies only, and only once you sign in. The main one is the session cookie set by our authentication provider, which holds your sign-in token. Alongside it we set small cookies recording which organization and facility you are working in, one marking a device as trusted if you choose that when entering a second factor, and — for our own staff only — one recording which organization is being viewed for support. All of them exist to make signing in work. There is no advertising or personalization cookie anywhere on this site, and our traffic measurement does not use one either.

Two things touch your browser's own storage rather than ours. The site reads a stored value called "theme" to decide whether to render light or dark. And if part of the page fails to download, a recovery script writes a counter and a timestamp to session storage so the page can reload itself once and then clear them. Neither contains anything personal, and neither is sent to us.

Do Not Track and cross-site tracking

We do not respond to browser "Do Not Track" signals, because we do not track you across websites in the first place and there is nothing for the signal to switch off.

No other party collects personal information about your activity across different websites when you use this site. There are no third-party trackers, pixels, or embeds on it.

Who else sees it

We use a small number of service providers to run this site. They handle information on our instructions and for no purpose of their own.

Vercel hosts the site and runs its servers. It handles and logs every request, including your IP address and user agent. Vercel also provides the traffic measurement described above, which it receives directly — anonymously, and without a cookie.

Supabase provides our authentication and our database, including the separate database that runs the demo. It receives your email address and password when you sign in or create an account, sends the verification and password-reset email, stores the security log described above, and keeps its own service-side logs, which include the IP address a request came from.

Resend delivers our email. If you join the waitlist it receives your email address and the message itself, and it records whether that message was delivered, bounced or was marked as spam so that we stop sending to addresses that do not work. If you request a demo, it receives your address and the sign-in email we send you, and the note we send ourselves. It is not used to profile you and it does not email you on its own behalf.

Sentry provides error and performance monitoring. Where it is switched on for a deployment, it may receive the error, the page or action involved, and technical context about the request, from our servers and from your browser. We have not enabled its session replay, its performance profiling, or its option to attach IP addresses and cookies to reports, and request headers and cookies whose names look sensitive are stripped before anything is sent.

We may also disclose information where the law requires it, to respond to a valid legal request, or where it is necessary to protect our rights, our users, or the security of the site.

How long we keep it

We do not currently delete security log records on a schedule. Assume that the email address, IP address, and user agent captured on a sign-in or password-reset attempt are kept indefinitely unless you ask us to remove them. If you want a record removed, write to support@jaggerstorage.com and we will delete it, unless we need it for an open security investigation.

Closing an account does not by itself clear those records: they are deliberately kept separate from the account so that a record of an attack survives the account it targeted. Ask us and we will remove them.

Waitlist records are kept to a schedule, and it runs automatically. A signup that is never completed is deleted after 30 days. Sign-up tokens are deleted 90 days after they are used or expire. The IP address and user-agent string captured when you joined are erased after 12 months, leaving the address and your consent record behind — the parts that are the point, without the parts that identify a device. If you unsubscribe we keep the one-way fingerprint of your address indefinitely, because forgetting it would mean emailing you again.

Demo access lasts 7 days from your most recent request. After that your guest account is locked, and it is kept, still under its code, so that asking again restores it. Anything you entered inside the demo is gone by the next nightly rebuild. Demo sign-in records are kept like the other security records above. To have your guest account and its records deleted, write to support@jaggerstorage.com from the address you used and we will remove them.

Session cookies last as long as your sign-in session and expire on their own. Server logs held by our hosting and authentication providers are kept on those providers' own schedules, which we do not control.

How we protect it

The site is served over HTTPS with a content security policy and other protective headers. Sign-in attempts are rate-limited by IP address, and an account locks after repeated failures. Accounts can use an authenticator app as a second factor. Your password is handled by our authentication provider and is never stored or logged by our own code. Security log records are protected so that a signed-in person can only ever read their own.

No website is perfectly secure, and we cannot promise these measures will always be enough.

Your choices and requests

You can read this entire website without giving us anything. If you never join the waitlist, request a demo or use an account page, we hold nothing about you beyond the server logs described above.

There is no self-service way to review or change this information, because there is so little of it. Write to support@jaggerstorage.com instead and we will tell you what we hold about you, correct it, or delete it. We will reply within 45 days, and we will not treat you differently for asking.

Children

Jagger is a business tool for people who operate self-storage facilities. This site is not directed to children under 13, and we do not knowingly collect personal information from them. If we learn that we have, we will delete it.

Changes to this policy

If we change this policy we will post the new version here and update the "last updated" date at the top of the page. If a change is material, we will say so on this page. This policy will change substantially once the product is actually available to customers, because there will be a great deal more to describe.

Contact

Privacy questions and requests: support@jaggerstorage.com.