Last updated: February 24, 2026
Privacy Policy
Janus is built on the principle that privacy is an architectural decision, not a compliance checkbox. This policy explains exactly what data we collect, how we use it, and what we don't do.
What We Collect
Account Data
When you create an account, we collect your email address and a password. Your password is hashed with bcrypt before storage — we never store or have access to your plaintext password.
Event Data
When your users interact with your application through the Janus SDK, the following data may be collected depending on your integration:
- Event type and custom payload
- Tags you define
- Session ID and visitor ID (anonymous identifiers)
- Page URL and referrer
- Browser, operating system, and device type (parsed from user agent)
- Country (derived from IP address via local GeoIP lookup, then discarded — see below)
What We Don't Collect
- No IP addresses stored. We derive a country code from the IP using a local MaxMind GeoLite2 database, then immediately discard the IP. It is never written to our database.
- No cookies. Janus does not set any cookies on your users' browsers.
- No fingerprinting. We do not use canvas fingerprinting, audio fingerprinting, or any other browser fingerprinting technique.
- No third-party analytics. We do not run Google Analytics, Meta Pixel, or any other third-party tracking on the Janus platform itself.
How Data Is Stored
Your data is stored in a PostgreSQL database. Authentication uses JWT tokens stored in your browser's localStorage (not cookies). All security-sensitive tokens (email verification, password reset) are SHA-256 hashed before storage.
Data Retention
Event data retention depends on your plan:
- Free — 3 months
- Pro — 12 months
- Enterprise — Unlimited
Expired event data is automatically and permanently deleted by a daily cleanup process running at 3:00 AM UTC. Expired authentication tokens are cleaned up daily at 4:00 AM UTC.
Third-Party Services
- Resend — We use Resend to deliver transactional emails (verification, password reset). Your email address is shared with Resend solely for delivery purposes.
- MaxMind GeoLite2 — We use a locally hosted GeoIP database to derive country codes. No user data is sent to MaxMind.
Your Rights
You have the right to:
- Delete individual events from your event log at any time
- Request complete account deletion, which cascade-deletes all associated data (projects, API keys, events)
- Request access to all data we hold about you (GDPR right of access)
- Request erasure of your data (GDPR right to erasure)
Security
We protect your data with bcrypt password hashing, SHA-256 token hashing, tier-aware API rate limiting, and allowed-origin restrictions on API keys. All traffic is served over HTTPS.