Privacy Policy

Last Updated: 19 August 2026
Effective Date: 31 August 2025

1. Introduction

Welcome to JutJut ("we", "our", or "us"). We are committed to protecting your personal information and your right to privacy, especially for our young users. If you have any questions or concerns about this privacy policy or our practices with regards to your personal information, please contact us at hello@jutjut.co.uk.

This privacy policy applies to all information collected through our website and mobile application (collectively, the "Platform"), and any related services, sales, marketing, or events.

Important for Young Users: If you are under 18, we encourage you to review this policy with a parent or guardian. If anything is unclear, please ask an adult you trust to help explain it.

2. Age Requirements and Verification

2.1 Minimum Age

• Our Platform is designed for users aged 14-18

• Users under 14 are not permitted to create accounts

• We verify age during registration

2.2 Parent/Guardian Involvement

• Users under 14 are not permitted to create accounts

• Parents/guardians can request access to their child's account information (ages 14-17)

• We may contact parents/guardians for consent where required by law

3. Information We Collect

3.1 Information You Provide

• Account Information: Email address, auto-generated display name, date of birth

• Profile Information: School year, interests, location (optional), default thought visibility preference

• Interaction Data: Saved opportunities, comments, ratings, thoughts (career insights you share)

• Communications: Messages you send to us or through the Platform

3.2 Information Collected Automatically

• Device Information: Device type, operating system, browser type

• Usage Data: Pages visited, features used, time spent on Platform

• Location Data: General location (city/region) based on IP address

3.3 Information from Third Parties

• Authentication Providers: When you sign in using Supabase

• Opportunity Sources: Public information about opportunities from partner organizations

3.4 Organisation Accounts

If you register as an organisation to post opportunities, we also collect:

• Organisation Details: Organisation name, website, and (optionally) a charity or company registration number

• Verification Contact: A contact phone number and email for the organisation's administrator, used to confirm the organisation is genuine before any of its content reaches young people

This organisation-administrator contact information is personal data that we process under our Legitimate Interests (verifying organisations that post to 14–18-year-olds, to keep the Platform safe). It is accessible only to our administrators, is never shown publicly, and is removed when the associated account is deleted.

4. How We Use Your Information

We use your information to:

• Provide and maintain our Platform

• Show you relevant opportunities based on your age and interests

• Send you updates about new opportunities (with your consent)

• Improve our services and develop new features

• Ensure Platform safety and prevent misuse

• Comply with legal obligations

4.1 Legal Basis for Processing (UK GDPR)

We process your data based on:

• Consent: For marketing communications and analytics

• Contract: To provide our services to you

• Legitimate Interests: For Platform improvement and safety

• Legal Obligations: When required by law

5. Thought Visibility and Privacy Controls

JutJut includes a "Thoughts" feature where you can share career insights and reflections (similar to Twitter). We prioritize your privacy with these controls:

5.1 Privacy by Default (UK Children's Code Standard 7)

• New accounts default to "Contacts Only" visibility - Only people you've approved as contacts can see your thoughts

• You must explicitly choose "Public" visibility if you want your thoughts viewable by anyone

• This protects you by default, while allowing you to share publicly if you choose

5.2 Visibility Settings

You can set a default visibility for all your thoughts in Settings, and change individual thought visibility when posting:

Contacts Only (Recommended):

• Only your approved contacts can view the thought

• Comments on the thought inherit the same privacy level

• This is the most privacy-protective setting

Public:

• Anyone on the internet can view the thought, even without logging in — including people you don't know

• Your username and avatar will be visible to the public alongside it

• We tell search engines and AI systems not to index thought pages, but we cannot guarantee every service honours this. Anyone who can view a public thought can also copy or share it, so it may stay visible elsewhere even after you delete it or make it private

• Think carefully before choosing this option

5.3 Comment Visibility

• Comments on thoughts inherit the thought's visibility setting

• If a thought is "Contacts Only", only those contacts can see comments

• If a thought is "Public", all comments are public

5.4 Changing Settings

You can change your default thought visibility at any time in Profile Settings → Privacy. Individual thoughts can be edited after posting to change their visibility.

6. Username and Identity Protection

We automatically protect your identity with privacy-first username practices:

6.1 Auto-Generated Usernames

• When you create an account, we automatically generate a unique username for you

• These usernames are designed to be non-identifiable (not based on your real name)

• You'll see your auto-generated username during onboarding

6.2 Username Changes

You can change your username at any time, subject to these rules:

First change:

• No waiting period - you can change immediately

Subsequent changes:

• Second change: 24-hour cooldown

• Third change: 3-day cooldown

• Fourth and beyond: 7-day cooldown

Privacy improvements bypass cooldowns:

• If you're changing from an identifiable username (like "JohnSmith2007") to a less identifiable one (like "CareerExplorer23"), you can change immediately

• This ensures you can always quickly fix privacy mistakes

6.3 What Others See

• Your username is visible on all content you create (thoughts, comments)

• Your profile shows your username and any information you choose to make public

• You control what additional profile information is visible to others

7. Cookies and Tracking Technologies

7.1 Essential Cookies

These are necessary for the Platform to function:

• Authentication cookies (keeping you logged in)

• Security cookies (protecting your account)

• Session cookies (remembering your preferences during visits)

7.2 Analytics Cookies (Optional)

With your consent, we may use analytics services to understand how users interact with our Platform:

• These help us improve JutJut but are not required for it to work

• You can opt-out at any time through your settings

7.3 Managing Cookies

• You can control cookies through your browser settings

• Refusing essential cookies may prevent you from using the Platform

• We will ask for your consent before placing any non-essential cookies

8. Data Sharing and Disclosure

8.1 We DO NOT Sell Your Data

We never sell your personal information to third parties.

8.2 Service Providers

We share data with:

• Supabase: For authentication services

• MongoDB: For data storage (hosted securely)

• Analytics Services: For usage analytics (only with your consent)

8.3 Legal Requirements

We may disclose information if required by:

• Law enforcement requests (with proper legal authority)

• Court orders

• Child safety concerns

9. Data Storage and Security

9.1 Where We Store Data

• Your data is stored on secure servers in the UK/EU

• We use MongoDB for database storage

• All data is encrypted in transit and at rest

9.2 Security Measures

• Encryption of sensitive data

• Regular security audits

• Limited access to personal information

• Secure password requirements

9.3 Data Retention

• Account data: Kept while your account is active

• Deleted accounts: Personal data removed within 30 days

• Analytics data: Aggregated and anonymized after 14 months

• Legal requirements: Some data may be retained longer if required by law

10. Your Rights Under UK GDPR

You have the right to:

• Access: Request a copy of your personal data

• Rectification: Correct inaccurate information

• Erasure: Request deletion of your data ("right to be forgotten")

• Restriction: Limit how we process your data

• Portability: Receive your data in a portable format

• Object: Object to certain processing activities

• Withdraw Consent: Change your mind about permissions you've given

10.1 Exercising Your Rights

To exercise any of these rights:

• Email us at hello@jutjut.co.uk

• Include your account email and specific request

• We will respond within 30 days

10.2 Parental Rights

Parents/guardians of users under 16 can:

• Request access to their child's information

• Request deletion of their child's account

• Withdraw consent for data processing

11. International Data Transfers

If we transfer data outside the UK:

• We ensure appropriate safeguards are in place

• We comply with UK GDPR requirements for international transfers

• You will be notified of any significant changes

12. Updates to This Policy

We may update this privacy policy from time to time:

• We will notify you of material changes via email or Platform notification

• Continued use after changes means you accept the updated policy

• Previous versions will be archived and available upon request

13. Contact Information

13.1 Data Controller

JutJut Limited
Registered office: Mayflower House, St. Johns Hill, Bungay, England, NR35 1PH
Registered in England and Wales, company number 16591693

13.2 Contact Us

• Email (including privacy and data protection enquiries): hello@jutjut.co.uk

13.3 Supervisory Authority

You have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: https://ico.org.uk

• Phone: 0303 123 1113

• Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

14. Special Note for Young Users

Your Privacy Matters!

• Never share your password with anyone

• Be careful about sharing personal information

• If something makes you uncomfortable, tell a trusted adult

• You can always contact us if you have questions

---

Acknowledgment
By using JutJut, you acknowledge that you have read and understood this Privacy Policy. If you are under 16, you confirm that you have your parent's or guardian's permission to use our Platform.