Privacy Policy

Who we are

Jussora is run by Xuefei Tao, called "Jussora", "we" and "us" here.

This policy covers this website, the Jussora web app, the Jussora iPhone app, the developer console, and the Jussora API, including the gateway that agents call. Write to privacy@jussora.com about anything in it.

What Jussora does

Jussora sits between AI agents and the accounts you use them with. An agent is a program that acts for you, such as an assistant in another company's app or a program you run yourself, such as Claude Code. A provider is a service whose account you connect, such as GitHub, Gmail or Notion. For each agent you choose, tool by tool, whether it may use the tool, must ask you first, or may not use it. Nothing is allowed until you choose. Jussora holds the connection and places each call itself, so the agent never receives your password or your provider tokens.

What we collect

Your account

• Your email address.
• If you set a password, a one-way hash of it, kept by our sign-in service. We never see the password itself.
• If you continue with Google or Apple, what they share with us: your email address, your name and picture if they give them, and their identifier for you. If you continue with Apple, we also keep a token Apple issues, encrypted, so that we can withdraw your Sign in with Apple authorization when you delete your account, as Apple requires.
• Sign-in records: when you signed in, and the IP address and the browser or app you used.

Your provider connections

• The access token, and usually a refresh token, that a provider issues to Jussora when you connect it. Both are encrypted before they are stored.
• The name of the connected account at the provider, such as your GitHub username or your Gmail address, so you can tell which account is connected; the permissions the provider granted; and when you connected and disconnected it.
• Which tools each account has is read from the provider when it is needed and is not stored, except a note of any new tool you have not yet decided about.

Your agents and your choices

• Which agents you connected, and when you accepted each one.
• What you chose for each tool for each agent: allow, ask or block.
• For a program you gave access to yourself, such as Claude Code: the name it gives itself, the address where it publishes its identity, and when you gave it access and when it was last used. We keep only one-way hashes of the tokens it holds.

The calls agents make

• Every call an agent makes through Jussora, whether it was placed, waited for you, or was refused: the agent, the tool, the arguments the agent sent, the time, what became of it, and, once placed, what the provider returned or, if it failed, the provider's reason.
• For each call that asked you: the tool's description, as you were shown it, and your decision.
• Questions an agent asks you through Jussora, and your answers.

Arguments and results contain whatever the tool handles. For an email tool that can be the text of a message, and for a calendar tool the people invited to an event. So the record of your calls can hold information about you and about other people.

Identifiers developers give us for you

When a developer's app invites you to connect its agent, the developer sends Jussora its own identifier for you, which may be your email address or an account number in its system. We keep it with the invitation link and, once you accept, with your connection to that agent, so that the agent can say whom it is acting for. If you never open the link, the identifier is deleted with it, a week after the link expires. The app does not show you these identifiers.

Your phone

If you use the iPhone app, the push notification token Apple gives your phone, so that we can notify it. It is removed when you sign out on that phone, and when you delete your account.

Technical data

• Server logs: the IP address of each request, its method, path and time, and how we answered. We remove the query string, the part of an address after a question mark.
• Counts of how often an IP address, an account or an agent reached us in the current minute or day, used to stop abuse and deleted five minutes after that minute or day ends.
• An audit log of events, such as a provider connected, an agent accepted, a tool's setting changed or a request decided. It holds identifiers and times, never names, email addresses, or the content of calls.

If you are a developer

Your email address and name; your agents, with their names, descriptions and the providers they may use; a one-way hash of each agent's API key with its first few characters and when it was last used; the invitation links you make; and the identifiers you give us for your customers.

If you visit this website

jussora.com sets no cookies and runs no analytics. It is hosted by GitHub Pages, which logs visitors' IP addresses for security under GitHub's own privacy statement, and its domain names are served by Cloudflare.

If you write to us

Your email address and what you write.

None of Jussora's apps or this website contains advertising, analytics or tracking code.

How we use it

Who receives it

The agents you connect, and whoever runs them

An agent receives the result of each call you allowed or approved, your answers to its questions, whether a call is waiting, approved or refused, and the names and descriptions of the tools it may use. That is the point of connecting it, and it is why you choose tool by tool.

• An agent in another company's app is run by that company, its developer, who decides what it does with what it receives under its own privacy policy. Our Developer Terms require every developer to protect what their agent receives at least as well as this policy describes.
• A developer can also ask Jussora whether you have accepted its agent, whether its calls will work, whether one of your providers needs reconnecting, and whether a link it made for you was opened by someone else.
• A program you gave access to yourself, such as Claude Code, receives results wherever you run it, and may send them to the AI model it uses, under that program's own terms.

No agent and no developer receives your provider tokens, your password, your Jussora account details, or your email address unless it already had it or a result contains it. None is told whether a tool it may not use was blocked by you, left undecided, or is missing from your account, or whether you declined to link a second identifier.

Before you allow a tool, think about what its results contain. An agent that may read your email receives your email, and so does whoever runs it.

The providers

Each call you allowed or approved goes to its provider with your token. Jussora also reads the list of tools in your account from the provider: when an agent asks which tools it may use, before asking you about a call, when you choose an agent's tools, and otherwise about once a day. The provider handles what it receives under its own terms and privacy policy. Providers are services you chose to use, not services Jussora uses for itself.

Companies that run parts of Jussora for us

Each processes data only to provide its service to us, under a contract. Apple and Google also decide for themselves how they handle your Apple ID and your Google account, under their own privacy policies.

Anyone else

We may also disclose it when the law requires it, to protect someone's safety or rights, or to investigate fraud or abuse, and, if Jussora is merged or sold, to the company that takes it over. For Google user data, that last needs your prior consent.

Google user data

This section says how Jussora handles data it receives from Google's APIs, as Google's rules for apps require.

Jussora's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace APIs will adhere to the Google Workspace user data and developer policy, including the Limited Use requirements.

What Jussora asks Google for

• Gmail. When you connect Gmail, Jussora asks for your email address and for permission to read, draft, send and label your mail (the gmail.modifyscope). This scope cannot delete mail permanently. Jussora uses it only for the Gmail tools you let an agent use: sending a message, creating a draft, searching and reading threads and messages, changing a thread's labels, and listing and creating labels.
• Google Calendar. When you connect Google Calendar, Jussora asks for your email address and for permission to see and change events, list your calendars, and see when you are free or busy (the calendar.events,calendar.calendarlist.readonly and calendar.events.freebusyscopes). It connects separately from Gmail, so connecting one never gives access to the other.
• Continue with Google. When you sign in with Google, Jussora receives your name, email address and picture, and nothing from your mail or calendar.

How it is used

Only to provide the features you see in Jussora: placing the Gmail and Calendar calls you allowed or approved for an agent you chose, showing you which account is connected and which tools it has, and signing you in.

Who it goes to

• To the agent you chose, at your direction: only through tools you set to allow for that agent, or a call you approved. This is the feature you set up in Jussora.
• To the companies above that run Jussora for us, to provide it.
• When needed for security, such as investigating abuse.
• When the law requires it.
• In a merger or sale of Jussora, only with your prior consent.

Jussora does not sell Google user data, does not transfer it to advertising platforms, data brokers or information resellers, and does not use it to serve advertising or to decide on credit or lending. It does not use or transfer it to create, train or improve a machine learning or artificial intelligence model beyond a model personal to you for a feature you use. People at Jussora do not read it unless you agree to it for specific messages or data, it is needed for security, such as investigating abuse, the law requires it, or it is aggregated and used to run Jussora as the law allows.

Our Developer Terms bind every developer whose agent receives Google user data through Jussora to the same rules.

How it is kept and deleted

Google tokens are encrypted before they are stored, and are never given to any agent or developer. Results of Gmail and Calendar calls are kept as described under How long we keep it. Disconnecting Gmail or Google Calendar in Jussora's Settings removes every agent's access to it, and deleting your account deletes the Gmail and Calendar data Jussora holds. You can also remove Jussora's access in your Google Account at myaccount.google.com/connections.

How long we keep it

When you delete your account

Delete account, in Settings on the web or in the iPhone app, takes effect at once. In one step it deletes your account, your provider connections with their tokens, your agents' connections and the identifiers developers gave us for you, your choices, your calls with their arguments and results, your requests and answers, your phones, and any program's access. Unless the same sign-in also holds a developer account, the sign-in is deleted too, and any Apple token we hold for it is withdrawn at Apple.

Four things remain after that.

• The audit log keeps its entries. They contain identifiers that no longer point at anything, and never your name or email address.
• Backups keep a copy until they expire.
• Jussora does not withdraw its access at your providers. Our copies of the tokens are deleted, so the access listed in your GitHub or Google settings can no longer be used, and you can remove it there.
• Whatever an agent already received stays with whoever runs it. Ask its developer to delete it.

A developer account is deleted the same way, from the console's Account page. An agent that appears in a person's history is kept, without an owner and without access, for as long as that history names it.

How we protect it

Provider tokens and Apple tokens are encrypted before they are stored, with a key that is not kept in the database. To report a security problem, write to security@jussora.com.

Seeing, changing and deleting your data

In the app

• See which providers you connected under Settings, Connected accounts, which agents you accepted and what each may do under Settings, Agents, and the calls agents made in your history.
• Change what any agent may do, or remove an agent, under Settings, Agents.
• Disconnect a provider, under Settings, Connected accounts.
• End a program's access, under Settings, Agents, on that agent's card.
• Delete your account, under Settings, Account on the web, or Settings in the iPhone app.

By writing to us

There is no screen for changing your email address or name, for seeing the identifiers developers gave us for you, or for seeing what providers returned to your calls. Write to privacy@jussora.com about them. If you cannot use Delete account yourself, write to the same address to ask for your account to be deleted.

Do Not Track

Jussora does not track you across other websites or apps, and lets no advertiser, analytics service or anyone else do so through its own. A browser's Do Not Track signal therefore changes nothing here: there is no tracking for it to turn off.

Children

Jussora is not directed at children under 13, and is not for them. We do not knowingly collect personal data from children under 13.

Changes to this policy

We post any change to this policy here, with a new date at the top.

Contact

• Xuefei Tao
• Privacy: privacy@jussora.com
• Help with your account: support@jussora.com
• Security: security@jussora.com