Last updated: October 13, 2026
This Privacy Policy explains which personal data JustX processes when you use our website and application at justx.world (the "Service"), for which purposes, and on which legal basis. If this English version differs from the German Datenschutzerklärung, the German version prevails.
The controller under the General Data Protection Regulation (GDPR) is:
See the Legal Notice / Impressum for more details. No data protection officer has been appointed, as there is no legal obligation to do so.
JustX is an AI personal assistant. It answers questions, searches the web, compares offers, creates texts, images and presentations, keeps appointments in a built-in JustX calendar and – only after your explicit confirmation – sends booking requests by email to businesses (e.g. restaurants, clinics, hotels).
When you sign up we process your email address and password (stored only as a hash) or – if you sign in with Google – your name, email address and Google identifier. Purpose: providing your account. Legal basis: Art. 6(1)(b) GDPR (contract).
We process the texts you send JustX, your conversation history and any images or PDF files you attach. To generate replies, this content is sent to our AI provider; for web searches, search terms are sent to a search service (see Section 4). Legal basis: Art. 6(1)(b) GDPR.
JustX may store durable facts from your tasks (e.g. "lives in Berlin" or a recurring preference) so future replies can use that context. You can review and delete stored entries at any time in Settings. Legal basis: Art. 6(1)(b) GDPR.
Meetings and confirmed bookings are stored in your JustX calendar in our database (title, time, place, notes). If you have enabled notifications, we remind you before an appointment by push notification. Scheduled tasks (e.g. reminders, topic monitoring and notices about replies to booking requests) are run by a background service at our hosting provider Railway, which processes the necessary account and task data from our database for this purpose. An optional "Add to Google Calendar" link opens Google Calendar with the event pre-filled; the data is only sent to Google when you click that link yourself. JustX has no access to your Google account. Legal basis: Art. 6(1)(b) GDPR.
Only when you explicitly confirm a booking request does JustX send the email on your behalf from its own address (booking@justx.world) via our email provider to the business, with a copy to your email address. The email contains your name and the details of the request. To find the business's website and contact address, we send the business name and place (not your personal data) to a search service and to the Google Places API (Google). Replies from the business are received via our email provider and processed by JustX to show you the reply, notify you and add a confirmed time to your JustX calendar. JustX has no access to your mailbox. Legal basis: Art. 6(1)(b) GDPR.
For generated or edited images, your description and, where applicable, the attached photo are sent to our AI provider. For presentations we look up matching royalty-free photos on Pexels; only search terms (the presentation topic and slide titles) are sent. Legal basis: Art. 6(1)(b) GDPR.
If you use the microphone, your speech is converted to text by your browser's speech recognition. Depending on the browser, this may be done on the browser vendor's servers (e.g. Google for Google Chrome) under that vendor's privacy terms. We do not store audio recordings. If you have a reply read aloud, the reply text is sent to our AI provider for speech output. Legal basis: Art. 6(1)(b) GDPR.
Only with your consent (your browser asks you) we collect your approximate location once and convert it into a city/country (e.g. "Berlin, Germany") using the Nominatim (OpenStreetMap) reverse-geocoding service. Only the city/country is stored, never precise coordinates. Purpose: location-based searches and bookings. Legal basis: Art. 6(1)(a) GDPR (consent); you can withdraw consent at any time in your browser settings.
If you enable notifications, we store a push subscription created by your browser. Delivery runs through your browser vendor's push service (e.g. Google, Apple, Mozilla). Legal basis: Art. 6(1)(a) GDPR; you can turn notifications off at any time in Settings.
To enforce each plan's daily limits we count your daily requests. For use without an account (guest mode) we store a cookie and a salted hash of your IP address; we do not store the IP address itself. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is preventing abuse and limiting our costs.
Our hosting provider processes technically necessary data when you use the Service (e.g. IP address, time, page requested, browser type) for delivery, debugging and security. Vercel's server functions run in Frankfurt am Main, Germany; the Railway background service runs in Amsterdam, the Netherlands. Legal basis: Art. 6(1)(f) GDPR (secure and stable operation).
We use Vercel Web Analytics to understand how our website is used in aggregated form (e.g. page views, country, device type, referring page). It sets no cookies and builds no user profiles. Legal basis: Art. 6(1)(f) GDPR (improving the Service).
Paid plans are processed by Stripe. We only receive limited information (e.g. plan, payment status, customer reference); your full payment details are processed solely by Stripe. Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR (statutory retention duties).
If you contact us through the feedback form, we process your message, an optional screenshot, the page you were on and your browser type to handle your request and improve the Service. Legal basis: Art. 6(1)(f) GDPR.
When you play JustX Tower (justx.world/play), we store your best score and the number of games you played in your browser's local storage; guests can play a limited number of free games. If you are signed in and save your score to the world ranking, we process a player name you choose freely, your score (best and best of the day) and a country code (e.g. "DE") that our hosting provider derives from your IP address when you visit; we do not store the IP address itself for this. The player name, country flag and score are publicly visible in the ranking to all visitors, even without an account. Please therefore do not choose a name that identifies you (e.g. your real name). We check scores for plausibility and may change or remove names that are offensive or infringe laws or third-party rights; please send reports to info.justx.ai@gmail.com. Legal basis: Art. 6(1)(b) GDPR (taking part in the ranking at your request) and Art. 6(1)(f) GDPR (protection against manipulation, country display). You can have your entry deleted at any time by emailing us.
We only share data with service providers we need to run the Service and who act on our behalf:
| Provider | Purpose | Data processed | |---|---|---| | Vercel Inc. (USA) | Hosting, server functions (Frankfurt region), Web Analytics | Technical access data, aggregated usage statistics | | Railway Corporation (USA), server region Amsterdam | Background service for scheduled tasks and queue (Redis) | Account identifier, task and calendar data, search terms for topic monitoring, push subscription | | Supabase (database region Frankfurt) | Sign-in, database, file storage | Account data, tasks, calendar entries, stored files | | OpenAI (USA) | Replies, task planning, image generation, read-aloud | Your messages, task context, relevant memory facts, attached images | | Tavily (USA) | Web search | Search queries (may include city/country) | | Resend, Inc. (USA) | Sending booking requests and receiving replies | Business email address, email content, your name and email address | | Pexels | Royalty-free photos for presentations | Search terms (topic and slide titles) | | Stripe | Payment processing | Billing data | | Google LLC (USA) | Sign in with Google (only if you choose it) | Name, email address, Google identifier | | Google LLC (USA) | Google Places API: finding a business's website and contact details for booking requests | Business name and place | | OpenStreetMap Foundation (Nominatim, United Kingdom) | Converting location into city/country | Approximate coordinates (only with your consent) | | Browser vendors' push services | Delivering notifications | Push subscription, notification content |
According to OpenAI, data sent through its API is not used to train its models by default. We do not sell your data and do not share it with advertisers.
Some providers (including Vercel, OpenAI, Tavily, Resend, Railway, Stripe and Google) are based in the USA; for the provider in the United Kingdom there is an adequacy decision of the European Commission. Transfers there are based on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR).
We only use technically necessary cookies and entries in your browser's local storage: for sign-in, for limiting guest mode, for your language setting, for your game progress in JustX Tower (best score, number of games), and to carry over a message typed before signing in. These are strictly necessary for the Service you request (Section 25(2) No. 2 TDDDG). We do not use advertising or tracking cookies.
We keep account, task and calendar data for as long as your account exists. If you delete your account, we delete your personal data within a reasonable period unless statutory retention duties apply (e.g. tax rules for billing records). Daily usage counters only serve the daily limit. World ranking entries are kept as long as your account exists or until you ask for their deletion. Server logs are kept by our hosting provider for a short time only.
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR). Contact info.justx.ai@gmail.com. You can also delete memory entries directly in Settings.
Right to object (Art. 21 GDPR): Where we process data based on Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation.
You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, Hintere Bleiche 34, 55116 Mainz, Germany, www.datenschutz.rlp.de.
JustX generates replies and suggestions automatically using AI. However, there is no automated decision-making that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR). Bookings and other actions only happen after your explicit confirmation. AI replies can be inaccurate; please check important information.
Using the Service with an account requires an email address or Sign in with Google. All other information (e.g. location, notifications) is voluntary; without it, some features are unavailable.
The Service is not directed at anyone under 18. We do not knowingly collect data from children under 18. If you believe a child has given us personal data, please contact us so we can delete it.
We protect your data with appropriate technical and organisational measures, including encrypted connections (TLS) and access restrictions. No method of transmission or storage can guarantee absolute security.
We update this Privacy Policy when the Service or the law changes. We will inform you in advance of material changes. The version published here applies.