← JAPS

Privacy

Last updated: 1 November 2026

JAPS (Just Another Portfolio Site) turns your GitHub repositories and Netlify sites into a portfolio. This page says what JAPS stores, where it goes and how to delete it. JAPS is run by Juraj Paluš as a personal project; the source code is public at github.com/Jurgo88/japs.

What JAPS stores

• Your GitHub profile: user id, username, name and avatar URL, from signing in.
• Access tokens for GitHub, Netlify and Cloudflare (if you connect them), and an AI key if you add your own. They are encrypted (AES-GCM) before they are stored, used only on the server, and never sent back to your browser.
• What JAPS finds in your accounts: the list of your Netlify sites, Cloudflare Pages projects and GitHub repositories, and for the projects you pick, facts such as languages, frameworks, dates, commit counts and README excerpts.
• Your portfolio: the profile texts, settings and generated project texts you edit in JAPS.
• Screenshots (desktop and mobile) of the live sites of the projects your portfolio shows, taken with Cloudflare's browser service. They are only visible to you until you publish.
• A portfolio on japs.app, if you publish there: the built site, public at your address, and the address you picked.
• Usage: how many AI generations and tokens you used per month, to apply the free limit.

GitHub access is read-only. JAPS sees private repositories only where you install the JAPS GitHub App on them.

Who else receives data

• The AI provider. To write project texts, JAPS sends the facts of the projects you picked (including README excerpts, also from private repositories) to OpenAI, or to the provider of your own key if you added one. Nothing is sent for projects you didn't pick. A project marked “anonymize” is sent without its name, description, URLs or README. The provider handles the data under its API terms.
• Cloudflare hosts JAPS (Workers, D1 database, R2 storage, portfolios on japs.app) and processes requests and stored data on JAPS's behalf.
• PostHog stores session recordings in the EU.
• GitHub, Netlify and Cloudflare receive the requests JAPS makes with your tokens, as they would from any app you authorize.
• GitHub Actions builds your site when you press Publish: it receives the portfolio you are about to publish (texts and screenshots) and nothing else. Your Netlify token stays with JAPS. The build log is public and shows only counts, never your content.

JAPS has no ads and does not sell or share data with anyone else.

Statistics

• Visits to japs.app are measured with Cloudflare Web Analytics, which uses no cookies and doesn't identify visitors.
• Visits to portfolios published from JAPS are counted so their owner can see them under Stats. A small script sends the page path and the host of the referring site. JAPS adds the visitor's country, taken from the connection, and keeps only daily counters for 30 days. It stores no IP address and no visitor identifier, and sets no cookies. Browsers with Do Not Track or Global Privacy Control are not counted. Owners can switch this off under Stats; it applies from their next publish.
• Session recordings of japs.app. PostHog records page layout, mouse movement, clicks and the pages you open, starting when the page loads, and a notice tells you so. All text, inputs and images are hidden, and JAPS doesn't link a recording to your account.
• Session recordings of Juraj Paluš's own portfolio, jurgo.japs.app. PostHog records what the visitor sees and does there, starting when the page loads, with a notice on screen. Portfolio text stays visible in the recording; anything typed is hidden. Portfolios of other people are never recorded.
• Recordings are stored by PostHog in the EU for up to 3 months, without IP addresses. They stop when you press No thanks, and don't start if your browser sends Do Not Track or Global Privacy Control. On japs.app you can change your answer with the Session recording link on the sign-in page or in your account settings.

Cookies

Two cookies, both needed for signing in: a session cookie (30 days, only a random value; the server stores its hash) and a short-lived cookie that protects the GitHub and Netlify sign-in from forgery (10 minutes).

Your answer to the session recording notice is kept in your browser's local storage. PostHog itself stores nothing on your device.

How long, and how to delete it

Data is kept while you have an account. Profile → Delete account deletes your account and everything listed above at once and revokes JAPS's GitHub and Cloudflare authorizations. To be thorough, also remove the app on GitHub → Applications and in Netlify under User settings → Applications, and on Cloudflare under Profile → Access management → OAuth authorizations. A portfolio you already published stays on your Netlify until you delete that site there. A portfolio on japs.app goes offline right away; its address then says the portfolio is gone for 60 days, so nobody else can take it over at once, and becomes free after that.

Your rights

You can see and change your data in the editor, and delete it at any time. For any other question or request (for example under the GDPR), open an issue at github.com/Jurgo88/japs/issues.

Terms of use