Privacy Policy

Last updated: 19 August 2026 · Effective: [LAWYER: effective date on publication]

1. What this covers

This policy explains what [JELLY ENTITY — Q14] (“Jelly”, “we”, “us”) collects when you use the Jelly iPhone app and the Jelly website at onjelly.com, what we do with it, and who else sees it.

It is written to describe what our systems actually do. Where we say we do not do something, we mean the system does not do it.

2. What we collect

2.1 When you create an account

• Email address. Your sign-in identifier.
• Password. Stored only as a scrypt hash with a per-account salt. We never store the password itself and cannot read it.
• Handle and name. Your handle is public. Only your first name is ever shown to other members.

2.2 Your profile

• Fit profile — height and sizes.
• A fit note, if you write one.
• Profile photo and bio, if you add them.
• Notification preferences.

2.3 Delivery details

• Delivery addresses — street, unit, city, state, ZIP, neighbourhood, and a label you choose.
• A contact phone number, if you give one.

Addresses and phone numbers are used solely to dispatch and complete a courier delivery. They are never shown to another member and never appear in any listing, order, message or public page.

2.4 What you do on Jelly

• Rentals and purchases — the Items, dates, delivery method, prices, fees, credits applied, refunds, late fees, cancellations, and the timeline of each order.
• Listings you create — photos, descriptions, brand, size, prices, and your policy settings.
• Reviews, saves, follows, and requests.
• Credits ledger — what was granted, why, and what was spent.
• Protection claims you open, and the photos and description you attach.
• Referrals — your referral code, who signed up with it, and which rewards were granted.

2.5 Messages

• Messages to other members, and your conversations with Mona, our in-app stylist.

2.6 If you join the waitlist

• Your email address, and the time you submitted it. Nothing else.

2.7 Technical

• Basic server logs — request paths, timestamps, IP address, and the error records our API produces. We use them to run and debug the service.
• Session tokens stored on your device to keep you signed in. Sessions expire after 30 days of inactivity.
• Failed sign-in attempts, held briefly in memory, to rate-limit password guessing.

3. What we do with it

• Run your account and keep you signed in.
• Show you Items in your size, in your city, free on your dates.
• Take payment, itemise it, apply credits, and pay lenders out.
• Book couriers and get an Item from one door to another.
• Show listings, reviews and closets to other members — within the limits in section 5.
• Send you notifications about your rentals: dispatch, delivery, returns, fees, payouts.
• Answer support requests and assess Protection claims.
• Detect and stop fraud, counterfeiting, and abuse of the Services.
• Keep the service working, and fix it when it does not.

We do not use your information to build advertising profiles, and we do not run behavioural advertising.

4. Who else sees it

4.1 Stripe — payments

Card payments and lender payouts are processed by Stripe. Your card details go to Stripe directly. Jelly never receives or stores your card number. Lender payouts run through Stripe Connect, and Stripe collects the identity and bank details it needs to pay you. Stripe handles that information under its own privacy policy.

4.2 Courier partners — delivery

When a delivery is booked, we send the pickup and drop-off addresses, and a contact phone number, to a courier partner — Uber Direct or DoorDash Drive. A courier needs an address to drive to it.

Jelly is the sender and recipient of record on every leg. The courier receives what it needs to complete the job. Members never receive each other’s addresses or phone numbers.

4.3 Service providers

We use hosting and infrastructure providers to run the app, the API and the website. They process data on our instructions and for no other purpose.

4.4 Legal

We may disclose information where the law requires it, or to protect the safety of members or the public, or to establish or defend a legal claim.

4.5 Business transfer

If Jelly is acquired or merges, member information may transfer as part of that transaction.

4.6 We do not sell your personal information

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. There is no advertising SDK in the Jelly app, no ad network integration in the API, and no advertising or analytics tracker on onjelly.com.

5. What other members see

Other members see, from your profile and your listings:

• your first name
• your handle
• your profile photo and bio, if you added them
• your neighbourhood — the area, not an address
• your height and fit note, if you added them
• your closet — the Items you have listed
• your reviews and rating

Other members never see your full name, email address, phone number, or street address. This is enforced in the code: every payload that can reach another member passes through a single shaping layer that strips those fields, and a test asserts it.

6. Mona

Mona is the stylist in the app. What you tell her is used to find Items you can actually book — your size, your dates, your city.

Mona’s replies are produced by Jelly’s own software running on Jelly’s servers. Your conversations with Mona are not sent to a third-party AI provider.

7. Cookies and the website

The Jelly website at onjelly.com sets no advertising cookies and runs no third-party analytics or tracking scripts.

The app stores a session token on your device so you stay signed in. That is not advertising technology and is not shared with anyone.

8. How we protect it

• Passwords are stored as scrypt hashes with a per-account salt, and compared in constant time.
• Sessions use opaque random tokens, expire after 30 days of inactivity, and are deleted on sign-out.
• Sign-in attempts are rate-limited.
• Addresses and phone numbers are held apart from every public and counterparty payload.

No system is perfectly secure.

9. How long we keep it, and how to delete an account

We keep your account information for as long as your account is open, and keep transaction records after that where we need them for accounting, tax, fraud prevention and legal claims.

There is no self-serve account deletion in the app today. To close and delete your account, write to [email protected] and we will do it.

10. Your rights

• State privacy laws. Rights to know, delete, correct, and opt out under the California Consumer Privacy Act and comparable state laws — including the categories-collected and categories-disclosed tables those statutes require, the request and verification process, the authorised-agent route, and the non-discrimination statement.
• New York. The SHIELD Act’s data-security obligations, and any New York-specific disclosure that applies to a New York-based marketplace.
• Sensitive information. Whether anything we collect is “sensitive personal information” as defined by those statutes.

Whatever the final drafting says, the underlying facts are the ones in sections 2 to 5.

11. Children

The Services are for people 18 and over. They are not directed to children, and we do not knowingly collect personal information from anyone under 13. Do not give us the personal information of anyone under 13 — for delivery or for any other reason.

If you believe a child has given us information, write to [email protected] and we will delete it.

12. Where your information is held

Jelly operates in the United States and holds member information in the United States.

13. Changes to this policy

If we change this policy we will post the new version here and update the date at the top. Where a change is material we will tell you in the app or by email.

14. Contact

[JELLY ENTITY — Q14]
Privacy and support: [email protected]