JAH AND CO

Privacy Policy

Effective Date: October 9, 2026

Jah and Co ("Jah and Co," "Company," "we," "us," or "our") is committed to protecting your privacy and being transparent about our data practices. This Privacy Policy explains what information we collect, how we use, share, and protect it, and the rights and choices available to you when you access or use our websites, browser-based games, apparel storefront, accounts portal, customer support services, and related applications (collectively, the "Services"), accessible via https://jahandco.com and its subdomains (including play.jahandco.com, shop.jahandco.com, accounts.jahandco.com, support.jahandco.com, and blog.jahandco.com).

Please read this Privacy Policy carefully. By using our Services or creating a Jah and Co account, you agree to the collection and use of your information in accordance with this Policy. If you do not agree, please do not use our Services.

1. Information We Collect

a. Information you provide directly

  • Account Information: When you create a Jah and Co account or update your profile, we collect your name, email address, chosen username or gamer tag, password, and account preferences.
  • Order and Shipping Details: When you purchase apparel or merchandise from our storefront (shop.jahandco.com), we collect billing and shipping addresses, phone numbers, order details, and sizing preferences necessary to fulfill and deliver your physical orders.
  • Payment Information: All payments are processed securely by our third-party payment processors (such as Shopify Payments and Stripe). We do not collect or store full credit or debit card numbers on our servers.
  • Marketing Sign-Up: If you subscribe to marketing email, we collect your email address, the topics you choose, when and how you opted in, and later changes to your choices.
  • Communications and Support: When you contact our support team (via support.jahandco.com or support@jahandco.com), submit tickets, or respond to surveys, we collect your contact information, ticket history, and the content of your communications to assist you.

b. Information from third parties and identity providers

  • Google Sign-In & Third-Party Authentication: You may choose to register or sign in to our Services using third-party identity providers, such as Google Sign-In (managed via our authentication provider, Clerk). When you authenticate using Google, we request and collect the following basic profile information:
  • Your Google account profile name (first and last name)
  • Your verified Google email address
  • Your Google profile picture / avatar URL
  • Your unique Google account identifier (subject ID)
  • We use this Google account information solely to authenticate your identity, create and maintain your Jah and Co account, and link your game progress and order history to your profile. We do not request, access, or store any sensitive or restricted Google user data (such as Google Drive files, Gmail messages, or Google Contacts).
  • Payment and Fulfillment Partners: We receive confirmation from our payment processors regarding transaction status (e.g., successful charge, refund) and tracking information from fulfillment shipping carriers.

c. Information collected automatically

  • Device and Technical Data: When you access our websites, we automatically collect your IP address, browser type and version, operating system, device characteristics, referring URLs, request timestamps, and network status.
  • Gameplay Telemetry: When you play games on our Play Studio (play.jahandco.com), we collect game session data, multiplayer matchmaking telemetry, in-game achievements, high scores, level progression, and crash diagnostics to operate the games and maintain competitive integrity.
  • Cookies and Essential Storage: We use cookies and local storage to maintain your active authentication sessions, remember your site preferences (such as audio or UI settings), and ensure platform security.

2. How We Use Your Information

We use personal data and third-party account information (including Google user data) strictly for legitimate business and operational purposes:

  • Provide and Maintain Services: To operate our websites, deliver interactive browser games, manage multiplayer lobbies, and fulfill apparel orders.
  • Identity and Account Management: To authenticate your identity across all Jah and Co studio applications, manage your unified profile, and secure your account credentials.
  • Game Progression and Leaderboards: To synchronize your cloud saves, track gameplay achievements, and display public leaderboard rankings for games played on play.jahandco.com.
  • Order Processing and Delivery: To process transactions, provide order status updates, and coordinate merchandise shipment and returns.
  • Customer Support: To investigate and resolve technical issues, respond to customer inquiries, and provide live chat or ticket assistance.
  • Security and Abuse Prevention: To monitor platform stability, detect and prevent fraud, unauthorized access, cheating, spam, and security incidents.
  • Service Communications: To send essential account notices, security updates, password resets, and transaction receipts.
  • Marketing Communications: If you opt in, to send promotional emails about new product drops, collection releases, offers, and studio news to the email address on your account. You can opt out at any time (see "Your Rights and Choices" below).
  • Legal Compliance: To comply with applicable legal obligations, court orders, and enforce our Terms of Service.

3. How We Share Your Information

We respect your personal data and do not sell it. Specifically:

  • No Sale of Personal Data: We do not sell, rent, lease, or trade your personal information or Google user data to third parties, data brokers, or advertising networks for monetary or any other consideration.
  • No Targeted Advertising: We do not share your personal information or Google user data with third parties to serve personalized, behavioral, or retargeted advertisements.
  • No AI Model Training: We do not use or transfer your personal data or Google user data to train, fine-tune, or develop generalized machine learning or artificial intelligence models without your explicit consent.
  • Trusted Service Providers: We share personal information only with vetted third-party vendors and infrastructure service providers who perform critical functions on our behalf, under contractual obligations of confidentiality and data security:
  • Identity & Authentication: Clerk (session and authentication infrastructure)
  • Cloud Hosting & Edge Computing: Cloudflare (edge delivery, DDoS protection, and cloud hosting)
  • Database & Backend Storage: Secure PostgreSQL and cloud database infrastructure
  • Payment Processing & Storefront: Shopify and Stripe (secure PCI-DSS compliant checkout and merchant services)
  • Email & Communication Delivery: Cloudflare Email and transactional email dispatchers
  • Legal Requirements and Safety: We may disclose personal data if required by law, regulation, subpoena, or valid legal process, or when necessary to protect the rights, property, or safety of Jah and Co, our users, or the public.
  • Business Transfers: In the event of a merger, acquisition, reorganization, or sale of assets, user personal data may be transferred as part of that transaction, subject to the protections of this Privacy Policy.

4. Google API Services User Data Policy & Limited Use Disclosure

Jah and Co's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

  • We only access standard Google user data (name, email address, profile picture, and Google user ID) required to verify your identity and manage your Jah and Co account.
  • We do not transfer Google user data to third parties except as necessary to provide or improve the core user-facing functionality of our Services, to comply with applicable law, or as part of a merger or acquisition.
  • We do not use Google user data for serving advertisements.
  • We do not allow humans to read Google user data unless you have given affirmative agreement for specific messages (such as customer support assistance), it is necessary for security purposes, or it is required to comply with applicable law.

5. Data Retention, Account Deletion, and Revoking Permissions

  • Data Retention: We retain personal data for as long as your Jah and Co account remains active or as needed to provide you with our Services. We may retain certain transaction records, order histories, and audit logs for a limited period to comply with statutory tax, accounting, and legal requirements.
  • User Data Deletion Instructions: You have the right to request the complete deletion of your account and all associated personal data at any time:
  • Self-Service Deletion: You can manage and initiate deletion of your account directly from your account settings at https://accounts.jahandco.com/user.
  • Email Request: You can email our privacy and support team at support@jahandco.com with the subject line "Data Deletion Request" from your registered account email address.
  • Upon receiving your verified deletion request, we will permanently delete or anonymize your personal data from our active databases within thirty (30) days, except where retention is legally mandated.
  • Revoking Google Permissions: If you signed in to Jah and Co using your Google Account, you can disconnect or revoke Jah and Co's access to your Google account at any time through Google's Security Settings page at: https://myaccount.google.com/permissions.

6. Security Safeguards

We implement industry-standard administrative, technical, and physical safeguards to protect your personal data against unauthorized access, loss, alteration, or disclosure:

  • All data transmissions across our Services are encrypted using TLS 1.3 / HTTPS.
  • Sensitive credentials and session tokens are hashed and stored using cryptographically secure algorithms.
  • Access to production databases and infrastructure is strictly limited to authorized personnel using role-based access controls and multi-factor authentication.
  • While we use rigorous safeguards to protect your data, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

7. Cookies and Similar Technologies

We use cookies, session tokens, and local storage strictly to provide core platform functionality:

  • Essential Authentication: Maintaining secure user sessions so you stay logged in as you navigate between our studios (such as from jahandco.com to play.jahandco.com).
  • User Preferences: Storing UI theme choices, audio settings, and cookie consents.
  • Performance & Diagnostics: Measuring site latency and uptime to ensure fast loading times.
  • You can configure your browser to decline cookies, but please note that doing so may prevent you from logging in or using authenticated features of the Services.

8. Your Rights and Choices

Depending on your jurisdiction (including the European Economic Area, United Kingdom, and California), you may have the following legal rights regarding your personal data:

a. GDPR & UK GDPR Rights (EEA and UK Residents)

  • Right to Access: Request a copy of the personal data we hold about you.
  • Right to Rectification: Correct inaccurate or incomplete personal information.
  • Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data.
  • Right to Restriction & Objection: Restrict or object to certain processing activities.
  • Right to Data Portability: Receive your data in a structured, machine-readable format.
  • Right to Lodge a Complaint: Submit a complaint with your local supervisory authority.

b. California CCPA / CPRA Rights (California Residents)

  • Right to Know: Request details on the categories and specific pieces of personal information collected, used, and disclosed.
  • Right to Delete: Request deletion of personal information collected from you.
  • Right to Correct: Request correction of inaccurate personal data.
  • Non-Discrimination: We will never discriminate against you, deny services, or charge different prices for exercising your privacy rights.
  • We do not sell or share personal information for cross-context behavioral advertising under the CCPA/CPRA.
  • To exercise any of these rights, please contact us at support@jahandco.com. We will verify your identity before processing your request.

c. Marketing Email Choices (All Users)

  • We add an email address to our marketing list only if you ask us to: by ticking the optional, unticked-by-default marketing box when you create a Jah and Co account; by entering your email in the sign-up box on jahandco.com and clicking the confirmation link we email you (we do not add the address until you click it); or by turning marketing email on in the Email tab of your account. Agreeing to marketing email is not a condition of any purchase or of using our Services.
  • If you enter your email on jahandco.com but never click the confirmation link, we do not store it as a subscriber, and the link expires after 48 hours.
  • Every marketing email contains an unsubscribe link. It opens an email preferences page where you can choose which topics you receive or unsubscribe from all marketing email. You can also change these choices at any time in the Email tab of your Jah and Co account. You can also contact us at support@jahandco.com to be removed.
  • Unsubscribing takes effect immediately. We keep your email address on a suppression list so that we do not email you marketing again, including if you later create a new account with the same address.
  • Unsubscribing from marketing does not stop essential account, security, order, and customer support messages.
  • If you are in the European Economic Area, the United Kingdom, or another region where you have the right to object to direct marketing, you may do so at any time using the options above and we will honor it.

9. Children's Privacy

Our Services are designed for general audiences and are not directed to children under the age of 13 (or the minimum age required by applicable law in your jurisdiction). We do not knowingly collect or solicit personal information from children under 13. If we learn that we have inadvertently collected personal data from a child under 13 without verified parental consent, we will promptly delete that information from our servers. If you believe a child has provided us with personal information, please contact us immediately at support@jahandco.com.

10. International Data Transfers

Jah and Co operates from the United States. If you access our Services from outside the United States, your information will be transferred to, stored, and processed in the United States and other countries where our cloud service providers operate. When transferring data from the EEA or UK, we rely on recognized transfer mechanisms, including the European Commission's Standard Contractual Clauses (SCCs), to ensure appropriate data protections.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our Services, technologies, or applicable laws. When changes are made, we will revise the "Effective Date" at the top of this page. If we make material changes, we will provide additional notice, such as via an announcement banner on our home page or direct email notification to registered account holders. Your continued use of the Services after any changes indicates your acceptance of the updated Policy.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: