Privacy Policy

Version 1.10, 17 October 2026

This policy explains what personal data JEK Systems collects through jeksys.net, the JEKray optical bench simulator and JEKrayPro accounts, why, and what you can do about it. JEK Systems is the controller of this data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Contact us about anything here at [email protected].

1. The short version

• You can use JEKray without an account. Your benches then stay on your own device and we never receive them.
• We use no analytics, no advertising and no tracking cookies.
• If you take out JEKrayPro, we keep what is needed to run your account: your name, your email address if your sign-in provider gives it, your benches, and the state of your subscription. Card details stay with Stripe; we never see them.
• We do not sell your data or use it for advertising.
• You can export everything and delete your account at any time.

2. Using the website and JEKray without an account

JEKray runs entirely in your browser. Benches you build, open or save stay on your device: in your browser’s own storage (for autosave and preferences such as which parts palette you use) and in any .jekray files you save. None of this is sent to us.

Share links carry the bench inside the part of the link after the #. Browsers do not send that part to the website, so we do not receive the bench; whoever you give the link to does.

Bug reports open an email in your own email program, addressed to us, containing your description, your browser and screen details, the bench’s name and size, and a link to the bench. Nothing is sent until you send that email. We use it only to fix the problem and to reply to you.

Hosting. jeksys.net is hosted by GitHub Pages. Like any web host, GitHub records technical details of each visit, such as your IP address and browser, to deliver and secure the site; see GitHub’s privacy statement. Some calculator pages load a maths typesetting library from the jsDelivr network, which sees the same kind of technical details.

Shop. If you buy something on jeksys.net, payment is handled by Stripe, and we receive your name, email address, billing country and what you bought, to deliver it and keep tax records. Delivery emails are sent through Resend. The quote cart keeps its contents in your browser’s storage until you send us a quote request.

Quote requests. When you send a quote request from the cart, what is in the cart and the details you give (your name and email address, and if you choose your organisation, phone number and a message) go through our server to [email protected], sent by Resend, and we email you a receipt with its reference. The receipt repeats only the part numbers and quantities. We use your details only to answer your request and anything that follows from it. Our server keeps nothing of the request itself; it keeps your email address and the time for 24 hours, to limit how many requests one address can send. If the request cannot go through our server, the cart offers to open it as an email in your own email program instead, and then nothing is sent until you send that email.

Quote requests for parts you design. When you ask for a quote for a part designed in JEKray, such as an RF lens, the request includes the part’s figures and a link that holds its design. We receive the design when you send the request. We use it only to quote for the part, make it and help you with it, keep it confidential, and never share or publish it without your permission, as our Made-to-Order Terms describe. We keep it with the quote, and with the order’s records if you order, for as long as we keep those (section 7).

Emails to us. If you email us, we keep the conversation to answer you and for our records.

3. JEKrayPro accounts

JEKrayPro (formerly called JEKray Pro) is the paid subscription that adds cloud storage, version history and team workspaces to JEKray. When you have an account we hold:

• Sign-in details. You sign in with Google or Microsoft; we never see or store a password. From Google we receive your Google account identifier, your name and your verified email address. From Microsoft (university and work accounts only) we receive your account’s and your organisation’s identifiers, your name and your sign-in name, which is usually your work email address. Until 31 October 2026, people who already signed in with ORCID can still do so, so as to link Google or Microsoft; from ORCID we receive your ORCID iD and name, and we delete ORCID identifiers after that date. We use these only to sign you in and to show your name to people you work with.
• Sessions. When you sign in we set one cookie (see section 6) and keep a scrambled copy of it with the time it was created, when it expires and your browser’s description, so you can see and end your sessions.
• Your benches and parts. The benches, folders and earlier versions you save to the cloud, with who saved each version and when, and where a bench was forked from; and the parts you keep in My parts.
• Teams. The workspaces you belong to and your role in each. If someone invites you, we hold the email address they invited until you accept or the invitation expires.
• Your profile picture and display name. If you add a picture to your account we store it and show it, with your name, to the people you share a workspace with: beside benches you changed, in the team’s member list and while you are editing a bench. You can change or remove it at any time from Your account.
• Who is editing. While you have a cloud bench open to edit, we record that you hold it (with the time) so that others in the workspace see that you are editing it and are not able to save over your work. The record ends when you close the bench or within a few minutes of leaving it.
• Subscription. Your plan, number of seats, status and renewal date, and Stripe’s reference numbers for you. For the academic price, we record how you qualified: your university email domain, or a check we made by hand.
• A university email address you confirm. If you confirm a university address by typing in a code we email to it, we keep that address for a year, to give you the academic price and any licence your university has for JEKrayPro, and so that one address confirms one account. We keep the code itself only as a scrambled value for 15 minutes, and a record of codes sent for a day, to stop codes being sent too often.
• University licences. If your university has a JEKrayPro licence for its people, we record that it covers you and how (your university email domain, your university’s Microsoft account, or an invitation from its licence administrators), and the months in which you used JEKrayPro through it. We tell the university only how many people used it each month. Its licence administrators can invite people and take people off by email address, but we never tell them whether a particular person uses JEKray.
• Activity records. A log of significant actions in shared workspaces, such as who joined or left a team, who invited whom, who changed a role, and who deleted, restored or took over a bench, so that team owners and admins can see what happened.

Google account data. We request only the basic scopes needed to sign you in (openid, email and profile) and access no other Google data. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

4. Why we use it, and our lawful basis

• To provide JEKrayPro, as our contract with you: signing you in, storing and showing your benches, running teams and taking payment.
• To keep the service secure and working, as our legitimate interest: preventing abuse, investigating faults and keeping activity records for teams.
• To answer a quote request, as steps you ask us to take before a possible contract.
• To meet legal obligations, such as keeping tax and accounting records.
• To tell you about your account: receipts, payment problems, invitations and important changes to the service. We send marketing email only if you ask for it, and you can stop it at any time.

5. Who else handles it

We use these providers, each under a data processing agreement or acting under its own privacy policy as shown:

• Cloudflare runs the JEKrayPro service and stores account data and benches.
• Stripe takes payments, holds card details and produces invoices. Stripe is also an independent controller for some data, such as fraud checks; see Stripe’s privacy policy.
• Resend sends account emails such as invitations and receipts, and delivers quote requests to us with your receipt for them.
• Resend sends the emails with the codes that confirm a university address.
• Google and Microsoft confirm who you are when you sign in with them, under their own privacy policies. We no longer use ORCID: we used it for sign-in and to confirm university affiliations until October 2026.
• GitHub hosts the website.

Members of a team workspace see each other’s names, profile pictures, roles and the benches in that workspace, who last changed each bench and who is editing it at the moment; the team’s owner and admins also see members’ email addresses and the activity record. We may disclose data if the law requires it. We never sell personal data.

Transfers outside the UK. Some of these providers process data in the United States and elsewhere. Where they do, the transfer is protected by UK adequacy regulations (including the UK extension to the EU–US Data Privacy Framework) or the UK International Data Transfer Addendum to the European Commission’s standard contractual clauses.

6. Cookies and browser storage

JEKrayPro sets one cookie, jek_session, on api.jeksys.net when you sign in. It keeps you signed in for up to 30 days, cannot be read by web pages, and is removed when you sign out. It is strictly necessary for the service you asked for, so it needs no consent banner.

Your account is the same across jeksys.net: each page of the site asks api.jeksys.net whether you are signed in, using the same cookie, to show your name and picture beside Cart, and the quote form fills in your name and email from it. For the rest of your visit the page keeps your name (and where your picture is) in your browser’s session storage, which is cleared when you close the tab. You can see and change your account, sign out, download everything or delete your account on the Your account page.

JEKray and the shop also keep preferences, autosaves and your quote cart in your browser’s storage on your device. We cannot read this storage; clearing your browser’s site data removes it.

We set no analytics, advertising or tracking cookies.

7. How long we keep it

• Account data, benches and parts: while you have an account. A bench you delete stays in the bin for 30 days so you can restore it, then it and its history are deleted; a part you delete from My parts is deleted at once.
• When you delete your account: your personal workspace, benches and parts are deleted at once, and remaining copies in our providers’ backups are overwritten within 30 days. Benches you saved in a team workspace stay with that team.
• After a subscription ends: see the JEKrayPro Terms for how long your cloud benches stay available to open and export.
• Sessions: deleted when you sign out or when they expire.
• Profile picture: until you remove it or delete your account, when it is deleted at once.
• Who is editing: the record of a bench you are editing ends when you close it or within a few minutes of leaving it, and is cleared within a day.
• Invoices and payment records: six years, as UK tax law requires.
• University licence usage records: for the life of the licence and six years afterwards, as the basis of what the university was invoiced. When you delete your account they are no longer linked to your name or email address.
• Emails with us, and quote requests: up to three years after our last contact.
• The address and time of a quote request, kept by our server to limit requests: 24 hours.
• Designs sent with quote requests: with the quote, up to three years after our last contact if you do not order; with the order’s records, six years, if you do. We delete a design sooner if you ask and we no longer need it.

8. Your rights

You have the right to see the personal data we hold about you, to have it corrected, to have it deleted, to restrict or object to our use of it, and to receive it in a portable form. In JEKrayPro you can download everything we hold about you and delete your account from the account menu in JEKray; for anything else, email [email protected]. We will reply within one month.

If you are unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

9. Security

All connections are encrypted. Sessions are stored only as one-way hashes, every request is checked against the workspaces you belong to, and access to our systems is limited to JEK Systems. No system is perfectly secure; if a breach puts your data at risk we will tell you and the Information Commissioner’s Office as the law requires.

10. Children

JEKray can be used by anyone without an account. JEKrayPro accounts are for people aged 13 and over, and subscriptions must be bought by an adult.

11. Changes to this policy

We will update this policy when what we collect or how we use it changes. The version and date at the top will change, and if the change is significant we will tell account holders by email before it takes effect.

Contact

Privacy questions and requests: [email protected]. See also the JEKrayPro Terms, the Made-to-Order Terms and the JEKray Licence.