What we hold, who can see it, and what we don’t have yet.

There are no passwords. You sign in with a one-time code sent to your e-mail address, every time, and a new address becomes an account on the same page. The sign-in provider holds who you are and which workspaces you belong to. It does not hold your rank.

Owner, admin, member and guest are ours. They live in our own database, and what each one may do is a matrix an owner can edit in Settings. Rank is read on every request, so a demotion lands on the next click rather than when a cache expires. A handful of routes belong to the people who run Juoni rather than to any workspace; those fail closed, and nobody is staff unless named.

A deck is a structured document in a hosted Postgres database, and every save is a version you can open and restore. The brand kit, projects, comments, share links and the audit log are rows beside it. Six services touch your data; here is each one and what it holds.

Nothing leaves for a model until you ask for a turn, or the designer runs on a deck you started from an outline. A turn is sent the same stack every time, and the page on how the agent works draws it: your workspace’s brand kit, the project, this deck’s brief and instructions and any sources you attached, the slides as structure, what you have selected, and the words you typed. Not other decks. Not other workspaces.

Every run is recorded — the context it was given, what it proposed, what you applied — and the people who build Juoni can read that record to fix the agent. A generated picture lands in your workspace’s library and nowhere else.

A deck opens to one of three audiences: the people you invited, anyone signed in at your workspace, or anyone holding the link. A link carries its own terms — a passcode, an expiry, whether it can be downloaded, whether it can be duplicated — and turning it off ends it for everyone at once. The pictures in a shared deck are served only to the people it was shared with, not to anyone who guesses their address.

A share counts opens and where each reader stopped, under a key the browser made up rather than anything that names a person. What each invited person may do — view, comment, present — is set per person.

Deleting your account is a request with a thirty-day grace, and the same settings page cancels it until then. When the thirty days pass, you are deleted at the sign-in provider — which is what deletion means — and our rows for you are cleared. A deck you put away goes to the workspace’s archive first, where anyone with the rank can bring it back, and to the trash after.

Single sign-on. There is no SAML or OIDC sign-in for a workspace; everyone signs in with a code to their e-mail address.

Certification. We hold no SOC 2, ISO 27001 or equivalent report. When that changes this page will say so, and until it does, this page is what you have to go on.

A choice of region. Your data lives where the services above run; you cannot pick a country for it.

If your work is regulated, read this section as the answer to the questionnaire, and ask us anything it leaves out through Send feedback in the app.