Privacy Policy
This page explains how information may be handled when you visit the JustMyth website or contact us.
1. Information you provide
If you contact JustMyth by email, we may receive the information you choose to provide, such as your name, email address, organization and message content.
2. Technical information
The website itself does not intentionally set advertising or profiling cookies. Hosting and infrastructure providers may process basic technical information such as IP addresses, request timestamps, browser information and server logs for security, reliability and delivery of the site.
3. How information is used
Information may be used to respond to inquiries, maintain site security, diagnose technical issues and operate or improve JustMyth's research and business activities.
4. Sharing
We do not sell personal information. Information may be processed by service providers that support website hosting, email, security or other infrastructure, subject to their applicable terms and privacy practices. We may also disclose information when required by law or necessary to protect rights and security.
5. Retention
Information is retained only as reasonably necessary for the purposes described above, legal obligations, security or legitimate operational needs.
6. External links
This website may link to third-party services. Their privacy practices are governed by their own policies.
7. Your choices
You may contact us to ask about personal information you have directly provided to JustMyth, subject to applicable law and technical or legal limitations.
8. Changes
This policy may be updated as the website and JustMyth's operations evolve. The latest version will be posted on this page with an updated date.
9. Contact
Privacy questions can be sent to devtmj@apeironlabs.tech.
Addendum · Added 8 October 2026
Accounts, waitlist and community data
The website now offers a waitlist, a contact form, optional accounts and a community forum. This section describes the information those features collect. It adds to the policy above.
Waitlist and contact form
If you join a waitlist we store your email address, the product you chose and the page you joined from. If you use the contact form we store your name, email address and message. For both, we also store a salted one-way hash of your IP address (not the address itself) and your browser's user-agent string, to help prevent abuse.
Accounts
If you create an account we store your email address, display name and, if you sign in with GitHub, the basic public profile GitHub shares (name, email and avatar URL) plus the account link Auth.js needs. We do not store passwords. If you turn on two-factor authentication we store your authenticator secret encrypted (AES-256-GCM) and your recovery codes only as one-way hashes.
Sessions and cookies
Signing in sets one essential, HTTP-only session cookie (plus short-lived cookies used only during sign-in for security checks). We record when each session was created and last used, a coarse device description from your browser's user-agent, and a hashed IP address, so you can review and revoke sessions in your account settings. We do not use advertising or analytics cookies.
Community posts
Threads, replies, upvotes and reports you submit are stored with your account. Posts and your display name are visible to anyone. Moderators can hide posts, and actions taken by moderators and admins are recorded in an internal audit log.
Sign-in links and site notifications are sent through Resend, which processes the recipient's email address and message content to deliver them.
Service providers
The site is hosted on Vercel and its database runs on Neon (Postgres); both process the data above on our behalf. If enabled, Upstash (Redis) processes hashed identifiers for rate limiting, and Cloudflare Turnstile processes technical browser signals to tell people from bots.
Deleting your data
You can delete your account at any time from your account settings. This removes your profile, sessions, linked sign-in methods, two-factor data and votes, and erases the content of your posts. To remove a waitlist signup or contact message, email us.
Addendum · Added 8 October 2026
Purposes, legal bases, retention and your rights
This section adds the details that Malaysia's Personal Data Protection Act 2010 (PDPA), the EU and UK GDPR and California's CCPA ask a privacy notice to give. It is a plain-language draft, not legal advice. Details pending: legal entity name, privacy contact person, minimum account age.
Who is responsible
The website is operated by the operator of JustMyth, which decides how your personal data is used (the “data user” under the PDPA and the “controller” under the GDPR). Contact: devtmj@apeironlabs.tech. Full details are on the Legal page.
Where the data comes from, and whether you must give it
We collect personal data directly from you, and from GitHub if you choose to sign in with it. Giving it is voluntary: you can browse the whole public site without giving any. An email address is needed to join the waitlist, send a contact message or create an account; without it we cannot provide those features.
Why we use it, and on what basis
- Waitlist: to tell you when early builds are available. Basis: your consent, which you can withdraw at any time.
- Contact form: to reply to your message. Basis: steps you ask us to take, and our legitimate interest in answering inquiries.
- Accounts and community: to sign you in and run the forum you take part in. Basis: providing the service you signed up for (contract).
- Security, moderation and abuse prevention: rate limits, bot checks, hashed IP addresses, bans and the audit log. Basis: our legitimate interest in keeping the site and its users safe, and legal obligations.
- Service emails: sign-in links and notifications needed to run the features above. We do not send marketing email.
Who it is disclosed to
Service providers that host and run the site, listed on the Subprocessors page; moderators and admins, for community moderation; anyone, for what you post publicly; and authorities when the law requires it. We do not sell personal information or share it for cross-context behavioural advertising.
How long we keep it
- Email sign-in links expire after 15 minutes.
- Sessions expire after 30 days without use, or when you sign out or revoke them.
- Account and community data: until you delete your account (see Your data for exactly what is removed).
- Waitlist signups: until you ask us to remove them or we no longer need them to contact you about early access.
- Contact messages: as long as needed to handle your inquiry and any follow-up.
- Audit log entries: kept for security and accountability; there is currently no automatic deletion.
- Hosting providers' request logs: according to their own retention settings.
Transfers outside Malaysia
Some of our service providers store or process data outside Malaysia, including in the United States. We use them only to run the features described here and rely on their published security and data-protection commitments.
Your rights
You can access, download, correct and delete your data, withdraw consent, and limit how it is used; under the GDPR you can also object to or restrict processing and ask for portability. Most of this you can do yourself; see Your data. You may also complain to Malaysia's Personal Data Protection Commissioner or to the data protection authority where you live.
Children
The website is not directed at children. If you believe a child has given us personal data, contact us and we will delete it.
Security and cookies
How we protect data, and how to report a vulnerability, is on the Security page. The cookies we set are listed in the Cookie Policy.