Privacy

Policy version: 2026-09-19-auto-review-v1

We do not save your model API key

Your key stays in the current tab’s memory and clears on refresh. It is not included in research submissions, downloads or share links. This does not mean that no other data is saved: voluntary research contributions and provider or infrastructure records are separate, as explained below.

Playing as a guest

Your question, possible answers and any necessary context are sent to the selected AI providers when you explicitly run an experiment. OpenRouter calls go directly from your browser to OpenRouter. When enabled, Vercel AI Gateway calls pass through our fixed server relay: it handles your key and task in request memory without saving them. Providers process your content under their own policies. Do not submit passwords, confidential documents or sensitive personal information.

The page can access a key while you use it. Memory-only storage and HTTPS do not eliminate the need to trust the website and its code. Use a dedicated key with a small provider-side budget, never a production key or Vercel account token. You can browse cases without a key or inspect the open-source code and run it locally.

Connecting OpenRouter opens its own authorization page. If you authorize, JevArena exchanges a short-lived code directly with OpenRouter for a user-controlled API key and holds that key in the original tab’s memory. No model runs automatically. The callback code arrives in a URL and may appear in infrastructure access logs; it is removed from the visible URL immediately. The API key is not placed in URLs or browser storage. Disconnecting clears the tab’s key but does not revoke it at OpenRouter; revoke it in your OpenRouter key settings.

Model API keys stay in the tab and are never part of a contribution. When public contribution mode is enabled, its visible contribution checkbox starts on: completing an answer or vote submits the displayed task and associated results for research and possible reviewed publication. Turn it off before completing your answer or match to keep that activity out of our research database. Page loads and connecting a provider do not submit contributions. Refreshing clears in-memory state, not a contribution already submitted. This is not a promise that provider or hosting infrastructure keeps no operational logs.

Optional account and private history

When enabled, email sign-in uses Supabase Auth and a configured email-delivery service to send a one-time login link. The account contains your email and identity identifier. Your email is used for authentication and service messages, not a marketing subscription. Essential session cookies keep you signed in; they are separate from your model API key.

Only clicking Save privately after its separate checkbox uploads the selected question, answers, model results and vote to your account history. Logging in does not upload the current conversation automatically. History is private to your account in the application, not public or end-to-end encrypted; authorized infrastructure administrators may access stored data for operations and support. The service limits history to 100 experiments per account and retains each for up to 30 days.

Download or delete saved experiments from Your history. Expired items are excluded from reads immediately and removed by scheduled cleanup. Deletion removes active records; restricted infrastructure backups may retain copies until their normal expiry. Account deletion requests require identity verification through the private contact channel above.

Public contributions: check your choice before answering

When enabled, public contribution mode is on by default, with an opt-out beside the answer or match controls. Leaving it on authorizes research use and publication after review of the task, possible answers, your answer and optional reason, and associated model runs or preference vote when supplied. Original additions are contributed under CC BY 4.0; third-party material keeps its own license and source. Only contribute content you have permission to share. A human answer is not a preference vote or a verified correctness label.

When automated review is enabled, the contribution notice explicitly says that submitting sends the task and contribution content to Jev through Vercel for screening. Passing submissions publish automatically to the community collection; others remain unpublished. Screening is not human review, a correctness check or a guarantee that sensitive content will be caught. Do not contribute sensitive content. The new automated-review consent authorizes this later screening call, not model training or unrelated provider calls. We do not use your API key for screening.

Automated review uses a separate, versioned consent. Older public submissions authorized for review are not automatically screened or published under the new policy. Existing private submissions remain private. When automated review is disabled, the public notice instead describes the existing review queue. No provider connection or page load submits a contribution.

Submitted records remain community-submitted, not verified evidence. Pending payloads are retained for up to 30 days. Publicly published cases may remain longer and can be copied by others. Automated screening and publication are deployment-gated; these statements describe their behavior when enabled.

The separate manual private-research form remains opt-in. Existing private submissions are not converted to public contributions, and private-history saves do not grant research or publication permission. Intake records the consent version and timestamp and uses a salted IP hash for abuse limits; hosting providers may process IP addresses.

Use your downloaded deletion receipt at Withdraw a contribution to request withdrawal. Keep the receipt secret. Minimal receipt and abuse-prevention metadata may remain to prevent accidental resubmission. Contact the operator privately for help removing published material; withdrawal cannot recall screenshots, GitHub history, forks or other copies.

Sharing and public data

Instant share links contain approved experiment data in their URL fragment. Anyone with the link can read or copy it. Downloaded JSON and images are controlled by whoever receives them. Public GitHub content and published case studies can be copied or archived by others; removing our copy cannot recall those copies.

Infrastructure, cookies and security

Vercel hosts the site and functions; Supabase provides account and database infrastructure when configured; the authentication email-delivery service processes recipient addresses and login emails; selected AI providers process model requests. These services may process data outside your country. We use HTTPS, access controls, server-only credentials and owner-scoped database access. No system is risk-free. We do not intentionally log request bodies or API keys.

There is no marketing subscription, advertising tracker or reCAPTCHA in this release. Essential login cookies may remain until sign-out or expiry. Provider sites reached through external links have their own practices. Changes to processing will be reflected in a revised policy and appropriate new choices before new uses.