Privacy · TypoSafe AI · updated 2026-09-19

Privacy.
There is not much of it to write about.

Jef does not read your input. It hashes it and looks the answer up in a table. That is the joke, and it is also the reason this page is short: a service that never reads anything has very little to tell you about what it does with what it read.

This page describes exactly what typosafe.lol collects, keeps and shares. It is written to be accurate rather than reassuring, so where something is stored, it says so plainly.

The short version

There are no accounts. No sign-up, no login, no password, no email capture.
Nothing is sold, rented or shared for advertising. There is nothing to sell.
You are not tracked across other websites. There are no advertising cookies and no fingerprinting.
Some things you type are published on a public wall on the site. That is the only meaningful thing to be careful about, and it is explained below.

What is stored

Three features write to a database. Everything else on the site writes nothing.

decisionsWhen you use an app on the site, the app name, the text you typed up to 200 characters, the answer and the confidence are saved and shown on a public wall. Do not type anything into it that you would not put on a public page, because that is what it becomes. Settle It casesThe two names and the two sides that each person typed, plus a six-character code and a hashed owner token. Anyone with the code can read the case. Vote vs Jef pollsThe question, the options, the vote counts, a six-character code, a hashed owner token, and a random token that stops one person voting twice. That token is generated in your browser and is not linked to you.

None of this is tied to an identity, because there is no identity to tie it to. It is tied only to the text you chose to type.

What is never stored

Anything that escalates or is refused. If your input touches health, harm, money, law or safety, or contains profanity or slurs, it is discarded rather than saved. It is not written to the database, not shown on the wall, and not rendered on a share card.
Your IP address, at the application layer. Our hosting and database providers process it in order to serve the request, as any web server must.
Names, contacts, or anything about you beyond the text you type yourself.
Any content sent to the API or the MCP endpoint. Those return an answer and keep nothing.

What stays on your device

Streaks, daily check-ins, which cases and polls you created, and the random voting token all live in your browser's local storage. They are never sent anywhere. Clearing your browser data deletes them permanently, and nobody can recover them, including us.

Counting visits

Two things count traffic, and neither identifies you.

our own counterRecords the page path, whether the visit came from a shared link, and the hostname of the referring site. It is stored as a daily total per page, not as a row per visitor, so there is no record of an individual visit to look up. Obvious bots are filtered out by user agent. Vercel Web AnalyticsPage views and which app was used. No cookies, no cross-site tracking, no fingerprinting. Most ad blockers block it, which is why we built the counter above.

Who else sees it

Three services are involved in running the site, and each sees only what it needs to do its job.

Vercel hosts the site and runs the API functions.
Supabase stores the decisions, cases, polls and visit counts described above.
Google Fonts serves two typefaces, which means your browser requests them from Google.

Nothing is shared with anyone else, and no data is sold or used for advertising.

Share links

Share links contain the text you typed, inside the URL itself. If you send someone a link, you are sending them that text. If you post it publicly, you are posting that text publicly. Links to refused or escalated inputs are not generated at all.

The API and the MCP server

The API at /v1 and the MCP endpoint at /mcp need no key and no account. They take your request, compute an answer and return it. Nothing from those requests is stored or written to the wall. Standard server logs at the hosting layer apply, as they do to any website.

The command line tool, npx jef-mcp and npx typosafe, runs entirely on your own machine and makes no network request at all.

Removing something

If you typed something into the wall, a case or a poll and want it gone, email us with the text or the code and it will be deleted. There is no account to verify you against, so we will remove anything a person asks us to remove rather than making you prove ownership of a joke about dinner.

Because there are no accounts, there is no profile to export and nothing to download. If you want to know everything the site holds about you, the answer is on this page.

Children

This site is not directed at children and is not designed for them. It is a joke about being unable to decide what to eat.

Changes

If this page changes in a way that matters, the date at the top changes with it. The version history is public in the site's repository.

Contact

Email hello@typosafe.lol for anything on this page, including deletion requests.

One honest note: this policy was written carefully and describes the system accurately, but it was not drafted by a lawyer. If you are relying on it for something that matters, read the safety page too, which explains the filtering in more detail.

Privacy.There is not much of it to write about.