Privacy & data flows
J-Express analyzes scientific datasets in your browser by default. Optional connections can send information off your device. J-Express is intended for datasets without personal information.
Scope and contact
This notice explains the data flows of Resonalis, J-Express and its optional integrations, including the J-Express application hosted at molmine.com/jexpress2026. For privacy questions or requests, contact contact@resonalis.com. Do not include sensitive datasets in email.
Browser workspace
Importing a file for ordinary browser analysis does not upload the dataset to a Resonalis dataset repository. Matrices, annotations, analyses and projects are processed on your device. The workspace may be saved automatically in this browser's IndexedDB; settings use localStorage and AI connection credentials use sessionStorage. These are functional browser storage, not an independent backup. Clear the workspace using the app and remove site data in your browser to remove remaining local settings and caches. Exported files, companion-runtime files and backups must be managed separately.
AI/MCP sharing and temporary relay storage
AI sharing is optional. Selecting Connect creates a session and sends a bounded technical context (dataset type, dimensions, analysis kinds and selected numeric parameters) to the J-Express relay on Cloudflare. This happens before an MCP client is approved; it does not include matrix values or row/column labels.
Approving a client grants ongoing access within the chosen permissions. Tool calls may send dataset names, identifiers, annotations, selected rows/columns, bounded matrix slices, computed results and plot images through the relay to the client. Repeated reads can disclose more than one slice. Labels, annotations and images can reveal information even when the full matrix is not transferred. Write permissions may also allow the client to create or modify workspace content through supported tools.
The relay temporarily stores session context, queued tool requests and returned results in Cloudflare Durable Objects; it is not a permanent project repository. Sessions expire after approximately 30 minutes without renewal; an active browser renews them. Results are removed when collected, or become eligible for cleanup after approximately one minute. Expiry and physical cleanup are separate: periodic cleanup and service availability can delay deletion. Authentication and client-registration records have separate expiry periods. These application expiry rules do not describe provider logs or backups.
Disconnect revokes further access through the session. It does not erase data already received by the client, its AI provider or a chat history. Their retention, training settings, international processing and deletion rules are governed by their own policies. Check those settings before connecting. Do not use this integration for personal, identifiable patient, confidential or restricted data.
External scientific services, models and local runtimes
User-requested gene annotation and enrichment may send selected gene identifiers and background lists directly to services such as g:Profiler and Ensembl. Their terms and privacy practices apply. Optional browser text embedding downloads model and runtime assets from external hosts; those hosts receive the associated network requests. Text embedding itself runs locally in that browser mode. An explicitly connected local R/Python companion receives analysis inputs on your computer; review its installation, logs and output files separately. Results requested through MCP can still leave the device.
Optional usage counts
When enabled, J-Express sends predefined activity categories (such as app opened or analysis completed) and an allowlisted analysis type to Cloudflare Analytics Engine. The event payload contains no dataset values, filenames, row labels, cookies or persistent user identifier. Usage counts are enabled by default; turn off “Allow anonymous usage statistics” in the app's Privacy & disclaimer section, or use ?telemetry=off. This stops future app usage events from that browser, not hosting/security requests or information already sent.
Hosting, technical requests and contact
Cloudflare delivers the sites and relay. Network requests necessarily expose technical information such as IP address, browser/request headers and request time to the infrastructure handling them. The restricted analytics payload described above does not mean all hosting traffic is anonymous. Infrastructure security or diagnostic records may be handled under the hosting provider's configuration and policies; this notice does not promise that all request logs are absent or immediately deleted. If you contact us by email, the address and message you choose to send are processed to answer your request.
Your choices and rights
Use browser analysis without AI, leave optional external features disabled, turn off usage counts, disconnect AI sessions and manage local site data. Use only data you are authorized to process and share. Personal information is outside the intended dataset workflow; removing direct identifiers alone may be insufficient, especially for genomic data. There is no claim here of clinical, GDPR or other regulatory certification.
If information relating to you has nevertheless been processed, contact us to request access, correction, deletion or restriction, or to object, as applicable. Portability and withdrawal of consent apply where the relevant legal conditions are met. You may complain to your data-protection authority, including Norway's Datatilsynet. We cannot delete data held independently by your browser, AI provider or other external service; direct the corresponding request to them.