Privacy policy

Everything you enter — balances, income, expenses, savings, categories — is stored on your device, in an encrypted database whose key stays in your phone’s secure keystore. This database is not included in your Google account’s automatic backups.

If you turn on the app lock, your phone’s own security (fingerprint, face, PIN) answers: no biometric data ever reaches JustePart.

Reminders (notifications) are calculated and triggered on your phone — nothing goes through a server.

The PDF of a monthly report is produced on your phone: it goes through no server, and it is sent nowhere unless you share it yourself.

An account is needed to use JustePart, and it only takes an email address, used to send you your sign-in links and to recognise you from one device to the next. No password.

You can also sign in with your phone’s account: “Continue with Google” on Android, “Continue with Apple” on iPhone. Only one of the two is offered to you, never both, and signing in by email is always available.

With Google, Google confirms your verified email address and gives us the identifier of your Google account; we check its signature and keep that address and that identifier, only to recognise you when you sign in again — including if you add another way of signing in to your account; they are erased with your account. We don’t access your contacts, your files or anything else in your Google account, and we send nothing back to Google.

With Apple, it works the same way. We only ask for your email address — not your name. Our server checks Apple’s signature against Apple’s public keys, then keeps that address, the fact that Apple has verified it, and the identifier Apple gives your account for JustePart, only to recognise you when you sign in again — including if you add another way of signing in to your account; they are erased with your account. If you choose “Hide My Email”, Apple hands us a relay address at privaterelay.appleid.com: to JustePart that is an email address like any other, and the only one we have — your sign-in links go there, and Apple forwards them to you. We send nothing back to Apple.

Once you’re signed in, the joint budget — expenses, declared income, fixed bills, envelopes, balance checks, savings, household settings — is copied to our servers so it can be shared with your partner’s phone.

Your personal space is backed up with your account. Its expenses, categories, income, fixed expenses, envelopes, balance checks, savings, labels, name and settings — and those of “My other personal account”, if you have one — are copied to our servers, into a space that belongs to your account alone. It is a backup: you get your personal space back on a new phone by signing in. Your partner can’t access it, and we don’t look at it. Every read and every write of this space goes over an encrypted connection and is authorised by your signed-in account: no other account, your partner’s included, can read it or write to it. As long as you are not signed in, nothing from your personal space leaves your phone.

Your partner sees only one thing from your personal space, and we should say so: if you work out your reference income from your personal income, they see its total for each month, which travels with the household settings and sets your share. The detail stays in your personal space.

A previous joint budget that you keep for yourself after leaving a household (“Your other budgets”) stays on your phone, with no backup: it is sent neither to our servers nor to any household. To keep a copy of it, export it from Settings › My data.

The joint budget also carries the first names or nicknames you give to the two people in the household and the household’s name; the joint budget and your personal space both carry the labels you write yourself (categories, expenses, savings goals). Write whatever you like: those words are yours, and we don’t read them.

Two random numbers travel with what you send: one for each installation of the app, one for each device. They let us recognise your phones, avoid applying the same change twice, and let you revoke a session. They don’t come from the hardware and they are not advertising identifiers. When you delete your account, the link between this device and it is removed at once; the installation identifier is revoked straight away and erased with the rest, within 30 days.

When you invite your partner by email, their address is stored with the invitation: it is used to send them the link, to check that it is really them accepting it, to recognise them from one invitation to the next in your household, and it counts towards the caps that protect us from bulk sending. It is used for nothing else. It is erased as soon as the invitation is accepted or cancelled; if the invitation expires with nobody touching it, the address goes at most an hour later. The record of the invitation itself is erased within 90 days.

Every sign-in link request also records the address entered, even if no account matches it: that is what stops the sign-in screen being used to work out who has an account with us. Those records are erased about thirty days after the link expires.

These servers are located in France (hosting provider: OVH). To be precise: the journey is encrypted, your phone’s database is encrypted, but these copies — the joint budget’s and the backup of your personal space — are stored in clear text in the server’s database: the labels and amounts there are ordinary text and numbers. What protects them is restricted access to the machine, the isolation of the database (only our server can reach it) and our backups, which are encrypted. We don’t look at these copies: they feed no advertising, no statistics and no other service — that is a commitment, not a technical impossibility.

Payment for Couple+ is handled by the app store you installed JustePart from — Apple’s App Store or Google Play, depending on your phone: JustePart never sees your payment method. To know whether Couple+ is active, the app relies on RevenueCat, acting on our behalf. It receives your JustePart account identifier — a randomly drawn number, which contains neither your name nor your address, but which does designate your account: it is not anonymous — and, from the store, the details of the subscription (plan bought, renewal date, auto-renewal) — never your budget, your name, your email address or your payment method. Our server records the state of the subscription: active or not, until when, which plan, which store it came from, whether it renews by itself, and the time we last read it. It also keeps a log of the signals received from the provider, carrying your account identifier; that log is erased along with your account.

Legal basis: performance of the contract (giving you access to what you bought). Retention: for as long as your account exists; the sales reports the store sends us, which do not name you, are kept for ten years to meet our accounting obligations.

• No ads, no trackers, no audience measurement.
• No automatic crash reports.
• No selling or sharing of data with third parties for commercial purposes.
• No connection to your bank: the figures are the ones you enter.

View and take your data with you: Settings › My data › “Keep a copy” gives you all your data, to save wherever you like.

Erase the device: Settings › My data › “Erase everything on this device” deletes everything from your phone. If you have an account, the joint budget and, if it’s backed up, your personal space come back the next time you sign in; a previous joint budget, which isn’t backed up, and anything not yet sent are lost.

Delete the account and the server copy: Settings › Account › “Delete my account” closes your account at once, closes your sessions and frees your place in the household; erasure from our servers — your account and the backup of your personal space — follows within 30 days. The copy of the joint budget is deleted once the household no longer has any members — as long as your partner stays, that budget is theirs too and it is not erased. On your phone, your data stays, but your personal space is no longer backed up. The steps, screen by screen, are set out on the Delete your account page.

The server’s backups (recovery copies of the whole database, separate from the backup of your personal space). Every night, an encrypted backup of the server’s database is made, so that it can be restored after an incident. These encrypted backups are kept for 90 days, then erased: whatever has been erased from the database therefore disappears from them at most 90 days later.

Changed your mind? For the following 30 days your account is closed but not yet erased. Simply sign in again with the same address — email link, “Continue with Google” or “Continue with Apple” — and it is restored as it was, with its identifier and the backup of your personal space; your place in the household is given back to you if it is still free. The app tells you what was recovered, and what could no longer be. After 30 days there is nothing left to restore.

What stays with your partner. If you leave a household where someone remains, two things of yours stay in their budget, with no time limit: the first name you gave there and your share. They name and split months they keep on reading; removing them would falsify their own history. Your reference income, on the other hand, has no use without you: it is erased at the same time as your account.

Without the app: if you have uninstalled JustePart or changed phone, write to contact@justepart.com from your account’s email address, with “account deletion” in the subject line. We delete the account, the backup of your personal space and the server copy that depends on it within 30 days, and confirm it to you by reply.

You can also exercise your other rights (access, rectification, erasure, portability) at the same address. You have the right to lodge a complaint with the CNIL, the French data protection authority.