Privacy policy

In short

The commitments below are not marketing statements: each one describes how the application is built, and each is expanded on in the sections that follow.

• No tracker, no audience measurement, no advertising pixel and no third-party script are loaded.
• The application is never connected to a bank. Nothing is imported: every figure comes from your own entries.
• Your data is never sold, rented, or shared for advertising or marketing purposes.
• Your data is used only to provide the service you asked for. Any other use would require your explicit and prior consent.
• You can ask for your account and everything in it to be deleted, at any time.

Data controller

The controller is Alexandre À COMPLÉTER, publisher of TrackYourBills. Any question or request about your data can be sent to À COMPLÉTER.

Account data

Creating an account stores the following, and nothing else:

• Your email address, used to identify you and to sign you in.
• Your password, stored only as a cryptographic hash. It is never held in clear text and cannot be read back, by anyone.
• If you register a passkey: its public key, the name you give it, and its creation and last-use dates. A passkey's private key never leaves your device and is never transmitted.
• A username, and optionally a first and last name, if you choose to fill them in on your profile.
• The date your account was created, and the date of your last sign-in.

The financial data you enter

Everything in this section exists because you typed it. There is no automatic collection of any kind.

This data is sensitive in practice — it describes how you live — which is why it is isolated per account at the database level and never leaves the service.

• Operations: a label, an optional note, an amount, a date, a category, and optionally an account and a payment method.
• Recurring payments: the same fields, plus a frequency, a start date, an optional end date, an optional reminder delay, and the status of each due date.
• Categories: a name, a colour, an icon and a direction (expense or income).
• Accounts: a name, optionally a bank name, a type, and optionally the last four digits of a card — which you provide only to tell two cards apart, and which alone identify no account and permit no payment.

What stays in your browser

Two preferences are stored locally on your device and are never sent to any server:

• Your light or dark theme choice.
• Your language, and which optional fields you want shown on the operation form.

What is never collected

The following are absent from the application by design, not by policy — there is no code in it that could gather them:

• Analytics, audience measurement, session recording or behavioural statistics of any kind.
• Advertising, advertising identifiers and third-party marketing tags.
• Profiling, scoring and automated decision-making producing legal effects concerning you.
• Any connection to a banking institution, open banking aggregation, or automatic import of transactions.
• IBANs, full card numbers, CVVs and banking credentials. No field in the application accepts them.
• Geolocation, contacts, calendar, camera, microphone and files on your device.

Purposes and legal bases

Each processing operation is carried out for one stated purpose, on one legal basis:

• Providing the service — creating your account, storing your entries and computing your totals. Legal basis: performance of the contract between you and the publisher (GDPR art. 6.1.b).
• Keeping the service secure — authentication, session management and protection against unauthorised access. Legal basis: the legitimate interest in operating a secure service (GDPR art. 6.1.f).
• Nothing else. Any new purpose would be presented to you beforehand and would take effect only if you agreed to it — refusing would keep the service exactly as it is today.

Cookies and local storage

The only cookies placed are the session cookies that keep you signed in between pages. They are strictly necessary to a service you explicitly requested, and are therefore exempt from prior consent under article 82 of the French Data Protection Act — which is why you are not shown a cookie banner.

Signing out deletes them. The two preferences described above are kept in your browser's local storage, not in cookies, and clearing your browsing data removes them.

Who has access

Your data is not shared with anyone. Two providers process it strictly on the publisher's instructions, and for no purpose of their own:

There is no other recipient. Your data is not sold, not rented, not exchanged, and not passed to any advertiser, data broker or partner.

• Netlify, Inc., which serves the site itself.
• Supabase, Inc., which provides authentication and the database where your account and your entries are stored.

Transfers outside the European Union

The database is hosted in the following region: À COMPLÉTER. Where a provider is established outside the European Union, the transfer is governed by the European Commission's standard contractual clauses, which that provider undertakes to apply.

How long data is kept

Your account and your entries are kept for as long as your account exists. There is no automatic expiry: your history stays complete because a budget only makes sense over time.

When an account is deleted, everything attached to it — operations, recurring payments and their due dates, categories, accounts and passkeys — is deleted with it by the database itself, in the same operation.

Security

The measures below are enforced by the system rather than by convention:

• Every table applies row-level security: a row can be read, modified or deleted only by the account that owns it. The rule is enforced by the database, so it holds even if the application were at fault.
• Passwords are stored hashed and are never readable, including by the publisher.
• Passkeys store only a public key. The private key stays in your device's secure hardware and is never transmitted.
• All traffic between your browser and the service is encrypted in transit (HTTPS).

Your rights

Under the GDPR you have the following rights over your data, which you may exercise at any time by writing to À COMPLÉTER. A reply will be sent within one month.

If you believe your rights are not respected, you may lodge a complaint with the CNIL, the French supervisory authority (www.cnil.fr).

• Access: obtain a copy of the data held about you.
• Rectification: correct anything inaccurate — most of it you can edit yourself in the application.
• Erasure: have your account and all its contents deleted.
• Portability: receive your data in a structured, machine-readable format.
• Objection and restriction: object to a processing operation or ask that it be restricted.
• Withdrawal: withdraw any consent you have given, at any time, without affecting what was done beforehand.

Minors

The service is not intended for children under 15. Below that age, French law requires the consent of a parent or guardian for an account to be created.

Changes to this policy

This policy may change as the application does. The date at the top of the page always reflects the current version, and any change that widens how your data is used will be brought to your attention before it takes effect.

Contact

For any question about this policy or to exercise your rights: À COMPLÉTER.