Privacy policy
Last updated: 13 October 2026
Grinance is a free spending planner run by one private individual on a non-professional, non-profit basis. This policy describes what personal data the app holds, why, where it lives, who processes it, how long it is kept and what you can do about it.
Data controller
The data controller, within the meaning of Article 4(7) of the GDPR, is the publisher identified in the legal notice, reachable at contact@grinance.com. Given the size of the processing, no data protection officer is appointed; that address is the single point of contact.
What the app holds
The email address you sign up with; your display name, timezone, first day of the week, interface language, colour theme and base currency, including its change history; the plan items you enter with their labels, links, icons, categories, amounts, currencies, directions, schedules and dates, and whether each is an estimate, with your scenarios and their notes, preparations, deadlines and reminder settings; and, if you use the cashflow page, the opening amount you declare with its date and currency, and the preferred minimum buffer if you set one. Sign-in records: a passkey's public key or a password hash, and a session record while you are signed in, which keeps the IP address and browser user agent of the device. If you sign in with Google or Apple, the app also keeps what the provider returns: your account identifier there, the access, refresh and ID tokens it issues with their expiry times and the permissions granted, and the name and, from Google, the profile picture link it shares. They link that provider to your account so you can sign in with it again; Grinance does not use the tokens to read anything from your Google or Apple account. To slow down repeated attempts, the app briefly counts requests to the sign-in service per IP address, and the codes emailed to each address, with letter case and any +tag sub-address ignored. Grinance never connects to a bank and never holds account numbers, card numbers or government identifiers. An opening amount is only the figure you choose to enter: nothing checks it against a bank account.
Why, and on what legal basis
Your account, your plan, the calculations on it, the reminder emails you turn on, the export and the deletion are the service you sign up for: they rest on the performance of the contract (Article 6(1)(b) GDPR). The IP address and user agent kept with a session, the limits on sign-in attempts and codes and the request logs protect accounts against abuse, and the pseudonymous product measures show how the app is used: both rest on legitimate interest (Article 6(1)(f) GDPR). Answering lawful requests rests on legal obligation (Article 6(1)(c) GDPR). Grinance does no profiling and makes no automated decisions about you.
Where the data lives
Grinance runs on Cloudflare. Your data is stored in Cloudflare D1, the application database, and exchange-rate snapshots in Cloudflare KV; sessions and sign-in records live in D1 as well. These are Cloudflare-hosted services, and the region follows Cloudflare's placement rather than a per-user choice.
International transfers
Cloudflare, Inc. is a US company, and its network can process requests and data outside the European Economic Area. Those transfers are covered by Cloudflare's Data Processing Addendum, which includes the European Commission's Standard Contractual Clauses and relies on the EU-U.S. Data Privacy Framework where it applies, under Chapter V of the GDPR.
Who processes the data
Cloudflare, Inc. is the only processor, under Article 28 of the GDPR and its Data Processing Addendum: Workers to run the app, D1 for the database, KV for exchange rates and Email Service for sign-in codes, password resets and reminder emails. If you choose to sign in with Google or Apple, that provider confirms your identity and shares your email address, an account identifier, sign-in tokens and your name with Grinance (Google also a profile picture link), under its own privacy policy. Your data is never sold or shared for advertising. There is no third-party analytics, no advertising and no error reporter that captures your data. Exchange rates come from the European Central Bank's public feed, which receives nothing about you.
What reminder emails contain
A reminder email is sent only for a kind you turn on, or for a deadline you note. A due-date reminder lists the plan items scheduled on the date it looks ahead to, each with its label, its amount in its own currency and, when an exchange rate is available, that amount converted to your base currency. The monthly planning digest lists the largest upcoming costs of the next 31 days, up to five, each with its label, date and amount in its own currency, unconverted, and the changes to plan items that take effect in that period, with the label, the new amount and the date it starts; when a due-date reminder falls on the same day, its items travel in the same email. A deadline reminder names a deadline you noted, by the label you gave it if any, and its date, with no amount. The monthly review reminder carries no labels or amounts, only a link to your plan. Turning reminders on therefore puts labels and amounts into an inbox Grinance does not control, and the account page says so before you turn them on. Every reminder email carries a link that turns its kind off.
Cookies and browser storage
Grinance sets only the cookies it needs to work. A session cookie (better-auth.session_token) keeps you signed in for up to 30 days after you last use it. While you register or use a passkey, a cookie (better-auth.better-auth-passkey) ties the passkey challenge to your browser for five minutes. While you sign in with Google or Apple, a cookie (better-auth.state) holds the sign-in state for five minutes, so the provider's answer can be matched to the request that started it. A cookie remembers your interface language (PARAGLIDE_LOCALE) and another your colour theme (grinance_theme), both kept for about a year. On the live site, the sign-in cookies' names start with __Secure-. The onboarding interview and the plan review keep work in progress in the browser's session storage, which is cleared when the tab closes. So that a page can still answer without a network, the app's service worker keeps the offline page in each language, with the stylesheets and fonts it uses, in the browser's Cache Storage (grinance-offline-v2); it holds no personal data. There are no advertising, analytics or tracking cookies, so these cookies and this storage, strictly necessary for the service and the offline page, are exempt from consent under Article 82 of the French Data Protection Act, and no consent banner is shown.
Product measures
Grinance counts a few product events to see how the app is used: when a plan is first completed, when a scenario is saved or applied, and when a preparation is set or edited. Each event carries the event's name, at most one coarse category, the month it happened in, and a code computed from your account identifier, the month and a secret key the publisher holds. Without that key the code cannot be linked to you, and because the month is part of it, codes from different months do not match. No amounts, labels, email addresses, tokens or anything you enter into a plan, scenario or preparation is collected, and there is no third-party analytics: the measurement stays first-party on Cloudflare. The events are kept for three months (Cloudflare Analytics Engine's own window) and no copy is kept in the app database. They hold nothing you could ask to export, and deleting your account leaves nothing linkable to you; your export and erasure rights are otherwise unaffected.
How long it is kept
Plan items, categories, the opening amount and preferences stay until you delete them or delete your account. A session ends at sign-out or 30 days after you last used it, and the record of an expired session is deleted within a day. Sign-in codes expire after five minutes, and the challenges of a passkey or a Google or Apple sign-in within ten minutes; any left unused are deleted within a day of expiring. The counts that slow down repeated sign-in attempts, keyed on an IP address, are deleted within two days of the last attempt. The count of codes emailed to an address covers one minute and is held by Cloudflare's rate-limiting service, not in the app database. A linked Google or Apple account, with its tokens, stays until you delete your account. The reminder logs record each reminder email sent: its kind, the date it was for, when it went out and, for a due-date reminder, how many occurrences it listed. They are pruned after 90 days. Request logs carry no amounts, labels or email addresses, and Cloudflare keeps them for at most 7 days. Deleting your account removes every row that belongs to you at once, and the session in your browser stops working; the database's point-in-time recovery history drops the deleted data within 30 days.
Security
Traffic is encrypted with HTTPS. A password is stored only as a hash, and a passkey only as its public key. Every database read is limited to the account it belongs to. If a breach is likely to put your rights and freedoms at high risk, you will be told without undue delay, as Article 34 of the GDPR requires.
Your rights
Under the GDPR and the French Data Protection Act you can access, rectify and erase your data, restrict or object to its processing, receive it in a portable format, and set instructions for what happens to it after your death. On the account page you can export your plan items, categories, scenarios, preparations, deadlines, reminder settings, cashflow opening amount and buffer, base currency history and other preferences as a JSON document, and you can delete your account permanently. For anything else, write to contact@grinance.com; Grinance answers within one month (30 days). You can also lodge a complaint with the CNIL (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr) or with the data protection authority of the country you live in.
Age
Grinance is meant for people aged 15 and over, the age of digital consent in France. It does not check age. If you believe an account belongs to someone younger, write to contact@grinance.com and it will be deleted.
Changes to this policy
This policy changes when the app or the law does. Material changes are announced in the app or by email before they apply, and the date at the top of this page shows the version in force.
Contact
For any question about this policy or your data, write to contact@grinance.com.