Privacy policy

Data controller

The data controller is [PUBLISHER_NAME], [PUBLISHER_ADDRESS].

For any question about your data, write to support@wenous.fr.

Data we collect and why

WeNous only collects the data it needs to run the service. Your data is never sold or used for advertising.

Your account

• First name, last name, email address and date of birth, requested at sign-up, to create your account, identify you and show you to the members of your relations. Only you can see your date of birth.
• Password: it is never stored in plain text, only as a hash from which it cannot be recovered.
• Profile photo, optional, resized on your device before it is uploaded.
• Preferences: language, theme and notification settings.

What you share in your relations

A relation is the space you share with other people: a couple, a family, flatmates, a trip, friends… What you enter there is stored so that it can be shared with its members:

• the relation itself: name, type, description, photo, anniversary date and default expense split;
• its members: each person’s role and joining date;
• the shopping list: items, quantities, units, notes, and who checked off what;
• expenses and repayments: title, amount, date, payer, participants, split, note and recurrence;
• tasks: title, description, priority, due date, assignees, progress and recurrence;
• calendar events: title, description, category and dates;
• the activity log: who created, edited or deleted what, and when.

Tasks and events in your Personal space are stored the same way, but only you can see them.

Invitations

To bring someone into a relation, an owner can enter that person’s email address or simply share a link. The invitation stores that address, if any, the proposed role, who sent it, its status and its expiry date. The address is used to show the invitation to the WeNous account that holds it.

Technical data

• Sessions: each signed-in device has its own session. Only a hash of the session token is stored, together with the device’s platform (iOS or Android).
• Notifications: if you allow them, your device’s notification token, its platform and when it was registered and last used, so that we can send you due-date reminders for the tasks assigned to you. Every reminder sent is logged.
• Your device’s time zone: sent with every request and stored with what you enter, so that dates fall on the right day.
• IP address: held in the server’s memory to limit the number of attempts on sensitive operations (sign-up, sign-in, password, invitations). It is not stored in our database.

Contacting support

If you write to us, your email address and your message are used to handle your request.

This website

This website has no forms, no accounts and no audience measurement. Its host processes your IP address to serve you the pages you request.

Legal bases

• Performance of the contract formed by the terms of use: creating and managing your account, sharing the data of your relations, invitations, password reset, support.
• Consent: push notifications, which you allow or refuse on your device and can turn off at any time in its settings.
• Legitimate interest: keeping the service secure, protecting sessions, limiting attempts and preventing abuse.

Recipients and processors

Members of your relations

The active members of a relation see your first name, last name, photo and email address, what you enter there, the activity that involves you and each member’s activity statistics. Each member only sees the activity log from the day they joined. Someone you invite sees your first name, last name and photo. Nothing is shared from one relation to another.

Our service providers

These providers process data on our behalf, solely to run the service:

• Vercel Inc., hosting of this website. 440 N Barranca Ave #4133, Covina, CA 91723, USA. Hosting region: [WEBSITE_REGION].
• [API_HOST], hosting of the app’s server. [API_HOST_ADDRESS]. Hosting region: [API_REGION].
• Neon Inc., hosting of the database. [NEON_ADDRESS]. Hosting region: [DATABASE_REGION].
• Cloudinary Ltd., storage and delivery of photos. [CLOUDINARY_ADDRESS]. Hosting region: [MEDIA_REGION].
• Expo (650 Industries, Inc.), delivery of push notifications. [EXPO_ADDRESS]. Hosting region: [PUSH_REGION].
• Brevo (Sendinblue SAS), sending of service emails. [BREVO_ADDRESS]. Hosting region: [EMAIL_REGION].

Photos go straight from your device to our photo storage provider, without passing through our server.

Push notifications are passed by our delivery provider to Apple’s (iOS) or Google’s (Android) notification services, which deliver them to your device. They contain the title of the task concerned.

Transfers outside the European Union

Some of our providers are companies based outside the European Union, notably in the United States, and may process data there. These transfers rely on an adequacy decision of the European Commission, such as the EU–US Data Privacy Framework, or on the standard contractual clauses adopted by the Commission.

You can obtain a copy of these safeguards by writing to support@wenous.fr.

How long we keep data

• Account: for as long as it exists. After it is deleted, see below.
• Relation content: for as long as the relation exists. Deleting an item removes it from the app for every member, but it remains stored in our database. The same applies to a deleted relation.
• Checked-off shopping items: permanently deleted 30 days after being checked off.
• Sessions: a session ends after 30 days without using the app on the device. The token sent with each request is only valid for about 15 minutes.
• Password reset: the link sent can be used once and is valid for 30 minutes. A new request cancels the previous one.
• Invitations: valid for 7 days, then kept on record with their status.
• Notification token: deactivated when the device signs out, or as soon as the notification service reports it as invalid.

After your account is deleted

• Immediately, the account can no longer sign in, all its sessions are closed and it leaves all its relations.
• 30 days later, its email address is replaced with an anonymous value and its profile photo is deleted. The address can then be used to sign up again.
• Still stored: first name, last name and date of birth, paid expenses and shares, so that the other members’ balances stay correct, and past activity, which appears without a name in the activity log.

The details are on the Delete your account page.

Security

• Passwords are protected with the Argon2id algorithm and never stored in plain text.
• Session and invitation tokens are only stored as hashes. Invitation links are also encrypted.
• On your device, session tokens are kept in the system’s secure storage.
• Traffic between the app and the server is encrypted (HTTPS).
• On every request, the server checks that you are an active member of the relation you are viewing.
• The number of attempts on sensitive operations is limited.

If a data breach puts your rights at risk, we notify the CNIL and, where the law requires it, the people affected.

Your rights

Under the GDPR and the French Data Protection Act, you have the right to:

• access your data and get a copy of it;
• correct it: your first name, last name, date of birth and photo can be changed in your profile, and support corrects your email address;
• erase it, in particular by deleting your account;
• restrict or object to its processing;
• receive the data you gave us in a structured format, to pass it on to another service;
• withdraw your consent to notifications at any time;
• set instructions for what happens to your data after your death.

How to exercise them

Write to support@wenous.fr from your account’s email address, stating which right you wish to exercise. We reply within one month, which may be extended by two months for a complex request; we will let you know if so. If we have reasonable doubts about your identity, we may ask you for additional information.

Complaints to the CNIL

If you believe your rights are not being respected, you can file a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL), at cnil.fr. We encourage you to write to us first, so that we can put things right.

Cookies

This website sets no cookies and loads no scripts: no audience measurement, no advertising, no third-party services. You are therefore not asked for consent.

The app does not use cookies. It keeps your session tokens on your device, in the system’s secure storage, along with your display settings: language, theme and the last relation you opened.