Privacy policy

1. Who is responsible

JCheck (“we”, “us”) is the mobile application of the same name, together with this website. For the purposes of the UK and EU General Data Protection Regulation, the data controller is JCheck, 11501.

2. What we collect

Your account

• Your email address, used to sign in and to send you confirmation and password-reset messages.
• Your password, stored only as a cryptographic hash. We never see or store the password itself.
• The name you choose to be called by, which is shown to you and to anyone you share a list with.
• Your chosen language.

What you put in the app

• The names of your lists, and who they are shared with.
• The items on them: name, quantity, unit, icon and any note you add.
• A record of what you ticked off, when, and in what quantity, this is what the monthly figures and the suggestions are built from.

Advertising

Ads are served by Google AdMob. Where you allow it, Google receives your device's advertising identifier (the IDFA on iPhone, the Advertising ID on Android), your IP address, and general information about your device. We do not receive this data ourselves; we see only aggregate reporting such as how many ads were shown. See section 4.

What we do not collect

No location, no contacts, no photos, no microphone, no browsing history, and no analytics or tracking software of our own.

3. Why, and on what basis

4. Advertising and consent

JCheck is free and paid for by advertising. Ads are supplied by Google AdMob.

If you are in the European Economic Area, the United Kingdom or Switzerland, the app asks for your choice before any personalised advertising happens, using Google's own consent form. You may refuse. If you do, you will still see ads, but they will not be based on a profile of you.

You can change your mind at any time from Settings → Ad privacy options in the app. On iPhone, iOS additionally asks for permission to track; you can change that under Settings → Privacy & Security → Tracking.

Google acts as an independent controller for the data it collects through advertising. What it does with that data is governed by its own policies: how Google uses information from sites or apps that use its services.

5. Who else sees it

We do not sell your personal data, and we never will. We share it only with the services needed to run the app:

• Google AdMob, advertising, as described above.
• Resend, delivers confirmation and password-reset email. It receives your email address and the contents of that message, nothing else.
• Our hosting provider, your account and lists are stored on a server we run ourselves. The provider supplies the machine; it has no access to your data for its own purposes.

We may also disclose data where the law requires it, or to establish or defend a legal claim.

6. Shared lists

When you share a list, everyone on it can see its items, its history, and the display name of everyone else on it. They cannot see your email address, your other lists, or anything outside the list you shared.

Invite codes expire after seven days. The owner of a list can remove anyone from it, and anyone can leave a list they were invited to. Deleting a list deletes it for everybody on it, along with its history.

7. How long we keep it

• Purchase history: the current month and the one before it. Older records are deleted automatically, not archived, deleted.
• Lists and items: until you delete them, or delete your account.
• Your account: until you delete it.
• Invite codes: seven days.
• Server logs: a short rolling window, for security and debugging.

8. Your rights

Under the GDPR you have the right to:

• ask what we hold about you, and get a copy of it;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to how we use it;
• receive it in a portable, machine-readable form;
• withdraw consent for personalised advertising at any time, without it affecting what came before.

9. Deleting your account

Open the app and go to Settings → Delete my account. It is immediate and permanent: your account, your lists, your items and your entire purchase history are removed. There is no grace period and no way for us to bring it back, so do make sure.

Lists that other people are still on are removed from your access. A list you own is deleted for everyone on it.

Cannot get into the app? Ask us to delete it for you.

10. Security

Traffic between the app and our server is encrypted with HTTPS. Passwords are stored only as hashes. Access to your data is enforced by the database itself, row by row, so one account cannot read another's, and a shared list is readable only by the people it has actually been shared with.

No system is perfect. If we discover a breach that puts you at risk, we will tell you and the relevant authority as the law requires.

11. Children

JCheck is not aimed at children and is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has given us their data, write to us and we will delete it.

12. International transfers

Our server is in France, so your account, your lists and your history stay within the European Economic Area. Google and Resend may process data outside it, including in the United States. Where that happens, those transfers rely on the European Commission's standard contractual clauses or an adequacy decision.

13. This website

This site sets no cookies, runs no analytics, and loads nothing from anyone else, the fonts and images are served from this domain. Our web server keeps ordinary access logs, briefly, to keep the site up and secure.

14. Changes

If we change this policy we will update the date at the top. If a change matters to you, we will say so in the app before it takes effect.