JCheck ← Back to the app

Privacy policy

Last updated .

The short version

JCheck stores your shopping lists so they work across your devices and the people you share with. Purchase history is deleted automatically after two months. There are no ads, no analytics and no tracking. We do not sell your data. You can delete your account, and everything in it, from inside the app.

1. Who is responsible

JCheck (“we”, “us”) is the mobile application of the same name, together with this website. For the purposes of the UK and EU General Data Protection Regulation, the data controller is JCheck, 11501.

2. What we collect

Your account

  • Your email address, used to sign in and to send you confirmation and password-reset messages.
  • Your password, stored only as a cryptographic hash. We never see or store the password itself.
  • The name you choose to be called by, which is shown to you and to anyone you share a list with.
  • Your chosen language.

What you put in the app

  • The names of your lists, and who they are shared with.
  • The items on them: name, quantity, unit, icon and any note you add.
  • A record of what you ticked off, when, and in what quantity, this is what the monthly figures and the suggestions are built from.

What we do not collect

No advertising identifier, no location, no contacts, no photos, no microphone, no browsing history. JCheck carries no advertising software and no analytics software, from us or from anybody else.

3. Why, and on what basis

What for Data Legal basis (GDPR Art. 6)
Running the app: your lists, on your devicesAccount, list contentsPerformance of a contract (b)
Suggesting what you usually buyPurchase historyPerformance of a contract (b)
Sign-in and password-reset emailEmail addressPerformance of a contract (b)
Keeping the service secure and workingServer logsLegitimate interests (f)

4. Who else sees it

We do not sell your personal data, and we never will. We share it only with the services needed to run the app:

  • Resend, delivers confirmation and password-reset email. It receives your email address and the contents of that message, nothing else.
  • Our hosting provider, your account and lists are stored on a server we run ourselves. The provider supplies the machine; it has no access to your data for its own purposes.

We may also disclose data where the law requires it, or to establish or defend a legal claim.

5. Shared lists

When you share a list, everyone on it can see its items, its history, and the display name of everyone else on it. They cannot see your email address, your other lists, or anything outside the list you shared.

Invite codes expire after seven days. The owner of a list can remove anyone from it, and anyone can leave a list they were invited to. Deleting a list deletes it for everybody on it, along with its history.

6. How long we keep it

  • Purchase history: the current month and the one before it. Older records are deleted automatically, not archived, deleted.
  • Lists and items: until you delete them, or delete your account.
  • Your account: until you delete it.
  • Invite codes: seven days.
  • Server logs: a short rolling window, for security and debugging.

7. Your rights

Under the GDPR you have the right to:

  • ask what we hold about you, and get a copy of it;
  • have inaccurate data corrected;
  • have your data erased;
  • restrict or object to how we use it;
  • receive it in a portable, machine-readable form.

8. Deleting your account

Open the app and go to Settings → Delete my account. It is immediate and permanent: your account, your lists, your items and your entire purchase history are removed. There is no grace period and no way for us to bring it back, so do make sure.

Lists that other people are still on are removed from your access. A list you own is deleted for everyone on it.

Cannot get into the app? How to get back in and delete it.

9. Security

Traffic between the app and our server is encrypted with HTTPS. Passwords are stored only as hashes. Access to your data is enforced by the database itself, row by row, so one account cannot read another's, and a shared list is readable only by the people it has actually been shared with.

No system is perfect. If we discover a breach that puts you at risk, we will tell you and the relevant authority as the law requires.

10. Children

JCheck is not aimed at children and is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has given us their data, write to us and we will delete it.

11. International transfers

Our server is in France, so your account, your lists and your history stay within the European Economic Area. Resend may process data outside it, including in the United States. Where that happens, that transfer relies on the European Commission's standard contractual clauses or an adequacy decision.

12. This website

This site sets no cookies, runs no analytics, and loads nothing from anyone else, the fonts and images are served from this domain. Our web server keeps ordinary access logs, briefly, to keep the site up and secure.

13. Changes

If we change this policy we will update the date at the top. If a change matters to you, we will say so in the app before it takes effect.