Privacy policy

In short

• No account, no email address, no ads. Nothing is sold.
• The content of your spaces (amounts, currencies, descriptions, notes, categories, first names, pronouns, emblems, space name, the name of each phone) is end-to-end encrypted: the server passes it on without being able to read it. Your data lives on your phones.
• The server keeps technical identifiers, dates and sizes so it can pass encrypted messages from one phone to the other.
• During pairing only, first names, the space name and the device name pass through the server unencrypted, and the server then deletes them automatically (see During pairing).
• The app sends anonymous usage statistics. They are on by default and you can turn them off in Settings › About › Anonymous statistics.
• The website sets no cookies and measures its audience without any persistent identifier.

Data controller

Rodrigue POCLET EI (sole trader, French micro-entreprise)
75 route de Villeneuve, 07170 Mirabel, France
SIREN 828 887 638 — SIRET 828 887 638 00033
Contact: [email protected]

Twocount is built and run by one person. There is no appointed data protection officer: every request goes to the address above.

Your spaces are encrypted

What you enter in a space (amounts, currencies, descriptions, notes, categories, first names, pronouns, emblems, space name, the name of each phone) is encrypted on the phone before it is sent, using XChaCha20-Poly1305. The key never leaves the phones in the space: the server only receives encrypted messages it cannot read.

The server works like a mailbox: it holds an encrypted message until the other phone has received it, then deletes it. Your space's data lives on your phones.

What the server sees and keeps

To run a space, the Twocount server stores:

• Random technical identifiers for the space, each member and each device. They contain no name and no phone number.
• The state of each device: pending, active or removed, when it joined, when it last connected, and how far it has read in the message queue.
• Encrypted messages, with their size and the time they arrived. They are deleted as soon as every other device in the space has received them. A technical identifier and a sequence number for each message stay as long as the space exists, to avoid duplicates.
• The encrypted copy of the space sent to a new phone joining it: deleted as soon as that phone has received it (an interrupted upload is deleted after one hour).
• A fingerprint of each member's PIN code, computed on the phone: the code itself is never sent. The server also counts failed attempts, to block repeated guessing.
• A fingerprint of invitation codes, valid for 15 minutes.
• The phone's notification token, if you turned notifications on (see Notifications).
• Daily usage counters (for example how many spaces were created or how many messages were relayed that day), with no identifier at all. They are not about anyone in particular and are kept indefinitely.

How long. This information is kept as long as the space exists on the server. When a device leaves the space, its notification token and anything waiting for it are deleted; only a row with its technical identifiers and the state “removed” remains, until the space is deleted. A device that never finished joining is removed after 7 days. The space and everything related to it are deleted from the server once no device is attached to it any more.

Backups. The server makes one copy of its database per day and keeps the two most recent. Deleted data can therefore remain in those copies for about two days.

Logs. The server writes one line per request: date, duration, method, response code and the requested path, which contains technical identifiers (space, device). It does not write the IP address. It only uses it in memory, to limit how many pairing attempts can come from the same address. These logs contain no content from the spaces (amounts, labels, names). Their size is limited: a rotation configured on the server overwrites the oldest entries as it goes. The technical intermediaries in front of the server (Cloudflare, the hosting proxy) may log the IP address of connections, for their security and proper operation.

Exchange rates. For expenses in other currencies, the app asks the server for the rates of a given day and sends nothing else. The server itself queries the public Frankfurter service: no user data is passed to it.

Hosting. The server is hosted by Infomaniak, on a machine located in Switzerland, a country recognised by the European Commission as providing an adequate level of protection. Requests first go through Cloudflare (see Service providers).

During pairing

When you invite someone into a space, or add another of your own phones to it, a few details pass through the server unencrypted, so that everyone can see who they are connecting to:

• your first name and those of the space's members, and the space name if it has one (sent by the inviting phone);
• the first name chosen by the person joining, and the device name of the phone asking to join, as set in the phone's system settings (for example “Sophie's Galaxy S24”: it may contain a first name).

These details are used for pairing only. They stay on the server while the invitation screen is open, then the server's hourly clean-up deletes them automatically: usually within an hour after pairing ends, and at the latest about two hours after. They may also remain in the server's backups for about two days. Everything else exchanged during pairing (keys and the copy of the space) is encrypted. Once pairing is over, first names, the space name and the device name only travel encrypted, inside the space.

Notifications and links between spaces

If you turn notifications on, the app gets a notification token from Google Firebase Cloud Messaging and sends it to the server. The server uses it to wake up the phone when the other member has added something. The notification it sends contains nothing readable: just “sync” (or “pairing request”) and a hashed space marker that does not reveal the space's identifier. The text you see in the notification is written by your phone. On iPhone, Google delivers these notifications through Apple's service (Apple Push Notification service).

A phone has a single notification token. If you have several spaces on the same phone, that same token is registered in each of them, which lets the server tell that those spaces are on the same phone. It still cannot read what is in them.

The token is deleted from the server when you turn notifications off or when the phone leaves the space. To work, the Firebase service is built into the app and may give the phone a technical installation identifier, under Google's own rules.

Anonymous app statistics

To learn what is useful and what breaks, the app sends usage statistics to an Aptabase instance hosted by the publisher (Aptabase is an open-source analytics tool). They are on by default. You can turn them off at any time in Settings › About › Anonymous statistics: nothing more is sent, including anything still waiting on the phone, which is normally deleted shortly after.

What is sent:

• usage events: screens opened, an expense added, some durations in ranges, and so on;
• once a day, the state of the phone: number of expenses, devices, categories and spaces, the space's age in ranges, chosen settings (appearance, notifications…);
• technical error reports (type of error and where it happened in the code), never the raw error message, which could contain decrypted text;
• with each event: the operating system and its version, the app version, the phone's language and region, and a random session identifier that is renewed after one hour of inactivity.

What is never sent: amounts, descriptions, notes, first names, space name, space or device identifiers, advertising identifier. There is no lasting identifier for the phone, so no tracking from one day to the next. The Aptabase instance receives the phone's IP address, like any server you connect to.

Legal basis: the publisher's legitimate interest in improving the app, with a simple right to object through the switch above. Statistics already sent cannot be linked to a person and so cannot be found again to be deleted.

On your phone

• Each space has its own database on the phone, in the app's private storage, protected by the system. Keys and secrets are kept in the iPhone Keychain or the Android Keystore.
• On Android, the app's data is excluded from system backups and from transfers to a new phone. On iPhone, the app's files may be included in iCloud or computer backups, depending on the phone's settings.
• The camera is only used to read the invitation QR code. The image is analysed on the phone; nothing is saved or sent. On Android, this uses Google's ML Kit library built into the app, which may send Google technical statistics about how it runs, without the images.
• Face or fingerprint unlock is handled by the system: the app only learns “succeeded” or “failed”.
• The diagnostic report (app version, system, device name, sync status, recent errors) is only shared if you copy or share it yourself.

The twocount.app website

• The website sets no cookies.
• Its audience is measured with Umami, a tool hosted by the publisher, with no cookie and no persistent identifier: pages viewed, referring site, country, type of device and browser. These measurements cannot follow a person from one visit to the next. Legal basis: the publisher's legitimate interest in knowing how the site is used.
• The website is hosted by OVH and goes through Cloudflare. Like any intermediary, they see the IP address of requests and may keep it in their technical logs, under their own rules.
• No page of the website reads the invitation code contained in invitation links.

If you sign up to test the app

Before launch, the website offers a form to become a tester. It is hosted by Google (Google Forms) and the answers are stored in the publisher's Google Drive.

• Data requested: your first name, your type of phone, the email of your Google account or Apple ID, and whether your partner will test too.
• It is used only to invite you to the test (Google Play or TestFlight, which then receive your address) and to contact you about it. No marketing, never sold.
• It is deleted when the test phase ends, or sooner if you ask at [email protected].
• Legal basis: your consent, given by ticking the box in the form, which you can withdraw at any time.

If you email us

If you write to [email protected], your email address and message are used only to reply and follow up on your request. They are not used for marketing and are deleted once they are no longer needed for that follow-up.

Service providers and transfers outside the EU

• Infomaniak (Switzerland): hosting of the app's server. Switzerland is covered by a European Commission adequacy decision.
• Cloudflare: network intermediary in front of the app's server and the website. Sees the IP address and requests (the content of spaces stays end-to-end encrypted).
• Google Firebase Cloud Messaging: delivery of notifications, with no readable content.
• Apple Push Notification service: delivery of notifications on iPhone, with no readable content.
• Frankfurter: exchange rates, queried by the server only, with no user data.
• OVH (France): hosting of the website.
• Google Forms: tester sign-up form and storage of the answers.

Google, Apple and Cloudflare are US companies: technical data (IP address, notification token) and answers to the tester form may be processed in the United States. These transfers rely on the EU–US Data Privacy Framework, which these companies have joined, and on the European Commission's standard contractual clauses.

Legal bases

• Syncing spaces, pairing, notifications, server backups: providing the service you use (performance of a contract, GDPR article 6(1)(b)).
• Logs and limiting attempts: legitimate interest in protecting the service (article 6(1)(f)).
• Anonymous app statistics and website audience measurement: legitimate interest in improving the app and the site (article 6(1)(f)), which you can object to at any time.
• Replying to your emails: legitimate interest in handling your request (article 6(1)(f)).
• Signing up for the test: your consent (article 6(1)(a)).

The app does not rely on your consent: there is nothing to accept to use it.

Your rights and how to use them

You have the right of access, rectification, erasure, restriction, objection and portability. In practice:

• Erasing a space: in the app, delete or archive the space. The phone is then removed from the space on the server. Once no device is attached any more, the space and everything related to it are deleted from the server (and disappear from the backups after about two days).
• If you uninstalled the app without leaving the space, your registration stays on the server, along with the encrypted messages waiting for you. Write to [email protected] to ask for it to be erased. Since Twocount knows neither your name nor your email, the server can only find you through technical identifiers: tell us anything that can help find the space (rough date it was created, when it was last used, which phone). The publisher will tell you honestly if it cannot identify it with certainty.
• Statistics: turn them off in Settings › About › Anonymous statistics. Those already sent cannot be linked to a person.
• Access and portability: your spaces' data is on your phone, readable in the app. The server only has encrypted and technical data.

For any other request, write to [email protected]. If you believe your rights are not respected, you can lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr/fr/plaintes), or with the authority of the country where you live.

Age

Twocount has no minimum age. The app asks for no identity, no email address and no age, and does not rely on consent: it collects nothing more about a minor than about anyone else.

Changes and history

If this policy changes, the new version is published on this page with its date. Dated versions are kept in the project's repository.

• October 21, 2026: first version.