Privacy policy

Less Than Three is a shared-expense application personally published by Pierre Goutheraud. This policy explains the processing performed when you use the website, PWA, or Android application.

1. Data controller

The data controller is Pierre Goutheraud. For questions or requests concerning your data, email pierre.goutheraud@gmail.com.

2. Data we collect

• Account: user identifier, email address, and profile information supplied by Google when you sign in.
• Shared space: display names, currency, split rules, invitations, and couple-space membership.
• Financial information you enter: titles, categories, amounts, dates, payers, splits, reimbursements, and recurring entries. Less Than Three does not connect to your bank or collect bank account or card details.
• Necessary technical data: authentication session, language, privacy choice, PWA cache, and an onboarding draft stored locally on your device.
• Optional analytics: only after you consent, viewed pages and limited feature events, such as creating an expense or installing the app, plus aggregate approximate country or city, browser, operating system, and device type supplied by Vercel Analytics. Titles, amounts, notes, and other free-form financial content are never sent to analytics providers.

3. Purposes and legal bases

• Providing your account, synchronizing the shared space, and calculating balances: performance of the terms of service.
• Securing the service, preventing abuse, and diagnosing failures: legitimate interest in operating a safe service.
• Measuring feature usage with PostHog and Vercel Analytics: your consent, which you may withdraw at any time.

4. Sharing and processors

Data is accessible only to:

• the partner you invite, for content in your shared space;
• Supabase for authentication, database, and server services;
• Vercel for hosting and, with consent, analytics;
• PostHog for optional analytics;
• Google for the OAuth sign-in you choose to use.

We do not sell or rent your data or use it for targeted advertising. Some providers may process data outside the European Economic Area under their applicable contractual safeguards.

5. Analytics and storage technologies

Analytics remains disabled until you accept it. PostHog is configured without autocapture, session recording, geolocation, user profiles, or persistent identifier storage. Server events use one-time anonymous identifiers. Vercel Analytics uses aggregate data and a hashed visit identifier that expires after 24 hours, without advertising cookies. You can change your choice at any time with the “Analytics settings” link at the bottom of public pages.

Strictly necessary cookies and storage maintain your session, remember your language and privacy choice, and support offline PWA behavior.

6. Retention

• Account and application data: until account deletion.
• Backup copies: removed within no more than 30 days.
• Optional analytics: no more than 12 months.

7. Account deletion

You can delete your account from the app settings. If no partner has joined your space, the space and its data are deleted. If a partner is still a member, shared history remains available to them, but your account, email, and identity are removed and your former role is anonymized. Backups expire within the period described above.

8. Your rights

Under the GDPR, you may request access, correction, deletion, restriction, portability, or object to certain processing. You may withdraw analytics consent without affecting earlier lawful processing. Contact pierre.goutheraud@gmail.com. You may also complain to the French data protection authority, the CNIL.

9. Security

Transfers use HTTPS. Authentication, database-level authorization rules, and server-side secrets protect access. No online service can guarantee absolute security, so please report suspected issues promptly.

10. Children and policy changes

The service is limited to people aged at least 16. This policy may change as the service or applicable rules evolve. The date at the top identifies the current version.