Privacy policy

Effective Date: [EFFECTIVE DATE]
Last Updated: [EFFECTIVE DATE]

This Privacy Policy explains how [LEGAL ENTITY NAME] ("we", "us", or "our") collects, uses, stores, shares, and protects your personal data when you use the MMJJS web application and services available at https://mmjjs.com (the "Service").

We are committed to protecting your privacy and handling your personal data transparently, lawfully, and securely in accordance with the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 ("DPA 2018"), and the Privacy and Electronic Communications Regulations ("PECR").

1. Who Controls Your Data

The data controller responsible for your personal data under this Privacy Policy is:

• Entity Name: [LEGAL ENTITY NAME]
• Company Registration Number: [COMPANY NUMBER, IF APPLICABLE]
• Registered Office Address: [REGISTERED ADDRESS]
• Information Commissioner's Office (ICO) Registration Number: [ICO REGISTRATION NUMBER, IF APPLICABLE]
• Privacy & Data Protection Contact: [PRIVACY EMAIL]

If you have any questions about this Privacy Policy, how your personal data is handled, or wish to exercise any of your statutory rights, please contact us using the email address above.

2. Our Core Architectural Privacy Principles

MMJJS is engineered around the principle of active financial awareness with strict data boundaries. Unlike conventional financial applications:

1. Manual by Design: We do not connect to your bank accounts via Open Banking, we do not scrape account data, and we never ask for your online banking passwords or credentials. All ledger entries are manually entered and verified by you.
2. Database-Level Row-Level Security (RLS): Privacy boundaries are enforced directly within our PostgreSQL database engine using cryptographically scoped policies. No user or household member can query or inspect records they are not permitted to see.
3. Cryptographic Blind Rollups: When you mark an asset, liability, investment, or outgoing as "Private" (is_private), its monetary value is mathematically included in combined household figures (such as total household net worth or committed expenses) via secure database functions, but the institution name, account nickname, and individual line-item balances are completely hidden from other household members.
4. No Advertising or Data Brokerage: We do not sell, rent, or monetise your personal or financial data. We do not use third-party advertising, behavioural tracking pixels, or third-party marketing analytics.

3. Personal Data We Collect

We only collect personal data that is necessary to provide, secure, and maintain the Service. The data we collect falls into the following categories:

A. Information You Provide Directly

• Account & Authentication Details: When you register, we collect your email address. If you choose to set a fallback password rather than using passwordless passkeys, your password is cryptographically hashed before storage.
• Authentication Credentials (Passkeys): If you register a passkey (FIDO2 / WebAuthn), our authentication provider stores the public key credential identifier, credential public key, and signature counter. Your actual biometric data (such as Face ID or fingerprint scans) and device PINs remain strictly on your local device and are never sent to or stored by us.
• Profile Information: We store a display name chosen by you (which defaults to your name or the prefix of your email address) to identify you within your household.
• Financial Ledger Entries (Personal Balance Sheet):
  • Liquid Accounts: Institution name, account nickname, account type (e.g., current account, instant-access savings, notice account, Cash ISA), balance (stored in integer minor units / pence), annual equivalent rate (AER), notice period in days, privacy status (is_private), and whether the account is open to receive household support (open_to_support).
  • Liabilities & Debts: Lender name, liability balance (in pence), annual percentage rate (APR), minimum monthly payment, due date, privacy status (is_private), and whether the debt is open to receive household support (open_to_support).
  • Investments & Holdings: Investment instrument or ticker symbol, instrument name, holding wrapper (e.g., General Investment Account, Stocks & Shares ISA, Lifetime ISA, SIPP), unit count, average cost basis (in pence), manual valuation overrides (in pence), and privacy status (is_private).
  • Income Sources: Source name (e.g., employer, business), net take-home amount (in pence), pay cadence (e.g., monthly, four-weekly, fortnightly), and the destination liquid account.
  • Committed Outgoings & Sinking Funds: Bill, subscription, or expense name, amount (in pence), frequency (monthly or annual), target sinking fund account, and privacy status (is_private).
• Monthly Reconciliation Records: Historical snapshot records created when you complete a monthly reconciliation pass (month_closes), including date of close, net worth, liquid total, investment total, and liability total.
• Collaborative & Household Content:
  • Household Structure: Household name, membership records, roles (e.g., owner, member, treasurer), and join dates.
  • Deal Prospectus Documents: Content authored in the prospectus editor for funding requests, including text headings, narrative explanations, tables, custom loan amortisation models (principal, term, APR), and itemised budget lines.
  • Prospectus Comments: Comments, questions, and negotiation notes posted on document blocks, and their resolution status.
  • Deals & Pledges: Bilateral debt-elimination and goal pledges between household members, agreed pledge amounts (in pence), frequency (one-off or recurring), target liability or account, and settlement timestamps.
  • Communal Pots: Micro-charter records including pot name, purpose description, target amount (in pence), chosen voting rule (majority or unanimous), member votes (yes, no, pending), ledger contribution amounts, and disbursement records.
  • Household Escrow Configuration: If configured by a household owner, the designated treasurer, designated liquid account identifier, and user-provided plain-text payment instructions.
• Notification Preferences: Your preference regarding whether to receive transactional notification emails (email_enabled flag).
• Support Communications: Any correspondence, feedback, or support requests you send to us via email.

B. Information Generated Automatically Through Use of the Service

• Achievement Milestones: Automated milestone records awarded when you hit specific financial targets (e.g., extinguishing a debt to zero during a reconciliation pass).
• Audit & Transaction Timestamps: Timestamps recording when records, reconciliations, deals, votes, and comments are created, updated, or settled (created_at, updated_at, closed_at).
• Technical Server Logs: Standard web server logs collected automatically by our hosting and platform providers when you interact with our web application, including your Internet Protocol (IP) address, browser type and version, operating system, referring URL, date/time stamps of HTTP requests, and request URLs.

C. Information Obtained from Other Users

• Household Invitations: If an existing member of a household invites you to join their household via email, they provide your email address to us. We use this email address solely to send the household invitation containing the invite code.
• Household Collaborative Actions: Other members of your household may generate records that reference you, such as votes on a communal pot you proposed, comments on your deal prospectus, pledges directed toward your open liabilities, or funds disbursed to your accounts.

D. Information We Do NOT Collect

To maintain absolute clarity, we do not:

• Connect to your online banking through screen-scraping or Open Banking APIs.
• Ask for, store, or have access to your bank account passwords, PINs, or security credentials.
• Collect credit or debit card numbers (the Service does not currently process payments).
• Collect biometric data.
• Collect special category personal data (e.g., health, racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, or sexual orientation).

4. Purposes and Lawful Bases for Processing

Under UK GDPR Article 6, we must have a valid lawful basis for every processing activity involving personal data. The table below sets out how and why we process your data:

5. How Your Information is Shared

We do not sell, rent, or trade your personal data to any third party. We share information only in the specific, controlled circumstances described below:

A. Sharing Within Your Household

MMJJS is designed for household coordination. By joining a household, you share certain information with other members of that household:

1. Visible vs. Private Records:
   • Any liquid account, liability, investment, or outgoing marked with is_private = false is visible in full detail (including provider name, account nickname, and balance) to all members of your household.
   • Any record marked with is_private = true is never visible in detail to other household members. Its monetary value is included only in mathematical household-level aggregates (the "Blind Rollup").
2. Deal Prospectus & Comments: Any prospectus you publish and comments posted on prospectus blocks are visible to all members of your household.
3. Communal Pots & Escrow: Pot charters, voting records, contributions, disbursements, and treasurer payment instructions are visible to all household members.
4. Support Eligibility: Debts or liquid accounts marked with open_to_support = true are displayed as eligible targets for household pledges or communal pot disbursements.

B. Third-Party Service Providers (Data Processors)

We engage carefully selected third-party service providers ("data processors") who process personal data on our behalf to deliver the Service. These processors act strictly under our instructions and are bound by data processing agreements requiring compliance with UK data protection standards:

C. Legal Requirements and Protection of Rights

We may disclose your information if required to do so by applicable law, regulation, court order, or valid government request, or where we believe disclosure is necessary to investigate, prevent, or take action regarding potential fraud, security threats, or violations of our Terms of Service.

6. International Data Transfers

Our primary hosting, database, and email infrastructure providers (including Supabase, Vercel, and Resend) are headquartered in the United States and may process data across international cloud regions.

Whenever personal data is transferred outside the United Kingdom to a country not recognized by the UK Government as providing an adequate level of data protection, we ensure appropriate safeguards are in place in accordance with Chapter V of the UK GDPR. These safeguards include:

• The UK International Data Transfer Addendum to the European Commission's Standard Contractual Clauses (SCCs); or
• The UK Extension to the EU-US Data Privacy Framework, where the recipient organization is certified under the framework.

You may request a summary of the transfer safeguards relevant to your personal data by contacting us at [PRIVACY EMAIL].

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, provide the Service, and comply with legal or regulatory requirements:

• Active Account Data: Your profile, personal ledger entries, balance sheet records, prospectus documents, and household records are retained for the lifetime of your active account.
• Monthly Reconciliation Snapshots: Historical month-end closing records (month_closes) are retained to provide your historical balance sheet timeline until deleted by you or upon account closure.
• Closed Month Ledger Entries: In accordance with strict accounting principles, ledger entries from closed months are locked against direct modification; corrections are recorded via offsetting reversal entries.
• Collaborative Negotiation Comments: To preserve fairness and an honest audit trail during household financial negotiations, comments attached to deleted prospectus blocks are retained in a collapsed, read-only "Removed content" section while the underlying funding request remains active.
• Server & Security Logs: Standard technical server access logs collected by our infrastructure providers are typically retained for 30 to 90 days for diagnostics, security auditing, and fraud prevention, after which they are deleted or anonymised.
• Upon Account Deletion: When an account is deleted, all associated personal ledger data, investments, liabilities, outgoings, allocations, achievements, and notifications are immediately and permanently removed via automated cascading database deletion (ON DELETE CASCADE).

8. Data Security

We implement appropriate technical and organisational measures designed to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or unauthorised access. These measures include:

• Hardware-Backed Authentication: Passkey (FIDO2 / WebAuthn) authentication eliminating password theft, credential stuffing, and phishing risks.
• Forced Database Row-Level Security: Every database table enforces PostgreSQL Row-Level Security (force row level security). Queries are cryptographically restricted to the authenticated user's ID (auth.uid()) or verified household membership.
• Definer-Enforced Rollup Boundaries: Rollup calculations across household members run inside secure SECURITY DEFINER database functions that calculate mathematical sums server-side and never transmit underlying private rows to the client browser.
• Cryptographic Secrets & Isolated Webhooks: Internal database webhooks are authenticated using dedicated shared secrets (X-Webhook-Secret) and executed over encrypted HTTPS connections.
• Encryption in Transit & at Rest: All data transmitted between your browser and our servers is encrypted using modern Transport Layer Security (TLS 1.3/1.2). Database records and backups are encrypted at rest using industry-standard AES-256 encryption.

Important Notice: While we implement rigorous, defense-in-depth security practices, no Internet transmission or electronic storage system can be guaranteed to be 100% impenetrable. We cannot warrant or guarantee absolute security against all unforeseen threats.

9. Cookies and Local Storage

Under the Privacy and Electronic Communications Regulations ("PECR"), we are transparent about our use of cookies and device storage:

A. Cookies

We do not use any advertising, marketing, profiling, or third-party analytics cookies.

We use only strictly necessary session cookies provided by our authentication system (@supabase/ssr):

• Purpose: To keep you signed in as you navigate between pages and to maintain your authenticated session with our database.
• Duration: Session-based or persistent for the duration of your active authenticated login.
• Legal Status: Under PECR Regulation 6(4)(b), strictly necessary cookies do not require prior consent because they are essential to provide the service explicitly requested by you.

B. Local Storage (localStorage)

We use your browser's local storage for a single functional preference:

• Key: mmjjs.has_skipped_passkey
• Purpose: A lightweight, client-side UX flag recording whether you have dismissed the passkey enrollment reminder on your current device. It prevents the prompt from reappearing repeatedly on that browser. It contains no personal data, no financial figures, and is never transmitted to our servers.

You can inspect, disable, or delete cookies and local storage items at any time through your web browser's security and privacy settings. Please note that disabling authentication cookies will prevent you from signing in to the Service.

10. Your Legal Rights Under UK Data Protection Law

Under the UK GDPR and the Data Protection Act 2018, you have statutory rights regarding your personal data. Subject to certain legal conditions and exemptions, your rights include:

1. Right of Access (Article 15): You have the right to request confirmation as to whether we process your personal data and to receive a copy of that personal data.
2. Right to Rectification (Article 16): You have the right to have inaccurate personal data corrected or incomplete data completed. You can update most ledger records, outgoings, liabilities, and your display name directly within the application at any time.
3. Right to Erasure / "Right to be Forgotten" (Article 17): You have the right to request the permanent deletion of your personal data where there is no compelling legal reason for its continued processing.
4. Right to Restriction of Processing (Article 18): You have the right to request that we restrict the processing of your personal data under certain circumstances (e.g., while the accuracy of the data is contested).
5. Right to Data Portability (Article 20): You have the right to receive personal data you provided to us in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.
6. Right to Object (Article 21): You have the right to object at any time to the processing of your personal data where we rely on legitimate interests as our lawful basis.
7. Right to Withdraw Consent: Where we rely on your consent to process personal data (such as optional notification emails), you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. You can toggle email notifications off directly in your /account settings.

How to Exercise Your Rights

To exercise any of these rights, please send an email to [PRIVACY EMAIL]. We will respond to your request within one calendar month in accordance with statutory requirements. We may require proof of identity before processing requests to safeguard your data against unauthorised disclosure.

11. Account and Data Deletion

In-App Deletion of Individual Records

You have full control over your active balance sheet. You can edit or delete individual liquid accounts, liabilities, outgoings, and investment contributions directly in the application interface. You can also withdraw from a household at any time using the "Leave Household" function.

Requesting Complete Account Deletion

Because MMJJS prioritises ledger integrity and multi-member household consistency, complete account deletion is currently processed via our operator verification workflow.

To delete your account and all associated personal data:

1. Send an account deletion request from your registered email address to [PRIVACY EMAIL].
2. Upon confirming your identity, our administrators will initiate the deletion command in our authentication service.
3. Because our database schema enforces strict cascading deletions (ON DELETE CASCADE), deleting your user record immediately and permanently removes:
   • Your user profile and display name;
   • All liquid accounts, liabilities, investments, income sources, and outgoings;
   • Your historical reconciliation passes, waterfall allocations, and month-end snapshots;
   • Your communal pot memberships, votes, and individual pledge requests;
   • Your in-app notifications and email preferences.

If you are the sole member of a household, the household record is deleted concurrently. If other members remain in the household, your membership row is removed, and any past contributions to communal pots or settled pledges are disassociated from your profile.

12. Children's Privacy

MMJJS is a financial planning and balance sheet platform designed exclusively for adult individuals and households. The Service is not directed at, marketed to, or intended for children under 18 years of age.

We do not knowingly collect personal data from anyone under the age of 18. If we become aware that we have inadvertently collected personal data from a child under 18 without verified parental consent, we will promptly delete that data and terminate the relevant account. If you believe that a minor has provided us with personal data, please contact us at [PRIVACY EMAIL].

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our technical architecture, product features, legal requirements, or operational practices.

When changes are made, we will update the "Last Updated" date at the top of this page. For material changes that substantially impact how your personal data is handled, we will notify you in advance by sending a notice to your registered email address or by presenting a prominent notice within the application before the changes take effect.

We encourage you to review this Privacy Policy periodically to stay informed about our data protection practices.

14. Questions and Complaints

If you have questions, concerns, or complaints about this Privacy Policy or how your personal data is handled, please contact us first so we can resolve the matter:

• Email: [PRIVACY EMAIL]
• Postal Address: [REGISTERED ADDRESS]

Right to Complain to the Regulator

You have the statutory right to lodge a complaint with the UK data protection supervisory authority at any time:

• Supervisory Authority: Information Commissioner's Office (ICO)
• Website: https://ico.org.uk
• Helpline: 0303 123 1113
• Postal Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF