OpenCount privacy.

What this covers

OpenCount is free, open-source software for splitting expenses. It comes two ways: the instance I run at app.opencount.eu, and copies anyone can run on their own server. The software behaves the same in both, so everything below about what it stores and sends holds for both. Who is responsible for the data is the part that differs.

Who is responsible

For app.opencount.eu, the data controller under the GDPR is zedensix, a private individual running a non-commercial service. For anything about your data, email contact@zedensix.com.

For any other instance, whoever runs it is the controller. If someone else gave you an account, ask them about your data: I have no access to their server.

What is stored, and why

• Your account: name, email address, a hash of your password, and if you set them up, your passkeys, authenticator app secret and backup codes. If you sign in with single sign-on, the provider’s ID for you and the tokens it hands back.
• Sessions: one per signed-in device, with the IP address and browser it was opened from.
• Groups: their name and currency, and their members. A member can be added by name before they have an account, so a group can hold the name of someone who never signed up.
• Expenses: description, amount, date, category, merchant, who paid and how it is split. Repeating expenses too.
• Invites and sign-up codes: the email address an invite was sent to, and short-lived codes, stored hashed.
• Appearance: your theme, accent colour, font and corners.

All of it exists to run the service you signed up for: splitting expenses with your groups and keeping your account secure. The legal basis is the performance of that service (GDPR Art. 6(1)(b)). Names of people added without an account, and the expenses they are part of, are held on the basis of the group’s legitimate interest in keeping its accounts straight (Art. 6(1)(f)).

Who sees what

• Members of a group see its members, including each member’s account email, every expense in it and everyone’s balance. Nobody outside the group can open it.
• The instance admin sees the list of accounts (name, email, role, whether two-factor is on, when they were created) and the invites sent. The app gives admins no way into a group they are not a member of.
• Nobody else. Nothing is sold, shared with third parties, used for advertising, or used for automated decisions about you.

Receipts

If the admin turns on receipt reading, you can scan a photo or PDF of a receipt to fill in an expense. The file is read in the server’s memory by Tesseract, an open-source text recogniser running on the same server, and dropped as soon as the reading is done. It is never saved, and never sent to any outside service. Only the amount, date and merchant it found go back to your form.

How long it is kept

• Your account and what is tied to it: until it is deleted.
• Groups and their expenses: until the group is deleted by the person who made it.
• Sessions: until you sign out or they expire.
• Sign-up codes: 15 minutes.
• Emails waiting to be sent (and so their recipient and contents): deleted 7 days after they go out.
• Server logs: each request’s method, path, status and duration, with no IP address, browser or account attached. They stay on the server.

Deleting an account deletes its sign-in details, sessions, passkeys, two-factor secrets and appearance. It does not delete your share of a group’s history: the other members still need their balances to add up, so the expenses you paid or owed stay in the group under the name you had in it. Ask the group to delete it if you want those gone too.

What leaves the server

• Emails: sign-up codes and invites go out through the mail server the admin configured, which sees the recipient and the message.
• Single sign-on: if you sign in through a provider the admin added, that provider sees the sign-in, under its own privacy policy.

That is the whole list. No telemetry, no update checks, no analytics, no fonts or scripts from a CDN. Error reporting and tracing exist in the software for self-hosters who point them at their own tools; on app.opencount.eu both are off.

Your device

OpenCount sets a session cookie to keep you signed in, short-lived cookies while you sign up, sign in with two-factor or a passkey, or use single sign-on, and a cookie to skip two-factor on a device you tick as trusted. They are all needed for signing in, so there is no banner asking about them.

Your browser’s local storage keeps your light or dark theme so a reload doesn’t flash. Installed as an app, it caches the app’s own code and icons for speed, never your groups or expenses.

Your rights

Under the GDPR you can ask to:

• access the data held about you, or get a copy of it
• have it corrected or deleted
• restrict how it is used
• object to it being processed at all

On app.opencount.eu, email contact@zedensix.com from the address on your account and you’ll get an answer within a month. That includes deleting your account, which the app doesn’t let you do yourself yet. On another instance, ask whoever runs it: they hold the data.

If you think your data is being mishandled, you can complain to the French data protection authority, the CNIL, or to the authority in your own EU country.

Changes

If what OpenCount collects or sends changes, this page changes with it, and the date at the top gets updated.