What we keep, and what we don't have

The rule, in three sentences

• Halis never holds your money and is connected to no bank. What goes into Halis, you write it — or someone in your group does.
• Halis reads neither your texts, nor your contacts, nor your precise location. No ads, no trackers, no resale.
• Your personal space only opens one account at a time, to a person you name, and the Coach never receives a word you have written.

Who is responsible

Halis is published by Africatech Studio, the data controller under the General Data Protection Regulation (GDPR). For any question about your data, write to bonjour@halis.app. A real person answers.

What we keep, and why

Everything below exists to run Halis. Nothing is collected for anything else.

• Your account: your email address — verified by a code, or provided by Google or Apple if you sign in with them —, your first name and your preferred currency. To recognise you, write to you, and show your amounts in your currency. No phone number, no password.
• Your devices: the model, the platform, the date of last activity, and an approximate location derived from the IP address at sign-in. So the Security screen can show you where your account is open, and so you can remove a lost phone.
• Your money: your accounts, movements, envelopes, goals, scheduled savings and categories — the amounts, currencies, dates and labels you write. That is the product.
• Your groups: the group name, its members, the shared expenses and how they are split, the repayments marked as done. Every member sees what the group contains: that is what a group means.
• Receipts: the photos of tickets and receipts you attach to a movement, if you attach any.
• Notifications: one notification token per device, so your phone can receive a reminder. It is deleted with the device.
• Crashes: when the app or the site crashes, an error report leaves with the version and the device model. Codes, tokens, addresses and numbers are filtered out before it is stored, and the IP address is anonymised.

The legal basis for all of this is the performance of the service you asked for (article 6.1.b of the GDPR), and our legitimate interest in keeping it safe where devices and crashes are concerned (article 6.1.f). The Coach, for its part, rests on your consent: it has its own section below.

What we don't have

• Your texts, your bank notifications, your contacts, your precise location: nothing is read on your phone.
• Access to your bank: Halis connects to no bank account and moves no money.
• Ad trackers, pixels, third-party analytics: neither in the app nor on the site. The site uses no cookies; your appearance choice, light or dark, stays in your browser.
• A buyer: your data is neither sold, nor rented, nor handed over.

The line between your personal space and the group

What is yours is not the group's. Your accounts, envelopes and goals are visible to you alone: no setting opens them to a group, and no member has access to them.

You can open one account, one at a time, to a person you name: they see its balance and its movements, and nothing else from your space — not your other accounts, not your envelopes, not your goals, not your report. You choose what they can do there, you can change it, and you can take it back. Every line carries the name of whoever wrote it, and someone you remove stops seeing the account while staying named on what they entered.

Conversely, what you enter in a group is seen by all its members, and stays after you leave: a shared expense is a fact of the group, and deleting it would rewrite everyone else's balance.

Halis ranks no one: no leaderboard, no “late”, and no member receives a score about another.

The Coach

The Coach is a conversation grounded in your ledger. It only starts if you turn it on, and you can turn it off whenever you want.

What then leaves your phone is an extract reduced to the minimum: amounts, categories, dates, balances. Never a label, never a note, never a group or member name — no text written by a person. Neither your name nor your address.

Answers are produced by a Google model (Gemini). The service that calls it is ours; it keeps no history of your questions or of the answers. The conversation is kept on your device, and the only thing that exists server-side is a transport buffer, one hour at most, for the time it takes to deliver the answer to you.

The Coach decides nothing: it writes no movement and moves no amount. A figure it shows comes from your ledger, not from it.

Where it lives, and who helps us

Halis runs on our servers, and the database that holds your ledger is hosted in Western Europe. A few providers do what we don't do ourselves. Each receives only what it needs, under contract, and none may use your data for its own purposes.

• Neon — the database, in Western Europe.
• Cloudflare — the halis.app site, the beta waiting list, and receipt storage.
• Resend — sending emails: sign-in codes, sign-up confirmations.
• Google — “Continue with Google”, notifications on Android, and the Coach's model. The text of a notification passes through Google to reach you.
• Apple — “Continue with Apple”, notifications on iPhone, and TestFlight during the beta. The text of a notification passes through Apple to reach you.
• Sentry — crash reports, filtered before storage, hosted in the United States.

When a provider processes data outside the European Union, it does so under the European Commission's standard contractual clauses or within the EU–US Data Privacy Framework.

For how long

• Your account and your ledger: as long as your account is open.
• A sign-in code: a few minutes, then it expires.
• A crash report: ninety days.
• The Coach's buffer: one hour at most.
• The beta waiting list — first name, address, platform: until the beta ends, or sooner on request.

Closing your account makes it inaccessible at once, on all your devices, and the ledger on the device that asked for the closure is wiped. Your personal space can then no longer be read by anyone; it is deleted from our servers at your request, within thirty days. What you entered in a group stays with the group, under your first name: it is the only thing we keep for the others, because deleting it would change their balances.

Your rights

The GDPR gives you rights over what concerns you, and they need no form.

• See what we hold about you, and receive a readable copy of it — an export.
• Correct what is wrong: your first name and currency change in the app; for the rest, write to us.
• Erase: close your account from the app, then ask for the deletion of what remains.
• Object to a processing, or ask for it to be restricted.
• Withdraw your consent to the Coach at any time, by turning it off.

To exercise them, write to bonjour@halis.app from your account's address. We answer within thirty days. If you believe we have not answered properly, you can lodge a complaint with the CNIL in France, with the data protection authority of your country of residence, or with the Commission de protection des données personnelles in Senegal.

Security

Everything that travels between your phone and our servers is encrypted, and so is the database at rest. Sign-in needs no password: a one-time code sent by email, or your Google or Apple account.

Each device has its own session, which you can remove from the Security screen; closing the account removes them all. A lost device is removed from there, and it never reopens the old session.

Minors

Halis is for people aged sixteen and over. If you think someone younger has opened an account, write to us: we close it.

What changes

This page will change with the product. We tell you before it changes — in the app, or by email if the change touches what we collect — and the date at the top always says when it dates from.