Privacy policy

Write to Fleuris

This page describes how the site works on 14 October 2026, from the published code. It does not describe a service that does not exist. It follows Regulation (EU) 2016/679 (GDPR) and French loi n° 78-17 of 6 January 1978 (Informatique et Libertés). The CNIL explains people's rights: https://www.cnil.fr/fr/les-droits-pour-maitriser-vos-donnees-personnelles

Controller

The controller for the processing Fleuris can actually hold is Myron Manns, a sole trader (micro-entreprise), SIREN 818 891 160, SIRET 818 891 160 00041, registered with the RNE. Address provided on request at . Email: . The controller does not receive the budget figures in clear text. Without an account they stay on your device. With an account, the server keeps only ciphertext.

What stays on your device

The browser stores the budget in IndexedDB, under the key fleuris-v1. That includes language, currency, payday, take-home pay, starting balance, the alert threshold, the savings target, bills, imported transactions, import batches, goals, merchant categories you corrected, alerts you hid, and a flag if you opened the sample.

Without an account, those figures are not sent to Fleuris, to a bank, or to a measurement tool. An imported statement is read in the browser. The file does not leave the device. No AI reads these figures. With an account, only text that is already encrypted is sent to the server.

In Settings you can export a JSON copy, import it back, or delete everything. If you clear this site's data in the browser, Fleuris loses it. The export is then the only copy.

Cookies and storage

The pages do not call document.cookie. They do not load an audience-measurement tool, an ad network, or a third-party tracker. If you open an account, the Worker sets two HttpOnly cookies, only for that session: fleuris_session, and fleuris_oauth for the Google or Apple round trip (ten minutes at most). Without an account, those cookies are not set.

The stores below stay on the device. They serve the tool you open, or a choice you made. They do not leave the device.

  • IndexedDB, database keyval-store, key fleuris-v1: the budget you asked the app to remember.
  • IndexedDB, database keyval-store, key fleuris-sync-v1: the account sync dates on this device, if you opened one.
  • IndexedDB, database workbox-expiration: when cached files for offline use expire.
  • localStorage, key fleuris-install-dismissed: the fact that you closed the install hint, so it is not shown again.
  • localStorage, key fleuris-theme: Light or Dark, the appearance chosen on this device.
  • localStorage, key fleuris-home: the visit count and the sections already opened, for the install hint and the Discover row.
  • localStorage, keys fleuris-seen-at, fleuris-nudge-never and fleuris-export-snooze: the date of your first visit on this device and your choices about the "save" and "open an account" reminders, so they are not shown too often. These values do not leave the device.
  • sessionStorage, keys fleuris-nudge-session, fleuris-home-session, fleuris-version-reload, fleuris-upload-asked and fleuris-upload-declined: cleared when the tab closes. They keep a reminder, a version reload or an upload question from repeating during the visit.
  • Cache Storage, caches workbox-precache-v2 and pages: a copy of the app files (scripts, styles, icons) and of pages already opened, so the app can open offline. The file that reads PDFs is not put in that cache ahead of time. These caches do not track your browsing for a third party.

The CNIL says trackers that are strictly necessary for a service the person expressly asked for do not need consent. That exemption is in article 82 of the French data protection law, and the CNIL restates it on its cookies and trackers pages: https://www.cnil.fr/fr/cookies-et-autres-traceurs. These stores fall under that exemption. So do the two account cookies, when they exist: they only serve the account you asked for. Fleuris therefore does not show a consent banner.

The host may set a technical security cookie if domain protection requires it. This project does not turn on any advertising or measurement cookie in its code. Storage that is not necessary for the service will not be added without consent asked first.

Host logs

Opening a page sends a request to Cloudflare, Inc., which hosts the site. The published configuration turns on Cloudflare observability. The host may then keep a technical log: IP address, date and time, requested address, browser agent. This project does not set how long those logs are kept. Cloudflare describes what it does with them in its own policy: https://www.cloudflare.com/privacypolicy/

Until Network Error Logging is turned off in the Cloudflare dashboard, every response carries the NEL and Report-To headers. The browser may then send a network-error report to Cloudflare (a.nel.cloudflare.com). That is not a cookie. No figure from your budget is in it.

Those logs do not contain your pay, your bills or your statement. The budget in clear text is not written there. With an account, the save request carries ciphertext, not the statement.

Public updates

A scheduled job runs every day on fleuris.fr, in a Cloudflare Worker. It reads public sources: fuel prices on data.economie.gouv.fr, the gas benchmark price published by the French energy regulator (CRE), the rent reference index (IRL) published by Insee, the Livret A and popular savings account (LEP) rates on Webstat (Banque de France), the minimum wage, housing benefits and the monthly "what changes" page on service-public.fr, the benefit revaluation on solidarites.gouv.fr, and the household tax calendar on impots.gouv.fr. It rewrites the public alerts file. A second job reads those same pages every four hours. If the text has changed, the public page says so and stops showing the figure until it has been checked again. Your browser does not contact those sources. It only loads that file from fleuris.fr. No figure from your budget enters these jobs. Ordering alerts against your bills happens on the device.

Account (optional)

Fleuris works without an account. You are not asked for an address until you open one. Without an account, your figures stay on the device and Fleuris does not receive them. Before anything is sent, the device encrypts the budget with a passphrase or a passkey. The server does not receive pay, bills or the statement in clear text.

If you open an account, we store your email address, the date the account was created, a session identifier (hashed) and your encrypted vault. To send you a sign-in code, the address is passed to Cloudflare Email Sending. If you choose Google or Apple, they pass us only your verified email address. Legal basis: performance of the service you ask for (GDPR article 6(1)(b)). How long: until the account is deleted; a session expires after 30 days; a code expires after 10 minutes. To limit abuse, the IP address and the email address are used to count code requests for one hour. You can delete the account at any time on Account: the address, the vault and the sessions are then erased from the server. To access or correct your account data, write to . An email address is required to open an account; without an account, Fleuris works as usual.

The anti-abuse counters rely on legitimate interest (GDPR article 6(1)(f)). Those rows, which hold an IP address or an email address, are deleted after 24 hours. The last sign-in is stored as a calendar day. An account with no sign-in for 3 years is deleted, after a warning email 30 days before. If you lose the passphrase and the recovery key, nobody can read the vault, not even Fleuris. The copy on this device stays when the account is deleted.

To count active accounts, Fleuris records the date of each account's last sign-in or sync, to the day. That date is updated on a sign-in or a sync, and it stays while the account exists. People without an account are not counted. No third-party tracker or measurement cookie is added for this.

Why this processing exists

The budget is processed in your browser to provide the tool you open. Without an account, Fleuris is not the recipient. With an account, Fleuris stores text it cannot read. Technical access logs are used to deliver and secure the site, on the legitimate interest in GDPR article 6(1)(f). No automated decision in the sense of GDPR article 22 is made from your budget.

How long

  • On the device: until you delete the data in Fleuris, or clear the site data in the browser.
  • Install hint and reminders: the local keys stay until the site data is cleared. Session keys disappear when the tab closes.
  • Cloudflare logs: a period set by the host, not defined in this project.
  • On the server, if you opened an account: the email address, the encrypted vault and the last sign-in date stay until the account is deleted. A session expires after 30 days. A code expires after 10 minutes. Anti-abuse counters are deleted after 24 hours. An account with no sign-in for 3 years is deleted, after a warning email 30 days before.

Recipients and transfers

Nobody receives your budget in clear text. Cloudflare, Inc. receives the request that loads the pages and, if you open an account, the ciphertext stored for that account and the email address, for the account and for sending the code. Google or Apple are contacted only if you choose their button, and only to verify the email address. The daily public job runs at Cloudflare and does not include your budget. Your budget figures in clear text are not part of that flow.

Cloudflare, Inc. acts as a processor (Cloudflare's data processing agreement). Transfers to the United States rely on the European Commission adequacy decision of 10 July 2023 (EU-U.S. Data Privacy Framework), Cloudflare being certified, and otherwise on the Commission's standard contractual clauses (decision 2021/914). Google and Apple, if you choose their button, act as separate controllers for their own sign-in service, under their policies.

Your rights

For data that stays on the device, you exercise the rights yourself. You see it on the screens. The JSON export covers access and, in practice, portability of the local budget. You correct a bill or a category. You delete everything in Settings, or by clearing the site data.

For a technical log the host may hold, or for account data (email address, sessions, encrypted vault), write to . You can ask for access, rectification, erasure and restriction, and you can object to processing based on legitimate interest, under GDPR articles 15 to 18 and 21. Fleuris replies within one month (GDPR article 12(3)). Portability under article 20 covers data you provided that a controller processes by automated means. Here, that is the JSON export of the local budget and, for the account, deletion from the Account page.

Complaint to the CNIL

You can lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL), under GDPR article 77. Address the CNIL gives for a complaint by post: Commission nationale de l'informatique et des libertés, Service des plaintes, 3 place de Fontenoy, 75007 Paris, France. Online: https://www.cnil.fr/fr/plaintes and https://www.cnil.fr/fr/adresser-une-plainte

iOS and Android apps

The Fleuris apps for iPhone, iPad and Android are the same tool, with the site files bundled in. The budget stays on the device. There is no tracker. An encrypted account stays optional, with the same Apple or Google sign-in as on fleuris.fr. A bill reminder is a local notification: it is calculated on the device and no token is sent to Fleuris. This policy covers the site and these apps.

Fleuris does not ask your age and is not directed at children. This policy is dated 14 October 2026. A newer version replaces this one on this page.