Privacy notice

The current account test

Your plan is kept on your device and, when you are signed in, saved to the account database so it can be restored. This includes the income, bills, debts, goals, FUN budget, broad fun-activity categories and amounts that you choose to enter. FUN FUND does not connect to your bank, collect bank credentials or read bank transactions.

Technical information

The hosting provider may process routine request information such as IP address, browser/device details, requested page, time, security events and error logs to deliver and protect the service. The intended lawful basis is legitimate interests in running and securing the test.

Information we use

The account test uses account identity and contact data, your financial-plan entries, consent records, feedback, deletion/export requests, and limited campaign labels from links such as utm_source. It also records a restricted activity ledger—such as planner opened, setup completed, plan saved, “Can I?” checked, feedback submitted and perks viewed—to measure whether the test works. This ledger uses approved event labels and broad categories only; it does not copy emails, salaries, free-text goal names or the raw financial plan. Campaign labels describe where a link was placed; they do not describe or prove a person’s identity or sexual orientation.

Why information will be used

• Provide, save and secure the service—necessary to perform the tester agreement.
• Operate support, prevent misuse and improve reliability—legitimate interests.
• Include broad categories in anonymous, minimum-cohort trend statistics for product and brand-partner planning—your separate optional consent only.
• Send optional product and marketing email—separate consent only.
• Meet legal duties and handle rights requests—legal obligation where applicable.

Anonymous trend reporting

This is an optional, unticked choice and refusing it does not block the app. If you opt in, the private planning record is still not shown to brands. The back office calculates broad totals such as average monthly FUN budgets, total logged fun spend, popular categories, planned goal value and campaign-source counts. Category and campaign rows are suppressed until at least 10 different opted-in users contribute. Reports must not include names, email addresses, free-text goal names or individual financial records. You can withdraw from the account page; your plan is then excluded from future reports.

FUN FUND does not ask for, infer or create a profile of sexual orientation. Marketing in LGBTQ+ venues, media or events is contextual: visiting through such a link does not label a person as LGBTQ+.

Optional venue check-ins and visit intentions

Location is off by default. If you separately enable it and tap to check in, your browser asks for device-location permission. Exact coordinates are processed only to create an approximate one-kilometre area and are not stored. While the check-in page remains open, periodic device checks confirm whether you remain near the starting venue; the server receives only a nearby/not-near result. A check-in becomes a qualified dining visit after at least 30 minutes and a confirming check. You may instead submit a venue you would like to visit without sharing device location.

Venue signals may include the venue name, broad category, approximate area, optional age band, broad party-size band, intended timing and calculated dwell time. Identifiable venue records are deleted after 30 days. Short unqualified check-ins are deleted after 24 hours. Withdrawing location permission deletes your identifiable venue signals immediately. Partner reporting is delayed by at least 24 hours and requires both location permission and anonymous-insight permission from at least 10 different people. Partners never receive names, email addresses, exact or live locations, individual routes, financial plans or sexuality data.

Marketing choices

Marketing email permission will be separate, specific, optional and unticked. Refusing it will not affect access. The consent wording/version and date will be recorded, and withdrawal will be available from account settings and every marketing email.

Processors, partners and transfers

The account beta uses Vercel for hosting, Clerk for authentication and Neon for database storage. Resend may be enabled later for email. They act as service providers/processors subject to their contracts. Brand partners may receive only the anonymous minimum-cohort statistics described above, not account or plan records. International-transfer safeguards, data locations and retention settings must be checked and documented for each provider before a wider launch.

Retention

The device copy remains until you delete it or browser storage is cleared. Account and plan data remain until account deletion during the beta; qualified venue signals and visit intentions are kept for up to 30 days; short unqualified check-ins for up to 24 hours; routine activity metadata for 12 months; feedback for 24 months; and consent/suppression evidence for up to six years where reasonably required to demonstrate compliance or defend legal claims. Provider backup deletion periods must be confirmed before wider invites.

Your rights

Depending on the circumstances, UK data-protection law may give you rights to access, correct, erase, restrict, object to or receive a copy of your information, and to withdraw consent. This includes the right to object to use based on legitimate interests, including anonymous trend reporting. Contact details will be added before tester invitations. You can also complain to the Information Commissioner’s Office.

Delete or export your plan

Use the controls in FUN FUND or the account page to download a copy of your profile, plan, consent, feedback, activity ledger and venue signals, or request deletion of the account, cloud plan, identifiable activity events and venue signals. Do not use V1 as your only record of important information.