Privacy policy · Jarful

Who we are

Jarful is the household budgeting app at app.jarful.co.nz. It is run by Rebellion Limited t/a Jarful, a New Zealand limited company (NZBN 9429050622870). Our registered office and address for service is Suite 6, 33 Hairini Street, Hairini, Tauranga 3112, New Zealand. In this policy, “we” means Rebellion Limited.

Privacy questions and requests go to support@getjamjar.com. That is the address on the Jarful website contact page.

What we collect, and why

We collect personal information to run the app: to sign you in, to keep your household’s budget, to take payment if you subscribe, and to send messages the service needs. We also collect it to protect accounts and the service. That includes limiting repeated sign-in guesses, and monitoring and logging access and usage, including rate limiting, so we can keep Jarful secure and detect misuse.

You give us most of this yourself when you use the app:

Your email address, and a first name if you choose to enter one.
A household name, and the email address of anyone you invite. An invite is kept for 14 days.
What you enter for the household: categories, budgets, rules, bills, debts, notes, tags, goals, forecasts, projects, belongings, insurance details, and similar records.
Transactions you import from a CSV file, or from rows the app reads out of a PDF statement in your browser. We store those transactions and the account name and number the file identifies. We do not keep a separate copy of that original statement file.
Photos and PDFs you upload (receipts, belongings, insurance documents, project and reconciliation files). Those files are stored for your household.
Email preferences. Product news is off unless you turn it on. Setup reminders are on unless you turn them off. Sign-in codes are sent either way.

We also record security details when you sign in: the time, the IP address Cloudflare passes to the app, and the browser or device string. A sign-in code is a 6-digit number that expires after 10 minutes. Too many wrong guesses void the code. You can add a passkey. We store the passkey’s public information, not a photo of your face and not a fingerprint. Face ID, if you use it, stays on your device.

The app does not ask you to create a password.

Where it comes from

Most information comes from you. Some comes from other places:

A person who invites you gives us your email address before you have an account.
If you connect a bank, Akahu sends the account and transaction information described below. We do not collect it from the bank directly.
Stripe sends us the status of a subscription (for example, active or past due). You enter card details on Stripe’s own page.

If you import or connect information about someone else in the household, you need to be allowed to do that.

Bank connections (Akahu)

Live bank feeds are off until we turn them on. Until then you can import statements yourself. When feeds are on, they use Akahu, a New Zealand open-banking provider. The connection is read-only. The app asks Akahu for enduring consent. It does not ask Akahu to make payments or transfers, and it never asks for your internet-banking password.

You consent on Akahu’s screen, not on ours. We then store an access token for that connection. The token is encrypted in our database before it is saved. We also store the Akahu user id for that connection. We do not store a name or email returned by Akahu’s “who am I” call.

When a connection syncs, the app reads:

Accounts Akahu returns: name, institution, account type, balance, currency, and the account number. For a card, the stored number is the last four digits. For KiwiSaver and investment accounts, balances and holdings Akahu includes. Those investment accounts are used for net worth. Their transactions are not copied into spending.
Settled transactions from about the past year on the first sync, then new ones after that: date, amount, payee, description, particulars, code, reference, merchant, and Akahu’s category. Pending transactions are kept as a temporary list and replaced on the next sync.

Foreign-currency balances are converted to New Zealand dollars with a public exchange-rate table. That lookup does not include your name or account number.

You can revoke access in the app (Settings, disconnect that bank). The person who connected it, or a household owner, can do that. You can also withdraw consent on Akahu’s screen. If Akahu tells us the token has been revoked, we disconnect it here too. Leaving a household, being removed, or deleting your account also revokes the connections you made. If you are the last person in the household, every connection is revoked.

After a disconnect we delete the token and ask Akahu to revoke it. Transactions already in the household stay, because they are part of the budget. The pending list for that connection is dropped. You can delete individual transactions in the app. Deleting the household deletes them with everything else.

The exact permission names Akahu enables on our app are set by Akahu. This policy describes what the app actually reads. We have not confirmed, from this app, which country Akahu stores bank data in.

If we need to investigate or stop misuse of a connection, we may share the information needed for that with Akahu or the bank. Logs and misuse sets out the limits.

Payments (Stripe)

If a household owner subscribes, checkout and the billing portal run on Stripe. We send Stripe the owner’s email address, the household name, and the household id. Card numbers are entered on Stripe’s page. Our database stores the Stripe customer id, subscription id, plan (monthly or annual), status, the end of the current period, and whether the subscription is set to cancel at the end of the period.

We have not confirmed, from this app, which country Stripe stores that information in. Stripe is a United States company. The app talks to Stripe at api.stripe.com.

Email

We send email through Amazon SES. The configured region is Sydney, Australia (ap-southeast-2). Messages are sent from support@getjamjar.com. Replies go to support@getjamjar.com.

Those messages can include a sign-in code, your first name, a household name, an invite link, a setup reminder, and — if you leave them on — weekly budget notes and alerts. A weekly note can name bills, amounts left to spend, and subscription changes. An alert can name a payee and an amount. Optional “what changed” wording is described under AI below.

We keep a mail log (address, kind of message, subject, and whether it was accepted). For a real address, the sign-in code is not stored in that log. The log row for your address is deleted when you delete your account.

Optional AI (Anthropic)

AI features call Anthropic’s Claude API at api.anthropic.com. Anthropic is a United States company. Nothing is sent there unless a feature below is actually used. We do not use your information to train a Jarful model. This app does not tell Anthropic whether it may use those inputs to train its own models.

Every paying or trial household has AI extras, with a fair-use limit. The module is switched on until someone turns it off. Separate from the module, Ask Jarful has its own switch. That switch starts off.

Ask Jarful. If you turn it on, a question sends Anthropic the question, up to 12 earlier messages in that chat, and the figures the assistant requests. Those figures are totals, bills, goals, projects, and at most 30 transactions (date, payee, amount, category, and tags). The tools are written to leave out account numbers, references and notes, and to remove long runs of digits. A filter can miss an unusual format. Chats are stored in Jarful. You can delete a chat. While Ask is on, the weekly job may also send Anthropic the titles and text of that week’s “what changed” cards, so it can rewrite them as a short paragraph. That happens without a separate question from you.
Reading a file. If you ask the app to read a receipt, a product photo or label, or an insurance document, that image or PDF is sent to Anthropic. A receipt can include a card’s last four digits. An insurance document can include names, an address, policy numbers and amounts. Identifying a product can also send the brand and model, and Anthropic may run one web search.
How to cancel a subscription. If there is no saved guide, and AI extras are on, the subscription’s name (and a payment-processor name, if the app detected one) is sent to Anthropic with one web search. The guide that comes back is saved for every household under the provider name in the answer.

Answers and readings can be wrong. They are not financial advice. The terms of use say more about that.

Who can see the household

Everyone in the household can see the household’s transactions, files and other records. A JSON export is the whole household. It includes other members’ names and email addresses, Ask chats stored for the household, and notification subscriptions. It leaves out bank-feed tokens. The CSV export is transactions only. Photos and documents stored as files are not inside either download. Ask us at support@getjamjar.com if you need those files.

There is no support screen in the app for browsing a customer’s household. Someone who administers the Cloudflare account that hosts Jarful can open the database. That is how we would look at a household if you asked us to, or to fix a fault. The app does not keep a separate log of those administrator reads.

Where we store it, and how we protect it

The app runs on Cloudflare. The database (Cloudflare D1) and the file bucket (Cloudflare R2) are both configured with location oc, Cloudflare’s Oceania region. The configuration does not name a city or a country inside Oceania. The app itself is a Cloudflare Pages site. A request can be handled on Cloudflare’s network outside New Zealand. We have not confirmed, from this app, that the database disks sit in New Zealand.

The site is served over HTTPS. The sign-in cookie (ojj_s) is marked HttpOnly, Secure and SameSite=Lax, and lasts 30 days. We store a hash of the cookie value, not the raw value. Bank-feed tokens are encrypted with AES-256-GCM before they are saved, in a way that ties the ciphertext to that household. Other household records are ordinary database rows.

Your browser also keeps an offline copy of the household so the app can open when the network is poor. That copy is on your device. It is replaced when a different person or household loads successfully. Switching household reloads the page. If that reload cannot reach the network, the previous household can still be on screen until it can.

Logs and misuse

We monitor and log access and usage, including rate limiting, for security and to detect misuse. Sign-in logging is described above (time, IP address and device string). We may also log a request that hits a rate limit, or that we reasonably suspect is misuse, such as automated or flooding traffic. We use these records to protect Jarful and bank connections. We do not use them for advertising, and we do not sell them.

Where we need to investigate or stop misuse of an account, of Jarful, or of a bank connection, we may share the personal information needed for that with Akahu or the relevant bank. We do that where the disclosure is one of the purposes we collected the information for, or where you authorise it. We may share information with a public authority, such as the Police or a regulator, where the law requires it, or where the Privacy Act 2020 allows it. That includes where disclosure is necessary to avoid prejudice to the maintenance of the law by a public sector agency. We share only what that purpose needs.

Sending information overseas

The Privacy Act restricts disclosure of personal information outside New Zealand. We send personal information to the providers below on the basis that each one is required, by a contract with us, to protect it with safeguards comparable to the Privacy Act 2020.

Cloudflare (database, files, and the app network). Location hint: Oceania. Country inside Oceania not confirmed in this app. The network is global.
Amazon Web Services, SES (email). Sydney, Australia.
Stripe (subscriptions). United States company. Storage country not confirmed in this app.
Anthropic (optional AI). United States company. Storage country not confirmed in this app. Sent only when an AI feature in the section above runs.
Apple, Google, Mozilla or Microsoft (optional phone and desktop notifications). The message is encrypted for your device. The push service receives ciphertext, not the budget text. The subscription address is stored in Jarful. Which country that service uses is not fixed in this app.
Akahu (bank feeds, when turned on). New Zealand provider. Storage country not confirmed in this app.

We also download public shop logos (from Akahu’s logo address, or from the shop’s own website) so merchants are easier to recognise. That request does not include your name, email or account number.

We do not sell personal information. We do not use it for advertising. We do not run a third-party analytics tracker in the app.

How long we keep it

We keep the household’s records while the household exists, so the budget, history and files remain available. There is no shorter written period for transactions, files or chats.

Sign-in attempts older than 7 days are deleted the next time an attempt is recorded. Sign-in codes are deleted when you delete your account. The mail log for your address is deleted then too. Other access and usage logs we keep for security and to detect misuse, including rate-limiting records, are kept only for as long as we need them for that purpose, unless the law requires us to keep them for longer.

If you delete your account and you are the last person in a household, we cancel that household’s Stripe subscription, revoke its bank connections, delete the household’s budget records and files, and delete the household itself.

If other people still belong to the household, the household stays for them. That includes transactions (including ones from a bank you connected), files, and Ask chats already saved there. We revoke the bank connections you made. We remove your login, your passkeys and your sessions. In the current code, your Ask chats and notification subscriptions are not removed from a household that continues.

On either path we remove your email, IP address and device string from the security log. The log of events can remain without those details. Stripe event ids already stored for the household can also remain. The app does not set a date to delete those leftovers.

Disconnecting a bank does not delete transactions already imported. See the Akahu section.

Access, correction and accuracy

You can see and change most household information in the app. You can download a JSON export or a transactions CSV from Settings → Privacy & data. You can ask us for a copy, including files the export does not contain, at support@getjamjar.com.

You can correct records in the app, or ask us to correct them. If we refuse, we will tell you why and you can ask us to attach a statement of the correction you sought.

Bank and statement figures are stored as they were imported. You can recategorise and edit them. AI readings are suggestions until you keep them. We are not the source of your bank’s records.

The security history in the app shows recent sign-in events for your account (time, event, and device). Ask us if you want the IP addresses on those events as well.

Identifiers

We assign our own id to your account and to each household. We store Akahu’s user id and Stripe’s customer id so those connections keep working. We do not use an IRD number, or another government number, as your Jarful id. We do not give our id to other organisations for them to use as their identifier, except the household id we send to Stripe so a subscription is applied to the right household.

If information is lost or misused

If a privacy breach is likely to cause serious harm, we will notify the Privacy Commissioner and the affected people as the Privacy Act requires. We will also tell you what happened and what you can do. The app does not contain an automatic breach-notification tool. Notification is a step we have to take ourselves.

Changes to this policy

We will post the updated policy on this page and change the date. If a change is one we need to tell you about, we will email the address on your account or show a notice in the app. The app does not yet record a separate acceptance of this policy.

Contact, and the Privacy Commissioner

Email support@getjamjar.com. We will respond to an access or correction request as the Privacy Act requires.

If you are not satisfied, you can complain to the Office of the Privacy Commissioner: privacy.org.nz, 0800 803 909, PO Box 10094, Wellington 6143.

The terms for using Jarful are on the terms of use page.