Privacy policy

The short version

• No account, no name, no email needed to use the tool.
• Your answers are encrypted in your browser before they’re saved. Our server keeps a budget it can’t read without your code.
• We never store your IP address in our database.
• No tracking cookies, no ads, no selling your data. No profiling.
• Our host, Cloudflare, is outside Quebec. We assessed that risk (section 7).
• You can delete your budget yourself, any time, in one click.
• Questions? Write to the person in charge of personal information: budget-tooling@proton.me.

1. Who we are

Coussinet is an online budgeting tool run by a self-employed sole proprietor in Quebec.

Email: budget-tooling@proton.me

In this policy, “we” means the person who runs Coussinet. “You” means the person (or couple) using the tool.

2. The person in charge of your personal information

The person in charge of the protection of personal information is Yannick Beaudoin, founder of Coussinet. This person makes sure this policy is followed, answers your questions, and handles your requests and complaints.

Contact: budget-tooling@proton.me. We answer in writing within 30 days, free of charge.

Only one person, the founder, has access to our systems and mailboxes. Nobody else works with your information.

3. What we collect, why, and for how long

We collect as little as possible. Here’s all of it, category by category.

3.1 The split calculator (“Calculator” page)

Everything happens in your browser. Nothing is sent or stored.

3.2 Your budget, saved on our server

• What: your interview answers, encrypted in your browser before they’re sent: income, expenses, debts, goals, children’s age brackets, couple situation, the boxes you ticked on your to-do list, and the nicknames you chose (a nickname or an initial is enough: please don’t enter your full name). Alongside the encrypted budget we keep only: a fingerprint of your budget’s identifier, whether the plan is unlocked, and a few dates (creation and last change, needed to sync between devices; last opened, to the day, for automatic deletion).
• Why: so you can come back to your budget later, on another device or with your partner, and so we can compute your “autopilot” plan if it’s unlocked.
• When: saving to our server starts automatically after the “Your income” section (before that, nothing leaves your device). A message tells you when it happens.
• Is it personal information? We treat it as such. Even encrypted and without a name, a budget describes a real person’s situation, and it’s sensitive. So we apply every rule in the law.
• How long: a budget that is not unlocked is deleted automatically if it hasn’t been opened or changed for 6 months. An unlocked budget (with an access code or, later, by a payment) is kept for as long as the service exists; if the service ever shut down, we’ll tell you at least 6 months in advance, on the website and in the tool, with a way to export your budget. Either way, you can delete it yourself whenever you want (section 10).

The technical details (code, encryption, fingerprint) are in Under the hood.

3.3 Computing your plan (if your plan is unlocked)

To compute your plan, your browser sends your budget’s key to our server over an encrypted connection. The server first checks that the plan is unlocked, then decrypts your budget in memory, for a few moments, computes the plan, sends it back, and forgets the key and the readable budget. Nothing is kept unencrypted, nothing is written to our logs, and the plan isn’t stored on our server. See Under the hood, section 5.

3.4 The copy on your device

Your browser keeps an encrypted copy of your budget and your code in its local storage, so you can pick up where you left off without retyping anything, even offline. This copy stays on your device: we don’t receive it.

Good to know: someone using the same browser could reopen your budget, like a tab left open. On a shared device, use “Save and exit”. The copy stays on the device until you clear it (“Save and exit”, “Delete my budget”, or by clearing the site’s data in your browser). If you create a link to bookmark or copy the share link, that link contains your code and may stay in your browser history: see Under the hood, section 6.

3.5 Emails you send us

• What: your email address, your name if it appears, and your message.
• Why: to answer you (support, exercising your rights).
• It’s optional. Never send us your budget code: we don’t need it to help you, and email isn’t a safe place to keep it.
• How long: 24 months after our last exchange, then deleted. If a request is ever tied to a purchase, it will be kept with our accounting records (6 years, as tax law requires).
• Your email goes through our email provider, Proton AG (Switzerland) (section 6).

3.6 Technical connection data

Like any website, our host Cloudflare receives your IP address, browser type and other technical data when your browser connects. That’s needed to deliver the pages and block bots.

• On our side: your IP address is used only, in the moment, to limit the number of requests (against bots). It is never stored in our database. Our technical logs don’t keep request details: only counters and errors, deleted after a few days (currently 3 days).
• Against bots: when a budget is created and when you try an access code, we use Cloudflare Turnstile, a check that usually needs no puzzle. Turnstile runs in your browser and looks at technical signals (IP address, browser type, connection fingerprint) to recognize bots. Our server doesn’t pass your IP address to it on top of that. It also sees the page address (the step name), but never your code.
• On Cloudflare’s side: Cloudflare processes this technical data for us, and partly for its own security needs and to improve its network and Turnstile, under its privacy policy and the Cloudflare Turnstile Privacy Addendum. Cloudflare’s dashboard also shows us traffic statistics and a sample of requests, which may include the IP address, country, browser type and page address (never your code). Cloudflare keeps them for up to 31 days. We look at them only to spot attacks or outages; we don’t copy them anywhere and we never link them to a budget.

3.7 Access codes (early testers)

• What: before payments open, we give access codes to a few early testers; a code unlocks a budget’s plan for free. For each code we keep only a fingerprint of the code, the day it was created, its expiry date if it has one, how many times it can be used and how many times it has been used.
• Never the date it was used, nor which budget used it: unlocking your plan only records “unlocked” in your budget. We don’t keep track of who received which code. The details, and the small limit that remains, are in Under the hood, section 7.
• The testers list: if we invited you, we keep a short list: your first name, the invitation date and how we reached you (for example your email). We do not write down which code you received. And codes are created in batches, not one at a time when someone is invited: their creation date doesn’t tell who received them.
• Why: to unlock testers’ plans and to know how many codes have been used; the list is used to invite you and ask for your feedback.
• It’s optional.
• How long: codes until the end of the early-access program, then we delete them; the testers list at most 3 months after the program ends. Your unlocked budget follows the rule in section 3.2.

4. What we never do

• Sell, rent or trade your information.
• Ads, tracking cookies, pixels, profiling, or analytics that follow you across sites.
• Store your name, email or IP address in the tool’s database.
• Keep your code or your budget’s key on our server.
• Use your budget for anything other than providing the service (for example, advertising or statistics about you).
• Make automated decisions about you. The tool does calculations for you, from your answers; the decisions are yours.

If we ever add audience measurement, it will be a cookieless tool that doesn’t follow you. We’ll update this policy before turning it on.

5. Your consent: what’s needed, what’s optional

• Needed to use the tool: your interview answers (otherwise there’s no budget to compute), the encrypted save on our server after the “Your income” section (it’s what lets you come back and share with your partner), and technical connection data.
• Optional: the emails you send us and using an access code.
• You can change your mind any time: “Delete my budget” erases everything, on your device and on our server. Simply stopping also works: a budget that isn’t unlocked deletes itself after 6 months.

We use your information only for the reasons explained here. For any other reason, we’d first ask for your express consent.

6. Who else handles your information

We work with very few providers. Each one gets only what it needs.

• Cloudflare acts on our behalf (as a service provider) to host and protect the tool. For a small part of the technical data (improving Turnstile, securing its network), Cloudflare acts on its own behalf.
• No other third party receives your information, unless the law requires it (for example, a court order). Since your budget stays encrypted, all we could hand over is unreadable content.

7. Where your information is (outside Quebec)

Your information is stored and processed outside Quebec:

• the database is hosted by Cloudflare in the “Eastern North America” region (probably in the United States), with no copies in other regions;
• pages and plan calculations are served by the Cloudflare data center closest to you (often in Canada for Canadian visitors, not guaranteed);
• Proton AG, our email provider, keeps the messages you send us (Switzerland).

Before communicating information outside Quebec, the law asks us to assess whether it will be adequately protected there. We made this assessment (approved on October 23, 2026). Our conclusion: protection is adequate, mainly because your budget is encrypted before it leaves your device and neither your code nor your key is kept at Cloudflare. One risk remains: another country’s laws (for example, the United States’) may let its authorities request data from a host. In that case, they would get encrypted data, unreadable without your code.

8. How we protect your information

Technical measures

• Your budget is encrypted in your browser (AES-256-GCM) with a key derived from your code, which is never kept on our server.
• Our server keeps only a fingerprint of your budget’s identifier: a stolen copy of the database couldn’t read, change or delete a budget.
• Encrypted connections only (HTTPS, enforced by your browser through HSTS), strict security headers, bot protection and request limits.
• No budget, key or request content in our logs.
• Daily automatic deletion of budgets that reach the end of their retention period.

Administrative measures

• One person has access to the systems: the founder, with two-factor authentication on the accounts.
• No copy of the database on a personal computer.
• A register of confidentiality incidents (section 11), and a review of this policy at least once a year or with every significant change.

Details are in Under the hood. No measure is perfect; we’d rather tell you exactly what we do, and its limits.

9. Cookies and browser storage

• No tracking cookies, no advertising cookies.
• Your browser’s local storage: the tool keeps your code and the encrypted copy of your budget there (section 3.4). If you pick a light or dark theme, it also keeps that choice: one word, “light” or “dark”, never sent, saying nothing about your budget. They aren’t cookies, but they work in a similar way: the data stays on your device until you clear it. To clear your code and budget: “Save and exit” (the theme choice stays: switch back to “Auto” to clear it). “Delete my budget” clears everything, theme choice included. To clear everything: your browser settings (“Clear site data”).
• Turnstile (bot protection) may use technical items strictly needed for that check. Cloudflare describes them in the Cloudflare Turnstile Privacy Addendum.
• Cloudflare, our host, sets no cookie on our site in normal operation. If an attack were under way, it could ask you for a bot check and set a temporary security cookie (for example “cf_clearance”), which isn’t used to follow you.

10. Your rights, and how to use them

The law gives you the right to access your information, have it corrected, have it deleted, withdraw your consent, get a copy in a usable format (portability), and file a complaint.

One important point: since we don’t know who you are, we can’t find your budget without your code. That’s by design. So most of your rights are exercised directly in the tool, with your code, without having to prove your identity to us:

Never send your code by email, even to us: we don’t need it to help you.

We answer every written request within 30 days, free of charge. If we must refuse a request, we explain why and how to challenge it.

Filing a complaint. If you’re not satisfied with our answer, or at any time:

• in Quebec: the Commission d’accès à l’information du Québec — cai.gouv.qc.ca;
• elsewhere in Canada: the Office of the Privacy Commissioner of Canada — priv.gc.ca.

11. If an incident happens

A “confidentiality incident” is, for example, unauthorized access to our systems or a loss of data.

• We act right away to limit the harm, and we record every incident in a register, even minor ones (kept 5 years).
• If an incident presents a risk of serious injury, we notify the Commission d’accès à l’information and the people affected. Since we don’t have your contact details, we’ll inform you through a clearly visible notice on the website and in the tool, and directly by email when we have your address (for example, if you wrote to us).

12. Young people

The tool is meant for adults managing their budget. It isn’t intended for children under 14. Since we collect no name or age, we can’t check this; if you’re a parent and think your child used the tool, “Delete my budget” erases everything.

13. Changes to this policy

• The effective date is at the top of this page.
• Since we don’t have your contact details, we announce any significant change on the website and in the tool, before it applies.
• If a change aims to use your information for a new purpose, we’ll ask for your consent before doing so. We’ll never reduce the protection of what’s already saved without your agreement.

14. Contact us

Person in charge of the protection of personal information: Yannick Beaudoin, founder of Coussinet

budget-tooling@proton.me

Under the hood (for the curious)

Like knowing how things work? So do we. Here is exactly what happens to your budget, with no marketing jargon.

1. Your code is your key

When you start a budget, your browser generates a random 20-character code, for example K7QM-2XPA-9FDE-H3WT-B6NR. The randomness comes from crypto.getRandomValues, your browser’s cryptographic generator. We don’t choose it and we don’t see it when it’s created.

Each character is worth 5 bits (we use the Crockford base32 alphabet, which drops letters that are easy to mistake for digits: I, L, O and U. If you type an I or an O by mistake, we read it as a 1 or a 0). That makes about 100 bits of randomness, roughly 1.3 × 10³⁰ possible codes.

That’s also why we don’t let you pick your own code: a password invented by a human, even a good one, contains far less randomness.

2. One code, two keys that never talk to each other

From your code, your browser computes two values with HKDF-SHA-256 (a standard derivation function, RFC 5869), each with a different label:

• label “lookup”: gives an identifier, sent to the server, which keeps only a fingerprint of it;
• label “key”: gives the encryption key, which stays in your browser (except to compute an unlocked plan, see section 5).

These calculations are one-way: from the identifier, it’s impossible to get back to your code or your key.

And our server doesn’t even keep the identifier: only its fingerprint (SHA-256), also one-way. When your browser sends the identifier, the server recomputes the fingerprint to find your budget. Result: someone with a copy of our database could not read, change or delete a budget.

3. Encrypted before it even leaves

Your budget is encrypted in your browser with AES-256-GCM (through the Web Crypto API built into your browser) before it’s sent. Each save uses a new random initialization vector, and GCM mode checks integrity: if someone altered the encrypted data, decryption would fail instead of producing a tampered budget.

Our database holds only:

• the fingerprint of the identifier (neither the code nor the identifier itself);
• your encrypted budget (unreadable without the key);
• whether the plan is unlocked;
• the version of your budget’s format (so it can be upgraded some day);
• a few dates (created, last changed, last opened) for saving and automatic deletion.

No name, no email, no IP address. (Like any web host, Cloudflare sees your IP address when your browser connects: it’s needed to answer you and to block bots. We don’t store it in our database, and our technical logs don’t record request details. Cloudflare also processes some technical data for its own security needs, and keeps a sample of requests (IP address included) for up to 31 days, which its dashboard shows us so we can spot attacks.)

On your device: your browser also keeps an encrypted copy of your budget and your code (in its local storage), so nothing is lost if you close the tab and you can pick up without retyping anything. A consequence worth knowing: someone using the same browser could reopen your budget, like a tab left open. On a shared device, use “Save and exit” when you’re done: this device’s copy is erased once your budget is up to date on our server, and your code will be needed to reopen it. “Delete my budget” erases everything, here and on our server. If you pick a light or dark theme, your browser also remembers that choice (one word: “light” or “dark”). It says nothing about your budget and is never sent. It stays after “Save and exit” (switch back to “Auto” to clear it); “Delete my budget” clears it too.

Try it yourself: open your browser’s developer tools (F12), Network tab, and change an answer. In the save request you’ll see encrypted text and the identifier (in a header), never your numbers or your code.

4. “What if someone stole the database?”

They’d have fingerprints and encrypted data, but no code, no identifier and no key. They couldn’t even replace or delete a budget. To read a budget, they’d have to guess a code. Even with a million budgets in the database and a farm of graphics cards trying a trillion codes per second, it would take them on average about 38,000 years to find just one.

(The math: 2¹⁰⁰ codes ÷ 2²⁰ budgets ≈ 2⁸⁰ attempts, about 1.2 × 10²⁴; at 10¹² attempts per second, that’s about 1.2 × 10¹² seconds.)

5. The only moment your budget is decrypted

To compute your “autopilot” plan (transfers, weekly amount, to-do list…), our server needs to read your budget. Here is how it works, only if your plan is unlocked:

1. your browser sends the identifier and the key to the server over an encrypted connection (HTTPS);
2. the server first checks that the plan is unlocked. If not, it stops there, without even using the key. If it is, it decrypts the budget already saved on our server, in memory, computes the plan and sends it back;
3. the key and the readable budget are forgotten right away. Nothing is kept unencrypted, and none of it is written to our logs. This calculation writes nothing to our database, and the plan itself isn’t stored on our server: it’s only sent back to you.

Why not compute everything in your browser? Because the plan is the paid part of the tool: if it were computed in your browser, anyone could unlock it without paying.

We’d rather be honest about the limit: during that brief moment, your budget passes through our server. Encryption protects your stored data (database leak, stolen backup); on its own it can’t protect against a server that was modified to misbehave. That’s why we’ll never tell you “even we can’t read it”. We tell you instead: we never keep it unencrypted.

6. The share link

When you copy your budget’s link, the code is placed after the # in the address. Your browser never sends that part of the address to the server: it stays on your device. As soon as the page opens, we remove it from the address bar, and we ask you to confirm before opening the budget.

Careful: this link is a real key. Anyone who has it can open, change and delete your budget. It may also stay in your browser history and in the app where you send it (email, messaging). Share it only with the person you’re doing your budget with.

Bookmarking your budget (only if you ask). The “Create a link to bookmark” button first explains the risks; only if you confirm do we place your code after the # in the address bar, just long enough for you to add it to your bookmarks. As soon as you close the message, we remove it from the address bar. That bookmark is also a real key: anyone with access to your bookmarks or your history (and to their sync on your other devices) can open your budget. Even after it’s removed from the address bar, the link stays in your browser history (and in its suggestions when you type an address): clear it from your history if other people use this device. By default, your code is never in the address bar.

Section addresses. Each step has its own address (for example /en/budget/income), so the Back button, page refresh and section bookmarks work. These addresses contain only the step name: never your code, a nickname or an amount. One nuance: the sharing step exists only for couples, so its address shows that it’s a two-person budget. (The children step shares the address of a neighbouring step, so it reveals nothing.) The “Copy link” button always gives the entry address (/en/budget/#…), never a step’s address.

7. Access codes (early testers)

Before payments open, we give access codes to a few early testers. A code unlocks a budget’s plan for free. Here’s what we keep, and what we don’t:

• for each code: a fingerprint of the code (impossible to reverse without a secret key that isn’t in the database), the day it was created, its expiry date if it has one, how many times it can be used and how many times it has been used;
• not the date it was used, and never which budget used it: unlocking your plan only records “unlocked” in your budget, just as a payment would;
• the code itself is never stored unencrypted, neither in the database nor in our logs;
• we don’t keep track of who received which code, and codes are created in batches, not one at a time when someone is invited: their creation date doesn’t tell who received them;
• a budget that’s already unlocked doesn’t use up a code: the code stays available.

To be precise: as long as payments aren’t open, an unlocked budget was necessarily unlocked with a code. And Cloudflare automatically keeps restore copies of the database for a few days (7 days on our current plan). By comparing two copies, one could see that a code was used around the time an encrypted budget was unlocked, without ever being able to read that budget. One more detail: unlocking your plan doesn’t change your budget’s last-change date. But a change saved right after, even one box ticked in “To do this weekend”, puts that date very close to the moment the code was used. Someone who had the database and knew when a code was used could therefore link the two more closely in time, still without being able to read your budget. When the early-tester program ends, we delete all codes from the database.

8. Bot protection

To stop a bot from creating thousands of fake budgets or trying access codes at random, we use Cloudflare Turnstile, a check that usually needs no puzzle, and we limit the number of requests per minute. For those limits, your IP address is only a counter, in the moment: it’s never stored. Turnstile runs in your browser and looks at technical signals (including your IP address) to recognize bots; our server doesn’t pass your IP address to it on top of that. Cloudflare describes this processing in its Cloudflare Turnstile Privacy Addendum. Turnstile also sees the address of the page it runs on, so the step name (for example /en/budget/split/), but never your code: we always remove the code from the address bar before Turnstile runs.

9. How long we keep your budget

• Budget not unlocked: deleted automatically if it hasn’t been opened or changed for 6 months. Opening it resets the clock. (For last opened, we record only the day, never the time, except on the creation day, where it equals the creation date. The creation and last-change dates are precise: they’re used to sync your devices.)
• Unlocked budget (with an access code or, later, by a payment): kept for as long as the service exists. If the service ever shut down, we commit to telling you at least 6 months in advance, with a way to export your budget.

10. Where your data is

The site and the database are hosted at Cloudflare (Workers and D1), which also runs our domain name, coussinet.ca (DNS). Database: ENAM region (eastern North America, the closest to Quebec), replication off. This data is therefore hosted outside Quebec; we made the privacy impact assessment required by Law 25 (conclusion: adequate protection, mainly thanks to encryption).

If you lose your code

We can’t recover it for you. It’s not ill will: we never had it. It’s the flip side of anonymity. Keep it in your password manager or email it to yourself.