Privacy

Everything you log stays on your device. Your food, supplements, strength sessions, location and your name. If you turn on syncing, a copy also travels between your devices, locked so nobody else can read it. Just Enough has no accounts and no user database. If you clear your browser data and haven’t saved a copy or set up syncing, your data on Just Enough is lost, and cannot be recovered.

What is stored, and where

The app keeps a single record in your browser’s local storage on the device you’re using. It contains:

• Your first name, if you gave one
• Your age band, and which set of published figures applies to you
• The supplements and food you add
• Strength sessions and time outdoors
• The location you chose for the UV calculation, as latitude and longitude
• Whether you’ve unlocked the app, and your license key if you have one
• If syncing is on, an unreadable copy of that record is stored on Cloudflare’s network, under a code we cannot reverse

Syncing devices

By default, each device keeps its own record independent of your other devices. We recommend syncing your devices:

On your first device — open Set up, then Save your log, and choose Sync your devices. You’ll be given a code. Write it down.

On your second device — go to the same place, choose Already have a code, and type it in. The two records become one. Turn it off at any time and that device goes back to keeping its own record.

How syncing devices work

Your device creates a sync code and scrambles your log with it before sending anything. The code never leaves your device. To connect with a second device, type the same code into it. That’s what makes the text readable again.

Save your sync code like you would a password. It isn’t a one-time setup code; it unlocks your data every time, on every device. You’ll need it again if you get a new phone. If you lose it, there’s no way to restore it.

What does leave your device

Where you are, for the UV reading

The sun’s angle is calculated using your latitude, date and time. Your coordinates aren’t shared, and the calculation works without an internet connection.

Currency conversion

If you’re outside the United States, the app asks an exchange-rate service, ExchangeRate-API, for today’s rates so it can show the price in your own currency. As with any internet request, that service may receive your IP address and basic technical information. The rates are then cached on your device for a day.

Checking your license

When you unlock the app, your license key is sent to Lemon Squeezy to confirm it’s valid, and re-checked occasionally afterwards. The key is the only thing we deliberately send. As with any internet request, Lemon Squeezy may also receive technical information such as your IP address.

Payment

We never see your card. Lemon Squeezy is the merchant of record. They take the payment, handle the tax, and hold whatever billing details you give them under their own privacy policy. Just Enough receives a record of the sale and the email address you used, to send your license key and support you if something goes wrong.

Email

If you share your email address, Just Enough may use it to help with your license key and receipts if you ask for them, and to send occasional emails about bone health if you opt in. You can opt out at any time. Just Enough doesn’t sell, rent or share your address.

Where your email is stored depends on why you gave it. Lemon Squeezy holds purchase and receipt addresses as part of the sale. If you subscribe to the bone health newsletter, your address is stored by MailerLite on our behalf, on servers in the European Union. Subscribing uses double opt-in: you confirm by clicking a link in an email. Every newsletter carries an unsubscribe link.

Links in the newsletter are routed through MailerLite, so we can see which articles people click. Each email also contains a small invisible image that reports when it is opened. Both are recorded against your subscription. Neither changes what you receive, and unsubscribing ends both.

Analytics

This site and the app both use Cloudflare Web Analytics. It is designed to provide aggregate website statistics without cookies and without creating individual user profiles. What it records is the page, roughly where in the world the request came from, and basic technical details such as browser and screen size.

Nothing you log inside the app is included. Cloudflare sees that a page was opened, not what you put into it.

Who is responsible for this

Just Enough is operated by G&G Advocacy (Pty) Ltd, a global specialist medical eLearning service provider. G&G Advocacy is the responsible party under POPIA, and the data controller for the purposes of GDPR. The Information Officer can be reached at [email protected].

Why we process your information

We collect and use personal information for the following reasons only:

• Running the app — showing your intake against the published figures
• Syncing your devices — if you switch it on
• Subscriptions — taking payment and issuing your licence key
• Checking a licence is valid — when you unlock the app
• Support — answering you when you write to us
• The newsletter — if you subscribe
• Aggregate statistics — about how the site is used

What information is essential and what’s optional

• You don’t need anything to try the app. No account, no card, no email.
• Your age and sex are needed for the app to show the right figures, and they stay on your device.
• An email address is needed to buy a subscription, and when you want to receive the newsletter.
• A location is optional and used only for the UV reading.
• The newsletter is entirely optional and never a condition of buying anything.

Who else handles your information

Some companies process information on our behalf as operators; others are independent providers with their own relationship with you.

• Lemon Squeezy — merchant of record, legally the seller. They hold your billing details under their own terms.
• MailerLite — stores newsletter addresses on our behalf, and records which links were clicked and when an email was opened.
• Cloudflare — hosts this site and the app, and stores the encrypted sync copy.
• ExchangeRate-API — supplies currency rates.

Where information is processed

Some of the companies that provide services to Just Enough operate from around the world, which means limited personal information may be processed in other countries. MailerLite stores newsletter addresses in the European Union. Cloudflare operates a global network. Lemon Squeezy is based in the United States. Where POPIA applies to a transfer of personal information, we take steps to ensure the transfer meets the requirements of section 72 of POPIA.

How long we keep information

• What you log — your logs remain on your device, and you can delete them at any time.
• The encrypted sync copy — until you stop syncing. It is unreadable to us either way.
• Purchase and tax records — for as long as tax and company law require us to keep them, which is longer than we would otherwise choose.
• Support emails — stored while the question is open, and for a reasonable period afterwards in case you write again.
• Newsletter addresses — stored until unsubscribed.

Information about your health

Food, supplements, strength sessions, time outdoors and your age band can together say something about your health and your habits. POPIA gives that kind of information extra protection, and we treat it on that basis.

This is the reason the app is built the way it is: the record stays on your device, the sync copy is encrypted with a key we do not hold, and there is no central profile of you anywhere.

If something goes wrong

If personal information under our control is ever compromised, you will be notified as soon as possible, and so will the Information Regulator, as POPIA requires. The encrypted sync copy is the only exception.

Your rights

Under POPIA, GDPR and similar laws you can:

• Ask for a copy of the personal information we hold about you
• Ask for it to be corrected if it is wrong
• Ask for your personal information to be deleted
• Object to certain processing
• Withdraw consent where our processing depends on it
• Unsubscribe from the newsletter at any time
• Complain to the Information Regulator

The personal information we can access in readable form is limited mainly to information connected with purchases, email subscriptions and support. If you use device syncing, an encrypted copy of your app record is also stored on Cloudflare’s network on our behalf, but only you have the key needed to read it.

Email [email protected] and expect a reply within one working day.

Communicating with the Information Regulator

If you are not satisfied with how your information is handled, contact the Information Regulator.

Access to information

G&G Advocacy (Pty) Ltd maintains a manual under the Promotion of Access to Information Act. Ask at the address below and we will send it to you.

Children

Just Enough is built for adults over 40 and the intake figures it uses are the adult ones. It is not intended for under-18s and we don’t knowingly collect anything from them.

Changes

If this policy changes in a way that affects you, the date at the top changes.

Getting in touch

Email [email protected].