Privacy Policy

JustConvert Effective Date: May 20, 2026 Last Updated: September 24, 2026 Version: 4.0

---

1. Introduction

AmaliLabs L.L.C-FZ ("we," "us," or "our"), incorporated in the UAE, operates JustConvert ("the App"), a native iPhone application available on the Apple App Store, with support and legal pages hosted at www.getjustconvert.com.

This Privacy Policy explains how we collect, use, store, and protect information when you use JustConvert. We are committed to protecting your privacy and being transparent about our data practices.

The short version: Your conversion content stays on your device. JustConvert has no ads, no first-party account, and no advertising profile. We use limited product and purchase analytics to improve the service, and never sell your personal information. The App provides a product-analytics switch; the website honors browser privacy signals. These controls and their limits are explained below.

This policy covers the public website, promotions run on it (such as the Emirates Lifetime campaign in Section 2.7), and the v2.1.0 release, including recognition of existing Apple purchases during onboarding. Older installed versions may continue using the legacy analytics described below until updated.

---

2. Information We Collect

2.1 Information Stored on Your Device (Local Only)

The following data is stored exclusively on your device and is never transmitted to our servers:

This data never leaves your device. It is stored in the app's local storage (UserDefaults) and is removed when you uninstall JustConvert.

Calculator expressions and live results are processed in memory on the device while the calculator is open. They are not stored in conversion history, analytics, or server-side storage.

2.2 Pseudonymous App Analytics Data

When Share product analytics is enabled, the App sends limited, explicitly selected usage events to PostHog EU. The preference is on by default and can be turned off in the App's secondary layer. We do not use automatic interaction capture, session replay, screen recordings, person profiles, advertising identifiers, or location enrichment for this analytics integration.

What we collect:

These identifiers are not a JustConvert account and are not linked by the App to your name, email address, Apple ID, or conversion history. Pseudonymous data can still be personal data. A separate purchase lifecycle integration can associate purchase events with a pseudonymous customer/install identifier, as explained in Section 2.3.

What App-generated analytics do NOT include:

• Your name, email address, phone number, Apple ID, or account credentials
• Entered conversion amounts, calculator expressions, output values, or conversion history
• Exact selected currencies, unit pairs, cities, time zones, favorites, or search text
• Precise location, GPS data, or advertising identifiers such as IDFA
• Payment-card details, localized price strings, or raw error descriptions

We do not intentionally retain IP addresses in product-analytics events or use them for location enrichment. Infrastructure providers nevertheless process network addresses to receive and secure requests. Purchase currency and revenue are separate from conversion amounts and may appear in purchase lifecycle analytics.

Legacy versions: Older app versions used randomly generated user/session identifiers and Supabase events with broader metadata, including screen/device information, product price/currency, and error codes. Historical app/web and redirect events remain in legacy storage pending retention review. The 12-month PostHog retention period does not apply to those records.

2.3 Subscription and Purchase Data

JustConvert is a paid app. Purchases are processed through Apple's App Store and managed via RevenueCat.

We do not collect, see, or store your payment card details, billing address, or Apple ID. All payment processing is handled by Apple. RevenueCat may associate purchase and entitlement records with its SDK-generated customer identity and Apple's transaction state. The App does not send conversion history, expressions, numeric conversion values, or other user-entered conversion content to RevenueCat.

In v2.1.0, automatic synchronization uses the existing Apple/RevenueCat purchase systems; the App does not collect an externally redeemed offer code or campaign claim. Synchronization does not itself grant access: RevenueCat must report an active entitlement. Manual Restore remains available if automatic recognition is unsuccessful.

RevenueCat sends purchase lifecycle events separately from App-generated analytics. A strict PostHog transformation retains only selected properties and removes unallowlisted customer aliases, transaction identifiers, subscriber attributes, and other fields before event storage. This limits retained data, not RevenueCat's original delivery payload. Turning off Share product analytics stops App-generated events but does not stop this server-side integration or necessary purchase/entitlement processing. Contact us to exercise applicable rights concerning those records.

2.4 Local Notification

The active JustConvert subscription flow does not request local notification permission and does not schedule billing reminders. On initialization, the App removes the legacy trial_reminder_day5 pending request from upgraded installations; no notification content is sent to our servers.

2.5 Public-site and campaign analytics

The public landing, Terms, and Privacy pages use PostHog EU in always-cookieless, personless mode. Selected events record a normalized page route, viewed landing section, App Store CTA placement, FAQ item ID, allowed campaign parameters, and referrer domain. We do not create persistent browser analytics IDs or analytics cookies, record session replay, or build visitor profiles. PostHog's cookieless processing uses a rotating daily hash rather than a persistent cross-day identity. Receiving requests still involves network information.

The website suppresses product analytics when your browser sends Global Privacy Control or Do Not Track, and honors an existing local analytics_opt_out setting. It no longer uses browser Supabase analytics or Vercel Analytics. The new integration attempts to remove obsolete browser identifiers where storage is accessible and does not use them; any remaining identifiers can be removed by clearing browser storage.

App and campaign links resolve through static Vercel redirects or iOS Universal Links. The retired go.justconvert.amalilabs.com slug system no longer performs Supabase campaign lookups or records JustConvert scan/link-preview events. Vercel still processes ordinary redirect requests, and Apple may process campaign attribution tags at the App Store destination. Historical redirect events included campaign slug/token, country header, user agent, and bot/link-preview classification; those legacy records are covered by Section 6.

2.6 Support and Legal Correspondence

If you email us, we receive your email address, message, and any information you choose to provide. Google Workspace processes this correspondence for us. We use it to answer requests and administer support, legal, and privacy matters, not to create an App account or advertising profile. Please do not send payment-card details, passwords, or unnecessary sensitive information.

2.7 Promotions and Eligibility Verification

From time to time we may offer free access to a defined group, for example people with a particular employer's work email address. For these promotions we collect only what we need to check eligibility once, deliver the benefit, and stop the same address from claiming twice. We do not use promotion data for marketing, advertising, or any unrelated purpose, and we do not share it with the group's employer.

Emirates Lifetime campaign. On www.getjustconvert.com/emirates, people with an @emirates.com work mailbox can claim one free JustConvert Lifetime code. The campaign rules are in Annex A of our Terms of Service. JustConvert and this campaign are not affiliated with Emirates.

We do not ask for your name, staff number, employee ID, or any document. Verification happens only through the code sent to your mailbox. The page keeps a random session token and your masked email in the browser's navigation history state so the verification page works; it sets no cookies and writes nothing to localStorage or sessionStorage. Your browser may keep this state across a reload or when it restores a session.

Redeeming the code happens in Apple's App Store under your Apple Account. We do not receive your Apple ID. The App recognizes the resulting Lifetime purchase through RevenueCat as described in Section 2.3; no campaign data reaches the App.

If you ask us to delete your campaign data before the retention period ends, we delete your email address. The same address could then request a code again while the campaign is open.

---

3. How We Use Your Information

We use the information we collect to:

1. Provide the service - deliver currency, unit, and time conversions
2. Improve the App - understand which features are used and how
3. Monitor performance - identify and fix technical issues
4. Plan features - make informed decisions about future development
5. Manage paid access - verify purchases, recognize existing entitlements, and understand purchase lifecycle and revenue
6. Respond to correspondence - provide support and handle legal and privacy requests
7. Run promotions - verify eligibility, deliver promotional codes, and prevent duplicate or abusive claims (Section 2.7)

We do not use your information for:

• Targeted advertising
• Selling to third parties
• Creating advertising profiles or making solely automated decisions with legal or similarly significant effects on you

Provider service-improvement and derived-data practices are addressed in Section 5.6. Pseudonymous product analytics is not a promise of "no tracking" or complete anonymity.

---

4. Legal Basis for Processing (GDPR)

For users in the European Union and European Economic Area, we process data under the following legal bases. Under UAE law, promotion processing relies on the same grounds: it is necessary to provide what you requested, and to protect the promotion against misuse.

You have the right to object to processing based on legitimate interests. Where applicable law requires consent for analytics or device storage/access, legitimate interests do not replace that requirement. A cookieless design, privacy signal, or opt-out switch does not itself establish a consent exemption. This policy does not claim that a consent or parental-consent flow exists. See Section 8 for your controls and rights.

---

5. Third-Party Services

JustConvert uses the following third-party services:

5.1 Apple App Store / StoreKit

• Purpose: App distribution, purchases, subscription management, plan changes, renewal-intent reads, restores, purchase synchronization, App Store campaign attribution, and redemption of promotional offer codes
• Data shared: Standard App Store and StoreKit purchase, subscription, storefront, and renewal information; payment details are handled entirely by Apple
• Privacy Policy: apple.com/legal/privacy

5.2 RevenueCat

• Purpose: Purchase offerings, entitlement state, purchase/restore/synchronization handling, and purchase lifecycle analytics delivery
• Data shared: Pseudonymous customer, transaction, product, and entitlement information associated with Apple purchase state, which may be personal data. Selected lifecycle analytics are delivered to PostHog as described in Section 2.3. No conversion history or user-entered conversion values are supplied by the App.
• Privacy Policy: revenuecat.com/privacy

5.3 Supabase

• Purpose: Exchange-rate storage, retention of legacy analytics, and processing of promotion claims
• Data shared: Currency-rate read requests and legacy analytics from older supported app versions. Historical web/redirect events remain; the former campaign-redirect table and function have been retired. New App/web product analytics use PostHog, not Supabase. For promotions, Supabase stores the claim data described in Section 2.7 in tables that browsers cannot read, and runs the server functions that verify eligibility and deliver codes.
• Storage: EU (Frankfurt, Germany)
• Privacy Policy: supabase.com/privacy

5.4 open.er-api.com

• Purpose: Upstream exchange rate source
• Data shared: No user data. Rates are fetched server-to-server by a Supabase Edge Function, not by the App directly.
• Privacy Policy: exchangerate-api.com/privacy

5.5 Vercel

• Purpose: Hosts the public landing, support, legal, and promotion pages and resolves static app/campaign redirects
• Data shared: Ordinary web request information, including IP address, requested URL, and browser information. The separate Vercel Analytics browser integration is no longer used.
• Privacy Policy: vercel.com/legal/privacy-policy

5.6 PostHog EU

• Purpose: Limited app, website, and purchase lifecycle analytics
• Data shared: The selected events, pseudonymous identifiers, and lifecycle information described in Sections 2.2, 2.3, and 2.5; network information necessary to receive requests
• Storage: Our selected PostHog Cloud region is EU (Frankfurt, Germany). Raw retained events have a 12-month retention period.
• Privacy Policy: posthog.com/privacy

PostHog's published policy permits aggregated or de-identified derived data for its internal product and model development, unless restricted by the applicable agreement or a customer opt-out. Such derived data may have different retention from raw events. We do not claim this provider use is disabled without verification of the applicable agreement and project setting. This is separate from an AI feature in JustConvert; we do not send conversion content to an AI service.

5.7 Google Workspace

• Purpose: Receive and manage support, legal, and privacy correspondence
• Data shared: Sender addresses, email contents, and information voluntarily submitted to our public contact addresses
• Privacy information: Google Workspace data protection

5.8 Resend

• Purpose: Sends promotion emails: the verification code and the promotional code
• Data shared: Your work email address and the content of those two emails, including the verification code or the promotional code and its redemption link
• Storage: EU sending region
• Privacy Policy: resend.com/legal/privacy-policy

We do not integrate advertising networks, social media trackers, or any data brokers.

---

6. Data Retention

---

7. Data Security

We implement the following security measures to protect your data:

• HTTPS encryption for all data transmitted between your device and our servers
• Row Level Security (RLS) on our Supabase database, restricting data access; promotion tables have no browser access at all and are reachable only by our server functions
• Keyed hashing of promotion verification codes, session tokens, and network addresses, so the stored values cannot be read back; verification codes expire after 5 minutes or 5 wrong attempts, and requests are rate-limited
• Pseudonymous IDs - no name, email address, Apple ID, IDFA, or other direct identifier is intentionally included in the App analytics payload
• Minimal data collection - we only collect what is necessary to operate and improve the App
• No accounts or passwords - JustConvert requires no registration, eliminating credential security risks
• On-device storage - the majority of your data never leaves your iPhone

While we implement reasonable security measures, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

---

8. Your Rights

Depending on your location, you may have the following rights regarding your data:

8.1 Rights for All Users

• Delete local data: Uninstall JustConvert to remove all locally stored data from your device
• Turn off App analytics: Disable Share product analytics in the App's secondary layer. This clears pending events and stops future App-generated capture without changing paid access, converters, or onboarding. It does not delete previously received events or disable separate RevenueCat lifecycle analytics or necessary provider processing.
• Control website analytics: Enable Global Privacy Control or Do Not Track in your browser. The website also honors an existing analytics_opt_out setting and does not create a persistent analytics identity.
• Request server-data actions: Contact us to object to analytics processing or request applicable access/deletion actions. Uninstalling the App does not delete provider-held records.

8.2 GDPR Rights (EU/EEA Users)

If you are located in the EU or EEA, you have the right to:

• Access: Request a copy of personal data we hold about you
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your data ("right to be forgotten")
• Restriction: Request that we restrict processing of your data
• Portability: Receive your data in a portable format
• Object: Object to processing based on legitimate interest
• Withdraw consent: Where processing is based on consent

How to exercise your rights: Contact us at legal@getjustconvert.com. We will respond without undue delay and within one month. Where legally permitted because of complexity or the number of requests, we may extend by up to two further months and will explain the extension within the first month.

Because analytics records use pseudonymous identifiers rather than a named account, we may need additional information that safely enables us to locate your records. We do not require you to create an account or send unnecessary sensitive information. If we cannot reasonably identify relevant records, we will explain the limitation and available actions. This does not limit rights where you provide information that enables identification. Objections to legitimate-interest processing are handled under applicable law.

You also have the right to lodge a complaint with your local data protection authority. For EU users, you can find your authority at edpb.europa.eu.

8.3 CCPA/CPRA Rights (California Users)

California residents have the right to:

• Know what personal information we collect, use, and disclose
• Delete personal information we have collected
• Correct inaccurate personal information
• Opt-out of the sale or sharing of personal information for cross-contextual behavioral advertising
• Limit the use and disclosure of sensitive personal information where applicable

We do not sell or share your personal information for cross-contextual behavioral advertising.

To exercise your rights, contact us at legal@getjustconvert.com. We will respond within 45 days and will not discriminate against you for exercising these rights. You may use an authorized agent where permitted by applicable law.

8.4 UAE Users

Under UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL), you have rights to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Object to processing in certain circumstances

Contact us at legal@getjustconvert.com to exercise these rights, including for promotion data (Section 2.7).

---

9. Children's Privacy

The App has no age gate or age-verification flow. It has no social features, user-generated content, chat, advertising, or mature content.

JustConvert is designed for travelers and expats, not as a child-directed service. It does not provide verified parental consent or parent-managed accounts. Default-on product analytics does not distinguish children from adults; absence of a name or account does not establish that no child's personal data is processed. We do not use data for targeted advertising or advertising profiles. Applicable child-data protections and consent requirements are not waived by these design choices.

If you are a parent or guardian and believe we hold personal data about your child, contact us at legal@getjustconvert.com so we can investigate and take applicable protective or deletion action. You may also disable App analytics using the control in Section 8.1.

---

10. International Data Transfers

JustConvert is operated from the UAE. Our selected PostHog Cloud EU storage region is Frankfurt, Germany, but EU storage does not mean all processing stays in the EU: operator access from the UAE and provider support/subprocessor access can involve other countries. Our Supabase project is hosted in the EU (Frankfurt, Germany), and promotion emails are sent through Resend's EU region. Apple, RevenueCat, Supabase, Resend, Vercel, and Google Workspace may also process data internationally under their applicable arrangements, for example for provider support or subprocessors.

Where transfer restrictions apply, an applicable lawful transfer mechanism is required, such as an adequacy decision or contractual safeguards including Standard Contractual Clauses. PostHog describes its available contractual safeguards in its Data Processing Agreement. A provider's published template does not establish that our agreement has been executed. Pseudonymization reduces exposure but is not itself a lawful transfer mechanism. Contact us for information about applicable safeguards and available copies.

---

11. On-Device Storage

JustConvert stores app preferences, conversion history, cached exchange rates, and other local state in iOS UserDefaults on your device. This data:

• Never leaves your device
• Is not accessible to us or any third party
• Is removed when you uninstall the App

The App does not use browser cookies for iOS conversion state. Separately, the PostHog SDK stores its random installation identifier and pending analytics queue on the device; those analytics events can be transmitted when enabled. Purchase SDKs also maintain their necessary local caches.

The public website does not create analytics cookies or persistent analytics IDs in localStorage or sessionStorage. Promotion pages keep a random session token and a masked email address only in the browser's navigation history state, as described in Section 2.7. It may read the existing local opt-out preference and attempts to remove obsolete analytics IDs. Any remaining unused identifiers from the former integration can be removed by clearing browser storage. We do not use advertising cookies or cross-site behavioral advertising.

---

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last Updated" date at the top of this policy
• Make the updated policy available at www.getjustconvert.com/privacy

We encourage you to review this policy periodically. This policy informs you about processing; continued use is not treated as consent where applicable law requires specific consent. Material changes do not override your statutory rights.

---

13. Contact Information

For any privacy question, request, or concern, or to exercise your rights, contact us at:

• AmaliLabs L.L.C-FZ
• Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E.
• General inquiries: hello@getjustconvert.com
• Legal and privacy inquiries: legal@getjustconvert.com

We aim to respond to all privacy-related inquiries within 30 days.

If you are in the UAE, you may also contact the UAE Data Office, the federal supervisory authority for personal data protection. If you are in the EEA or the UK, you may lodge a complaint with your local data protection supervisory authority.

See also our Terms of Service.

---

This Privacy Policy was last updated on September 24, 2026.