Privacy Policy

Just the Next · Last updated 8 October 2026

Just the Next is run by Bluefox Software, a sole proprietorship in British Columbia, Canada ("we", "us"). This policy explains what personal information Just the Next collects, why, who else handles it, how long we keep it and what you can ask of us. Questions go to privacy@bluefox.software.

What we collect

• Your account: your email address, your password and, if you give one, your name. The password is stored only as a one-way hash; nobody, including us, can read it.
• Your sessions: when you sign in, the IP address and the browser or device description (user agent) of that session. A session ends when you sign out, when you reset your password, after 30 days without use, or when you delete your account. The record of an ended session is kept until you delete your account.
• What you put in Just the Next: your lists, the items in them and when you finish them, and where you are in each list.
• On your device: a copy of your lists, so Just the Next works without a connection, kept in your browser's local storage or in the iOS app's storage. It is removed from the device when you sign out or delete your account, with one exception: changes you made offline that have not reached us yet stay on the device after you sign out, so they are not lost, and are sent when you next sign in there.
• Technical records: for each request to our servers, the page or address asked for, the time, the result, your IP address and your user agent, and the IP address a limit on repeated requests applies to. We use these only to run, secure and fix the service.
• Assistants you connect: if you let an AI assistant use Just the Next for you, a record of that assistant and what you allowed it to do, until you revoke it, reset your password or delete your account. What the assistant reads (your name, your email address and the content its tools reach) goes to that assistant's provider, under its own terms.

What we do not do

No analytics, no advertising, no tracking pixels, and we never sell your information or share it for advertising. The website uses one cookie, the session cookie that keeps you signed in, and keeps your account's id in your browser's local storage; the home page and this page use neither. The iOS app keeps your session in the device's Keychain.

Why we use it

• To provide the service you signed up for (performing our agreement with you).
• To keep it secure and working, and to stop abuse (our legitimate interests).
• To send the only two emails the service sends: a password reset link you ask for, and the confirmation that your account was deleted. We send no marketing.
• To meet our legal obligations.

Who else handles it

We use these service providers, under contracts that limit them to processing on our behalf:

• OVHcloud: our servers and database, in Beauharnois, Quebec, Canada.
• Resend, a United States company: delivers our emails, so it receives your email address and the message.
• Cloudflare: its R2 storage holds our database backups and technical records.
• Google: the home page loads its fonts from Google Fonts, so your browser sends Google your IP address and browser details when you open it. The app and these pages load nothing from Google.

Some of these providers process information outside Canada, including in the United States, where it may be subject to that country's laws.

How long we keep it

• Your account and content: until you delete them, or your account.
• Technical records: about 30 days.
• Database backups: about 14 days.

When you delete your account, it is removed from our live database at once. It survives only in backups and technical records until those expire as above. Automatic rules in our storage remove any backup or technical record a failure leaves behind: backups within 90 days, technical records within 120.

Your rights

You can ask to see, correct, export or delete your personal information, and to withdraw a consent you gave. You can delete your account yourself, at any time, in the app: Lists → Account → Delete account. For anything else, write to privacy@bluefox.software; we answer within 30 days.

If you are not satisfied with our answer, you can complain to the Office of the Information and Privacy Commissioner for British Columbia, the Office of the Privacy Commissioner of Canada, or, in the European Union or the United Kingdom, your local data protection authority.

Security

Information travels encrypted (HTTPS), passwords are hashed, and access to our systems is limited to what running the service needs. No system is perfectly secure; if a breach puts you at risk, we will tell you and the authorities as the law requires.

Children

Just the Next is not intended for children under 16, and we do not knowingly collect their information.

Changes

We will post any change here with a new date. If a change matters to how we use your information, we will also tell you by email before it takes effect.