Cookies and device storage

1. Current website use

The website uses storage for requested functions and security: selected appearance, waitlist completion and private dashboard access. Referral codes are used only when provided in a referral link. It does not currently load external advertising pixels, session replay or a visitor analytics service. Local interface events are not currently transmitted to an analytics provider. There is no optional website tracking to accept, so no Accept all cookies banner is shown. This must be reassessed before adding optional trackers.

2. Website inventory and duration

debtly_waitlist_session: first-party HTTP-only cookie authenticating the private waitlist/referral dashboard. New-signup sessions last up to 24 hours; sessions from emailed management links last up to 30 days. SameSite=Lax and Secure in production. Set for the requested dashboard function, not an ordinary anonymous page view.

debtly-theme: first-party localStorage for selected light/dark appearance; persists until changed or cleared. Without it, system preference applies.

debtly-waitlist-joined: first-party sessionStorage remembering completed signup for the current browser-tab session.

Supabase authentication, typically sb-<project>-auth-token: browser storage when login or password recovery establishes a session; retained until sign-out, session removal or browser cleanup.

3. Security services

Where configured, Cloudflare Turnstile loads an anti-bot check and can process browser/device/network signals; it is not used as an advertising tool. See the Cloudflare Turnstile Privacy Addendum. Hosting can process logs and use necessary delivery/security mechanisms under the deployed configuration. This does not authorize optional marketing reuse.

4. Web and mobile app storage

The app retains authentication, language/theme/currency preferences, onboarding state, cached records and pending synchronization. Examples include @i18n_language, debtly-settings, debtly:react-query-offline-cache and account-scoped offline-sync keys. Web uses browser persistence; mobile uses AsyncStorage and SecureStore for native-session encryption keys. Preferences persist until changed/cleared; caches and queues follow the app lifecycle rather than a cookie expiry. Native referral checks can retain account-scoped App Attest key IDs and integrity evidence for anti-abuse eligibility, separately from advertising IDs.

5. Conditional mobile advertising

Rewarded AdMob is optional, configured only on iOS/Android and enabled separately. Non-personalized ads can use identifiers/storage for delivery, frequency limits, reporting and fraud prevention. SDK/provider rules control their names/duration. Google’s privacy form identifies applicable purposes/providers and its SDK retains choices until changed/reset/renewed. Before a rewarded request, Debtly checks consent; where GDPR applies, refusing device storage blocks the request. Unknown/failed privacy checks also block it. Where required and available, reopen Settings → Advertising privacy choices. Terms acceptance, signup and push permission are not advertising consent.

6. Controls and changes

Change preferences, remove a referral code in the form, disable push, change discoverability, sign out or delete the account through available controls. Browser/device settings can clear or block storage, which can sign you out or lose unsynchronized work; exports elsewhere are unaffected. Removing the dashboard cookie does not withdraw the waitlist signup. Use an email unsubscribe link to withdraw your waitlist membership, or request other deletion at develop@debtly.tech.

Any future optional web tracking must stay inactive until the legally required choice is obtained, with clear refusal and change controls. Scrolling, continued browsing and accepting general Terms are not that choice. We update this notice as technologies/purposes change. Contact the Operators at develop@debtly.tech; the Privacy Policy explains retention, providers and rights.