Privacy Policy for Debtly

1. Account and profile

We use your email, account ID, display name, username, photo, language, currency, invitation identifiers and privacy preferences to maintain your account. Supabase Authentication handles passwords. If you choose Google Sign-In, Google supplies an identity token and available email, name and photo for authentication through Supabase. The selected login provider also processes authentication under its own policy. We also record the accepted Terms version, acknowledged Privacy Policy version, language, source and acknowledgment time; the server records its receipt time. This record does not grant advertising consent.

2. Ledger data and other people

We store debts, expenses, amounts, currencies, dates, recurrence, participants, groups, memberships, contact requests, invitations, labels, reminders, recorded payments, activity and uploaded attachments. Contacts are entered or linked in Debtly; the app does not import your device address book. Another user may enter your name or contact details, even if you have no account. Contact us to access, correct or request review of information about you. Recorded payments and approvals do not verify that money moved. Exchange-rate displays provide estimates, not currency transactions.

3. Optional payment instructions

You may save an account holder name, bank or receiving-account details, payment handle, email, phone or custom notes as payment instructions. These are stored for your use and are not automatically published to all participants; you can copy or share them yourself. Do not enter full card numbers, CVV/CVC, PINs, passwords, one-time codes or online-banking credentials. These instructions are separate from Premium checkout: Debtly does not receive the full card or bank details used to pay Apple or Google for a subscription.

4. Sharing and visibility

Authorized contacts and group or debt participants can see the profile and ledger information made available by their relationship and the access rules. Settings → Profile privacy controls username discoverability and contact invitation links. Disabling discovery does not erase existing shared records. Trust settings affect approval of shared actions, not confidentiality from existing participants.

Profile photos use public URLs and can be viewed by someone with the URL. Debt attachments use private storage and temporary signed links. Authorized recipients can still save or forward files. Upload only relevant information you are authorized to share and avoid unnecessary sensitive information.

5. Device storage and notifications

We store sessions, preferences, account-scoped cached records and pending changes for supported offline use. Browser builds use browser storage; mobile builds use device storage. Native sessions use an encrypted adapter, but this does not mean every cached record or export is encrypted by Debtly. Protect access to your device. The Cookies and device storage describes these technologies and controls.

Infrastructure and SDKs can process IP, device/browser information, session IDs, request times and operational or error logs. If enabled, Expo, Apple Push Notification service and Firebase Cloud Messaging process your push token and notification payload to deliver operational alerts. Alerts may reveal data on the lock screen; disable them in the app or device settings. Images use the device picker. The current app does not request microphone or device-location access.

6. Premium and subscription providers

Apple App Store or Google Play handles subscription purchases, renewals and refunds. RevenueCat processes your internal Debtly account ID, store purchase/receipt information, product IDs, entitlement and subscription state, renewal and trial/period dates, and relevant technical information to validate and restore access. Billing SDKs can connect when you view or manage Premium, before a purchase. Sponsored Premium seats use invitations, membership and the purchaser’s subscription state. A sponsored seat does not itself give the purchaser access to your private ledger.

7. Optional rewarded advertising

On configured iOS/Android builds, when the feature is enabled, you may choose an AdMob rewarded ad. Google Mobile Ads can process IP, device/advertising IDs, ad interactions and diagnostics for delivery, measurement and fraud prevention. Debtly sends an internal profile ID for server-side reward verification, not debt amounts or ledger contents.

We request non-personalized ads, which can still use identifiers or device storage. Before a rewarded request, we run the Google consent flow and check the applicable choices. Where GDPR applies, refusing the device-storage purpose blocks Debtly’s rewarded request. Unknown or failed privacy checks also block it. Where available, Settings → Advertising privacy choices reopens the privacy form. Refusing ads does not prevent ordinary Free use; the ad-dependent reward is unavailable. The web app does not currently serve rewarded ads.

8. Waitlist, referrals and security

Waitlist registration uses email, language, signup date, source and any referral code for launch/waitlist messages, private dashboard access and eligible promotions. It does not create an app account. A verified email can link a signup to an app account. Referral administration uses verification, onboarding completion, activity dates, qualifying individual debt or payment action, a cooling period and reward state. Referrers see aggregate counts and anonymous activity, not your email or ledger contents.

Cloudflare Turnstile processes browser/network security signals to prevent automated submissions: see its Cloudflare Turnstile Privacy Addendum. Private hashes of IP, email and referral codes limit abuse; hashes are not anonymous data. Resend processes recipient email and message contents for waitlist/referral email.

Eligible native referral checks use Apple App Attest or Google Play Integrity and the configured verification service. They process challenges, proofs or key IDs, profile ID, app version, verdicts and risk signals to prevent duplicate or fraudulent rewards. Results can put a referral under review or make it ineligible. Request review of an incorrect result at develop@debtly.tech. These checks secure promotions, not general advertising profiles.

9. Purposes, legal bases and disclosures

Where a legal basis is required, we rely on the service contract for authentication, the ledger, synchronization, requested exports, subscriptions and requested promotions; legitimate interests for security, abuse prevention, preserving shared records and disputes, subject to your rights; and legal obligations where applicable. Optional advertising/device access that requires consent uses a separate mechanism. Required account data is necessary to create an account; payment instructions, uploads and rewarded ads are optional. Accepting the Terms or acknowledging a privacy notice does not authorize all processing.

Providers include Supabase (auth, database, storage), Google and Apple (chosen login, store billing, push and integrity as applicable), Expo (push), RevenueCat (subscriptions), Cloudflare (Turnstile), Resend (waitlist/referral email), and deployment hosting and integrity verification services. We disclose needed data for these purposes, valid legal requests and protection of users/service. We do not sell or rent ledger or contact records. Conditional advertising processing and applicable choices are described separately.

10. Retention and account deletion

The configured Free personal-history lifecycle applies to non-group debts without another linked Debtly participant. Eligible records can be hidden after 90 days from their latest recorded activity, with configured warning thresholds and a 30-day recovery period. Permanent purge is controlled separately and can be disabled; a recovery deadline is not a promise to erase all copies on that date. Eligible Premium access can preserve or restore records within the recovery period. Shared/group debts and account deletion follow different rules.

Delete your account in Settings or request assistance at develop@debtly.tech. The app first removes account-owned uploaded files. Credentials, profile and solely controlled data are removed, but another participant’s shared history can remain. Group ownership can transfer, and shared entries can retain names already recorded, payment history and local contact snapshots with the deleted profile’s email/photo removed. Other users’ free text or files can contain information entered independently. Deletion cannot recall saved exports or copies.

Waitlist/referral data is separate and is not automatically erased by app-account deletion. Use the unsubscribe link in any waitlist campaign email to withdraw your membership without signing in. It removes your signup and disables your code and private dashboard access. Unclaimed benefits and pending referrals are canceled; already granted Premium and earned rewards remain. Restricted identity hashes and necessary reward records prevent duplicate attribution and repeated promotion claims. Request other deletion or referral-data review at the same address. We assess necessary promotion, fraud-prevention, legal and shared-record requirements. Provider backups, security logs and billing records can have separate retention cycles; we do not promise an unverified backup-purge period.

11. Exports, imports and API access

Exports contain accessible records in the scope and supported format you choose (.debtly, PDF, CSV or Excel), potentially including personal/financial information and selected attachments. Import previews can read packages locally; submitting an import for staging sends selected data to the server. Staging does not guarantee conflict resolution or completed import. Where available, API tokens authorize their selected scopes. Protect files/tokens and revoke compromised tokens. Recipients process shared information outside Debtly; account deletion does not remove files saved elsewhere.

12. Security, international processing and rights

We use access controls and reasonable safeguards, but cannot guarantee absolute security. Providers can process data outside your country. Where required, transfers must use applicable safeguards, such as approved contractual protections or an adequacy decision. Ask us about relevant providers, locations and safeguards; we do not promise a specific server country or certification.

Depending on your location, you may request access, correction, deletion, portability, restriction, objection, consent withdrawal and review of applicable automated decisions, and complain to your data-protection authority. We may verify identity and respond within applicable deadlines. Shared-record requests are assessed alongside participants’ rights and we explain applicable limits. The service is not directed to children; contact us about improperly supplied child data. Questions and requests go to the Operators at develop@debtly.tech. Material changes are notified through the service or email where appropriate; a policy update alone does not authorize a new optional purpose.