Privacy Policy

Information we collect

• Account information. Your email address, and a password if you choose one. On the website and in the app alike, you sign in with that password or with a one-time code we email you. If you set a password, our sign-in provider, Supabase, stores it as a one-way hash, never as the password itself. The time zone of the browser or phone you use is stored alongside your account, so that “this week” means your week rather than ours.
• Personal details you choose to add. Your account page on the website lets you save a name, phone number, date of birth and address. Every one of them is optional, none of them is required to use any part of Debito, and you can clear any of them at any time. We do not ask for a Social Security number, a government ID, or anything from a bank statement, and you should not send them to us.
• Debt information you enter. The debts, balances, interest rates, budget figures, and payments you record. You can use the website as a guest without an account, in which case this stays in your browser and is never sent to our servers.
• Usage analytics. Aggregate, privacy-friendly usage metrics on the website (via Vercel Analytics) that help us understand which features are used. These do not identify you personally. The app does not include an analytics or advertising service.
• Error reports. When something fails on our servers, a report can go to Sentry: the error, where in our code it happened, the request it happened during, and which version of Debito was running. Some reports also carry the internal ID of your account or of the record involved, which is a random string rather than your email address. Reports are set up to leave out request bodies, cookies, headers, query strings and email addresses. The website sends no error reports from your browser; the app's crash reports are described under The mobile app.

How we use your information

• To provide the service: saving your plan and showing your progress.
• To secure your account and prevent abuse.
• To improve Debito based on aggregate usage.
• To find and fix what breaks, from error and crash reports.

We do not sell your personal information, and we do not share your debt data with advertisers.

Service providers

We rely on a small number of trusted providers to run Debito:

• Supabase, for sign-in and encrypted database storage for your saved plan.
• Vercel, for hosting and privacy-friendly analytics.
• Resend, which delivers our email: sign-in codes and, if you have an account, a welcome email when you first save a plan with debts in it, a monthly recap, and notices about a subscription to Extra. The welcome email and the recap each carry a link that turns them off, and the recap can also be turned off under Settings on the website.
• Sentry, which receives error reports from our servers and crash reports from the app.
• Expo, which delivers updates to the app. See The mobile app.
• Stripe, for payment processing for Extra subscriptions. We never see or store your full card details.
• Plaid. If you choose to connect a bank, Plaid securely links your accounts so we can import balances. See below.
• Anthropic, which provides the AI model behind Ask Debito and the what-if box on the website. If you use either, your debt figures are sent to Anthropic to generate the answer. See below.

Ask Debito and what-if questions (optional)

Ask Debito is optional and only runs when you open it and send a message. When you do, we send Anthropic your question along with a summary of your situation — your debt names, balances, rates, minimum payments, what you pay each month, your budget totals, and how much you have logged as paid so far this month — so the answer is about your actual plan rather than a generic one. Each question goes with the conversation before it, up to the last 20 messages, since we keep no copy between questions. We do not send your name, email address, or any of the identity details on your account page. It works the same way on the website and in the app.

We do not store your conversations. On the website, a conversation exists only in your browser tab and is gone when you close it. In the app, it is held in the app's memory and never written to your phone's storage, and it is gone when the app is closed or you sign out. We keep only a count of how many messages you have sent each day, which is what enforces the daily limit on the free plan. Anthropic processes the request to produce the answer and does not use it to train their models.

The “Ask your own” what-if box on the Debts page of the website uses Anthropic too, and only when you send it a question. It sends your question along with each debt's name, type, balance, rate, minimum payment and what you pay toward it, the random ID we use to tell your debts apart, the order you are paying them off in, and what goes to your debts each month. Nothing from your budget, your payment history or your account page goes with it. The model only works out which change you mean; every figure in the answer is calculated by us. As with Ask Debito, we keep a count of how many you ask rather than the questions, and Anthropic does not train on them. The app has no what-if box.

If you report an answer, the email you send us contains that answer and the question it answered, and we keep it as we keep any other email to support. Nothing is sent until you send it yourself.

Ask Debito is not financial advice, and it is not a licensed adviser. It can also be wrong. Check anything important against the numbers on your own statements before acting on it.

Connecting a bank (optional)

Bank connections are optional and only available if you turn them on. When you link an account, Plaid handles the connection and we receive read-only balance and liability information for the accounts you choose, never your bank login credentials. The access token that lets us refresh balances is encrypted and stored securely, is used only to sync your accounts, and is deleted when you disconnect the bank or delete your account. We cannot move money.

Bank linking is only on the website. The app has no way to link a bank.

The mobile app

The app uses the same account and the same servers as the website. Signing in, and staying signed in, goes from the app straight to Supabase, and your plan comes and goes through our servers. This section covers what is particular to the app, including the two other services it talks to directly: Sentry and Expo.

The app stores these on your phone:

• Your sign-in session, in the phone's secure storage — the Keychain on iOS, or encrypted with a key held by the Android Keystore — until you sign out.
• A copy of your plan as the app last loaded it — your debts, bills, income, logged payments, the money people owe you, and the names of any banks you have linked — so that it opens straight away, even without a signal. It is kept in the app's own storage rather than the secure storage. It is shown only to the account that loaded it, and never once it is more than a week old. Signing out in the app deletes it, and so does deleting your account there. If the app's session is ended from somewhere else, such as by deleting your account on the website, the copy is deleted the next time the app is opened with a connection.
• A shared bill's credential. If you take part in a bill someone has shared with you, the credential that lets you back into that bill is kept in the same secure storage as your session. It belongs to no account, so signing out does not remove it.
• A few settings about the app rather than about you: whether the calendar shows dots or bars, our servers' last answer on whether this version of the app is still current, and whether you hid the note about a newer version.

It also keeps the identifier described under Updates below, and a crash report waits on the phone until it can be sent. On Android, the app opts out of cloud backup, so none of this is uploaded when your phone backs itself up.

What the app tells our servers about itself. Every request the app sends to our servers names the app: its platform (Android or iOS), its version and build number, its runtime version, which update it is running, and its release channel. That is about the app, not about you. Our servers read it to decide whether that version can still save changes, and it is not stored with your account.

Crash reports. If the app crashes or meets an error it cannot handle, it can send a report to Sentry. A report holds the error and where in the app's code it happened; the app's version, build, runtime version, update and release channel; technical details of the phone, such as its model and operating system version; and a short trail of what the app did just before, in which each request is recorded only as its method, its result and its address, without the query string and with the code from a shared bill's link blanked out. The app attaches no screenshot or record of what was on the screen; no account, email address or IP address; nothing a request sent or received; nothing it wrote to its log; and none of the labels of what you tapped — in Debito, a button's label can be the name of a debt. Sentry also records when each session of the app starts and ends, and whether it ended in a crash, so we can tell how often the app crashes; that record carries no account details and nothing from your plan. Development builds send nothing.

Updates. Some updates to the app come from Expo rather than through the app store. When the app checks for one, it tells Expo its platform, its runtime version, the update it is running and the one it was installed with, its release channel, any update that recently failed to start, and a random identifier the app created for this installation. If the update system itself failed the last time the app started, the check also says what went wrong. Nothing from your account or your plan is sent; like any server, Expo sees the internet address the request comes from.

Data retention and deletion

We keep your data for as long as your account is active. You can delete your account at any time: on the website, open Settings and choose Delete account; in the app, tap the circle with your initial at the top of Home to open Settings, and choose Delete account. When you do, your profile, debts, and payment history are permanently removed from our database. Deleting it in the app also clears the app's copy of your plan and your sign-in from that phone; deleting it on the website clears them the next time the app is opened with a connection. How to delete your account covers the app, the website, and what to do if you cannot sign in. Guest data lives only in your browser and is cleared when you clear your browser storage.

Security

Data is encrypted in transit (HTTPS). Access to your saved plan is restricted so that only you can read or change it. No system is perfectly secure, but we work to protect your information using industry-standard practices.

Three fields get more than that. If you choose to save a phone number, a date of birth or an address, each is encrypted with AES-256-GCM before it reaches our database, using a key the database itself does not hold. They are decrypted only to show them back to you on your own account page. A name and a date of birth together are the raw material for identity theft, and unlike a password, a date of birth cannot be changed afterwards, so we treat them differently from the rest.

Children

Debito is not directed to children under 16, and we do not knowingly collect their information.

Changes to this policy

We may update this policy from time to time. When we do, we'll revise the "Last updated" date above.

Contact

Questions about privacy? Email us at support@debito.app.