Privacy Policy

Account information: your email address (or the identifier provided by Sign in with Apple or Google), used to create and secure your account.

Financial information: the debts, income, expenses, and payments you choose to enter, used to calculate your figures and sync them across your devices.

Usage analytics: basic feature-use events tied to your account id, plus anonymous onboarding steps and predefined choices, help us understand how the app is used. Analytics exclude entered names, financial amounts, statement text and chat contents. Technical metadata includes app version, operating system, device model and testing channel. Product analytics do not request device location, contacts or advertising identifiers. IP-derived location enrichment is disabled. Older app versions sent some additional analytics properties; contact us with questions or erasure requests.

Advertising measurement: see "Advertising Measurement" below. This is the only data we use for advertising, and it is limited to install and milestone events.

Your information is used to provide the app:

• Authenticate your account and keep you signed in
• Calculate your safe-to-spend amount, budget, payoff timeline, and progress
• Securely back up your data and sync it across your devices
• Power the home-screen and Lock Screen widgets
• Understand which features help people, and which of our ads bring people to Debtless

Your data is stored on your device and in your private, per-account space in our cloud backend (Supabase). It is encrypted in transit (TLS) and at rest, and row-level security ensures only your account can access your data.

Keep a device passcode and Face ID enabled for additional protection. The app also offers an optional App Lock in Settings.

We rely on a small number of trusted providers to run the app:

• Supabase: secure account authentication and encrypted data storage
• Sign in with Apple and Google Sign-In: optional account sign-in
• RevenueCat: subscription management and receipt validation
• Anthropic (Claude): powers optional Debby chat and extraction from uploaded PDF statement text; see "Debby AI Chat"
• Discord: restricted operational support notifications using a ticket reference
• PostHog: product analytics (feature-usage events only; never your financial figures)
• GIPHY: fetches the optional GIFs Debby can send in chat
• Meta (Facebook): advertising measurement only; see "Advertising Measurement"

We never sell your data, and we never share your financial figures with any advertiser.

When advertising measurement is enabled and you allow tracking in iOS, the app can send Meta app-activation and limited setup/upgrade milestone events. These events do not include entered financial amounts, statement text, chat messages, email addresses or your Debtless account id. Meta may process device identifiers for attribution.

If you decline tracking, the current release does not initialize Meta or forward new advertising events. Automatic app-event logging and SKAdNetwork reporting are disabled in this release.

RevenueCat attribution identifiers are linked only while tracking is authorized. This statement does not imply that server-side RevenueCat-to-Meta purchase reporting is enabled.

You can change permission in iOS Settings → Privacy & Security → Tracking. Withdrawing permission stops new app-forwarded events when the app observes the change; it does not recall already transmitted requests or erase provider history. Contact privacy@debtless.app for deletion requests.

You can view and edit your entries in the app. Settings → Delete Account removes your account and associated financial records from our active database and cannot be undone. Provider cleanup can take additional time; restricted retry records may be retained until cleanup is confirmed. Backup copies expire under the applicable backup schedule.

You can also request access to, correction of, or an export of your data by emailing privacy@debtless.app.

We retain account data while your account is active. After deletion, provider cleanup, restricted retry records and backups follow the process described above. Contact us for the status of a deletion request; any retention required by law may continue.

If you are located in the European Economic Area, you have additional rights under the General Data Protection Regulation:

• Legal basis: we process your data to perform our contract with you, for our legitimate interest in improving and promoting the app, and with your consent for advertising measurement linked to your device (the iOS tracking prompt)
• Right to access, rectification, erasure, restriction, portability, and objection
• Right to withdraw consent at any time, including for tracking, in iOS Settings → Privacy & Security → Tracking

Data Protection Officer: dpo@debtless.app

Supervisory authority: you have the right to lodge a complaint with your local data protection authority.

We do not sell your personal information. Sending advertising-measurement events to Meta may count as "sharing" under California law; you can opt out by declining or turning off tracking in iOS Settings → Privacy & Security → Tracking.

• Right to know: request the categories and specific pieces of personal information we hold
• Right to delete: use in-app account deletion; provider cleanup and backups follow the process described above
• Right to opt out of sharing: decline tracking as described above
• Right to non-discrimination for exercising your privacy rights

To exercise your California privacy rights, email privacy@debtless.app with "California Privacy Request" in the subject line.

If you are a Canadian resident, you have rights under the Personal Information Protection and Electronic Documents Act: to access and correct your information, to withdraw consent (including by declining tracking or deleting your account), and to file a complaint.

We collect personal information only for the purposes described here, and retain it only as long as necessary for those purposes.

To exercise your rights, email privacy@debtless.app with "Canadian Privacy Request" in the subject line. You may also contact the Privacy Commissioner of Canada at www.priv.gc.ca or 1-800-282-1376.

Debby is an optional, educational money-coaching chat powered by Claude, an AI model provided by Anthropic. When you send Debby a message, that message and a summary of your financial figures (such as your debts, income, and expenses) are sent to Anthropic to generate a reply. Your conversation and any notes Debby saves are stored in your private account so they sync across your devices.

Debby provides general educational information, not licensed financial advice. Your data is not used to train AI models and is never sold. All core calculations, including payoff timelines, safe-to-spend, and budgets, are performed by transparent math on your device. Using Debby is entirely your choice.

Debtless is intended for adults (18+) managing personal finances. We do not knowingly collect personal information from anyone under 18.

We may update this policy as the app evolves. Material changes will be reflected here with an updated date and, where appropriate, noted in the app.