Privacy Policy

This Privacy Policy explains how ihavenodebt (“ihavenodebt”, “we”, “us” or “our”) collects, uses and protects your personal data when you use our website and mobile application (together, the “Service”). We are the data controller for the personal data described here, and we process it in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable data-protection law.

ihavenodebt is a personal debt-tracking tool. We designed it to need as little of your data as possible: no bank-account linking, no open banking, and no advertising trackers.

Information we collect

We collect the following categories of personal data:

• Account and profile data: your email address, an optional display name, and a securely hashed version of your password. We never store your password in plain text.
• Financial tracking data you enter: the debts, balances, interest rates, minimum payments, due dates, categories, notes and payments you choose to record. This is information you type in yourself — we do not connect to your bank or import it automatically.
• Preferences: settings such as your display currency and chosen theme.
• Subscription and payment data: if you upgrade to Pro, your payment is processed by our payment providers (Stripe for web and Google Play for the Android app). We receive confirmation of your subscription status and renewal dates, but we do not collect or store your full card or bank details.
• Referral data: if you use or share a referral link, we record the referral code and the link between the referring and referred accounts so we can apply the reward.
• Technical and usage data: limited information generated when you use the Service, such as your IP address (used to derive an approximate country for currency defaults and for security and abuse prevention), device and browser type, and server logs.

How and why we use your data

We use your personal data to:

• create and secure your account and authenticate you;
• provide the Service — storing, displaying and calculating your debt tracking, projections and progress;
• operate paid features, process subscriptions and apply referral rewards;
• send service messages such as email verification, password resets and important account notices;
• maintain the security, integrity and reliability of the Service and prevent fraud or abuse;
• comply with our legal obligations and respond to lawful requests.

Legal bases for processing

Under UK GDPR we rely on the following legal bases:

• Performance of a contract — to provide the Service you have signed up for, including paid features.
• Legitimate interests — to keep the Service secure, prevent abuse, and operate and improve our product, balanced against your rights.
• Consent — where we ask for it (for example, optional communications); you can withdraw consent at any time.
• Legal obligation — where we must process data to comply with the law.

Sharing your data

We do not sell your personal data, and we do not share it with advertisers. We share data only with the service providers (processors) that help us run the Service, and only as needed to provide it:

• Cloud hosting and managed database providers that host the application and store your data securely.
• Stripe — payment processing for web subscriptions.
• Google Play — payment processing for Android subscriptions.
• Resend — sending transactional emails (verification, password reset and account notices).

These providers act on our instructions under appropriate data-processing terms. We may also disclose data where required by law, to protect our rights or users, or in connection with a business transfer (such as a merger or acquisition), in which case we will notify you.

International transfers

Some of our providers may process data outside the UK or European Economic Area. Where they do, we rely on appropriate safeguards such as UK adequacy regulations or Standard Contractual Clauses (with the UK Addendum) to protect your data.

How long we keep your data

We keep your personal data for as long as your account is active. If you delete your account, we delete your debts, payments and associated personal data, except where we are required to retain limited records (for example, billing or tax records, or to comply with legal obligations). Backups are cycled out on a routine schedule.

Security

We take security seriously. Passwords are hashed with bcrypt and never stored in plain text. Sessions use signed tokens, and on the web are kept in secure, HTTP-only cookies. Data is transmitted over encrypted connections (HTTPS) and stored in an encrypted database. No system is perfectly secure, but we work to protect your data using industry-standard measures.

Your rights

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased (“the right to be forgotten”);
• restrict or object to certain processing;
• data portability — receive your data in a portable format;
• withdraw consent where we rely on it.

You can exercise the core of these rights yourself at any time: from Settings you can export all of your data, and you can permanently delete your account and its data. For anything else, contact us using the details below. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

Cookies

We use only essential cookies needed to sign you in and keep your session secure. We do not use advertising or third-party tracking cookies.

Children

The Service is intended for adults and is not directed at children. You must be at least 18 years old to use it, and we do not knowingly collect data from anyone under 18.

Changes to this policy

We may update this policy from time to time. If we make material changes we will update the “Last updated” date above and, where appropriate, notify you. Continued use of the Service after changes take effect means you accept the updated policy.

Contact

For any privacy questions or to exercise your rights, contact us at [email protected].