Privacy Policy

• No backend. The App has no server of ours. We never receive your financial records.
• Local storage. Your data is stored on your device in a local database (Apple SwiftData).
• iCloud backup and restore are optional and use your private iCloud account — not ours.
• No ads in the App, and no ad network SDK inside it.
• Anonymous usage analytics and crash reports are collected so we can see which features are used and fix what breaks. These carry no names, no notes, and no amounts — see sections 8 and 9.
• With your permission (the iOS tracking prompt), your device's advertising identifier is used to measure which advertisement led to an install. You can decline, and can change your mind at any time in iOS Settings.
• Network use: optional iCloud backup, subscription processing through Apple / RevenueCat, analytics and crash reporting, and push notifications.

You may store the following in the App: debtor/creditor names, transaction amounts, dates, notes, interest terms, payment records, books/ledgers, and your own profile.

• This data is saved locally on your device using SwiftData.
• It is not sent to us or to any third party we control.
• You can delete any record, or clear all data, at any time from within the App.

If you use Cloud Backup or Restore:

• Your data is stored in your own private iCloud container (iCloud.com.shahanul.Debt-Book) under your Apple ID.
• This transfer is between your device and Apple's iCloud. We have no access to it.
• Apple's handling of iCloud data is governed by Apple's Privacy Policy.
• You can stop using Cloud Backup and manage the App's iCloud data through Apple's iCloud settings.

The App provides an optional searchable contact list to speed up adding a transaction (NSContactsUsageDescription).

• Contact access is requested only when you open the contact-selection feature. If permission is granted, the App reads contacts from the device to display the searchable list, including names, phone numbers, email addresses, and contact thumbnails when available.
• If you select a contact, the contact's name, first phone number, and first email address, when available, are copied into the App's local database and associated with your debt record. Contacts you do not select are not saved in the App's database.
• We do not receive or upload your address book or selected contact information to a server operated by us, and the App does not send contacts to RevenueCat.
• If you explicitly use Cloud Backup, saved debt-book records—including contact details you previously selected and saved—are included in the backup stored in your private iCloud container under your Apple ID. We do not have access to that data.
• A selected contact's name and phone number may appear in a PDF transaction statement generated on the device. The PDF is shared only when you explicitly choose a destination through the iOS share sheet.
• You can deny or revoke contacts permission in iOS Settings; the App still works (you type names manually).

The App can suggest names for your books using Apple's on-device language model (NSLanguageModelUsageDescription).

• This runs entirely on your device using Apple's Foundation Models.
• No prompt or data is sent to us or to an external AI service for this feature.

Premium features are sold via subscriptions and a lifetime purchase. Payments are processed by Apple (App Store), and subscription state is managed through RevenueCat, our subscription infrastructure provider.

• We never see or store your payment card details. Apple handles all billing.
• RevenueCat processes subscription-related identifiers, purchase/entitlement information, and associated technical information needed to validate purchases and enable restore-purchases. The App does not send RevenueCat your contacts, debt records, names, notes, or transaction amounts.
• RevenueCat's handling of data is governed by RevenueCat's Privacy Policy.
• Apple's handling is governed by Apple's Privacy Policy.

• Optional PIN lock and auto-lock protect access to the App.
• Your PIN is stored only as a SHA-256 hash on your device — the raw PIN is never stored.
• Because your data lives on your device (and in your own iCloud), its security also depends on your device passcode and Apple ID security.

The App records a small, fixed set of anonymous usage events so we can see which features people actually use, where they get stuck, and whether an update made things better. These are sent to Amplitude and to Google Firebase Analytics.

The complete list of events is: app opened; onboarding started and completed; book created; person added; transaction created; partial payment added; transaction paid off; interest calculated; PDF exported; PIN enabled; iCloud backup enabled; paywall viewed; purchase started; purchase completed. The App also records app launches and session starts automatically.

An event may carry structural details only — whether a transaction was a lend or a borrow, whether it had interest or a due date, how many books exist, the subscription product identifier and its price, and whether you are on the free or paid plan.

Advertising identifier & the tracking prompt

We advertise the App. To learn which advertisement led to an install, Firebase can share your device's advertising identifier (IDFA) with Google Ads, where it is matched against advertisements you were shown. Under Apple's rules this counts as tracking, so:

• iOS asks your permission first, through the standard App Tracking Transparency prompt.
• If you decline, no advertising identifier is read, and iOS additionally blocks the App's analytics traffic to Google's measurement endpoint. The App works exactly the same either way.
• You can change your answer at any time: iOS Settings → Privacy & Security → Tracking.

Purchase events — which subscription was bought, its price and currency — are also used to measure advertising performance. No advertising network operates inside the App, and we never receive advertising profiles built about you elsewhere.

When the App crashes, a report is sent to Google Crashlytics so the bug can be found and fixed. A report contains:

• The crash itself — the stack trace and the code that failed
• Device model, iOS version, App version, and the App's database schema version
• A randomly generated installation identifier, which is not tied to you or to any account

We also record a report when the App's database fails to open, because the App recovers from that silently and it would otherwise be invisible to us. No ledger content is ever attached to a crash report — no names, amounts or notes.

• Due-date reminders are local. Your device schedules them and they never leave it. No server is involved and we cannot see them. With Discreet Notifications on, names and amounts stay off your lock screen.
• Announcements are push notifications delivered through Firebase Cloud Messaging. If you allow notifications, your installation receives a push token — that is what lets an announcement reach everyone at once. The token identifies an installation, not you, and we keep no list of who received what.
• Turn either off at any time in iOS Settings → Notifications → Debt Book.

The developer does not receive or have access to:

• Your debts, transactions, amounts, interest terms, or notes
• The names, phone numbers or email addresses of the people in your books
• Your own profile details — name, email, phone or photo
• Your contacts
• Your photos, or any PDF statement you generate
• Your PIN (only a one-way SHA-256 hash is stored on your device, never sent anywhere)
• Your location
• Any data on a server operated by us (we have none)

The App is not directed to children under 13 and we do not knowingly collect personal data from children. We operate no server that holds your records, and the analytics and crash data described above carry no personal details. The App does not ask for the tracking permission in order to build a profile of anyone, and tracking can be refused outright.

You are in full control of your data:

• Access / Export: Export your data from within the App.
• Delete: Delete individual records or clear local data in the App. If you used Cloud Backup, you can manage the App's stored iCloud data through Apple's iCloud settings.
• Because we hold no copy of your ledger, deletion on your device (and iCloud) removes it entirely.
• Tracking: allow or refuse it when the App asks, and change it later in iOS Settings → Privacy & Security → Tracking. Refusing stops the advertising identifier from being read or shared.
• Notifications: turn announcements and reminders off in iOS Settings → Notifications → Debt Book.
• Analytics: to ask that analytics and crash reporting be disabled for your installation, or to ask what has been collected, email us — the address is at the top of this page.

None of these services receive your debt records, the people in your books, or your notes. No advertising network runs inside the App.

We may update this policy as the App evolves. The “Effective date” above reflects the latest version. Material changes will be reflected here and, where appropriate, in the App.