Privacy statement

The short version

DebtAway has no server, no account and no sign-up. Your loans, payments and settings live in your device’s own storage. They are not transmitted, not analysed and not passed to anyone, because there is nowhere for them to be received.

Personal data is processed in two cases only: when this website is visited (server logs) and when DebtAway Pro is bought (purchase validation through Apple and RevenueCat). Both are described in detail below.

There is no advertising, no tracking, no analytics service, no cookies and no consent banner, because none of it is in use.

1. Controller

The controller under Art. 4 (7) GDPR is:

Company

Minty Software

Owner

Deniz Erginos

Address

Hauptstr 37, 76872 Steinweiler, Germany

Mail

deniz@erginos.io

A data protection officer is not required by law and none has been appointed. Data protection requests go to the address above.

2. Data in the app

The app stores what you type in, in the device’s local storage (AsyncStorage). That is:

• the loan’s name, balance, interest rate, monthly payment and due day
• the payments you record, with their date, amount and kind
• the days won and the interest saved that the app computes from them
• your language, appearance and Pro settings

None of it leaves the device. There is no transfer to me and no sync with a server, because the app has none. To that extent there is no processing by me as controller: what happens on your own device is your decision.

The app asks for no registration, no mail address, no phone number and no bank details. There is no bank interface and no account access.

3. Website and server logs

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Serving a page produces technical connection data the server records automatically:

• the IP address of the requesting device
• the date and time of the request
• the address requested
• the browser type and version the browser reports
• the operating system
• the referrer URL, where the browser sends one

The legal basis is Art. 6 (1) (f) GDPR. The legitimate interest is operating the site without faults and defending it against attacks. This data is not combined with other sources and no profile is built from it.

Vercel processes it as a processor under the Data Processing Addendum that forms part of the Vercel terms, and deletes the logs automatically after a short period.

The Archivo typeface is served from this site. No Google Fonts are loaded, no videos are embedded and no third-party content is fetched. The site sets no cookies and stores nothing in the browser.

The projection on the front page runs entirely in your browser, on the same arithmetic the app uses. The figures you type there are not sent to the server, not stored and not written into the address bar. They are gone the moment you leave or reload the page.

4. Buying DebtAway Pro

DebtAway Pro is a one-time purchase through the App Store. Apple processes the payment. Apple gives me no personal details about you, only anonymous sales figures.

To check that the purchase is valid, the app uses RevenueCat, Inc., 1 Letterman Drive, Building C, Suite C3-350, San Francisco, CA 94129, USA. RevenueCat receives:

• an anonymous user id RevenueCat generates itself, with no link to your name or mail address
• the App Store receipt with the product id, the time of purchase and the store account’s country
• technical details about the device and the app version

Your loans, payments and amounts are not transmitted. The legal basis is Art. 6 (1) (b) GDPR, because validating the purchase is necessary to provide the Pro features you paid for.

Without a purchase and without restoring one, nothing that could be attributed to a person is sent to RevenueCat.

5. Backup export

With Pro you can export your data as a file. The export writes the file on the device and hands it to the operating system’s share sheet. Where it goes is your decision. I do not receive it, and there is no upload to me.

6. Recipients

Nobody outside these three receives data:

Vercel Inc., USA

hosting this website, server logs

RevenueCat, Inc., USA

validating the Pro purchase

Apple Inc., USA and Ireland

processing the App Store payment

There are no ad networks, no analytics providers, no crash reporting services, no mailing list providers, and no sale or exchange of data.

7. Transfers to the USA

Vercel, RevenueCat and Apple are US companies, so processing may take place in a third country. Transfers rely on the EU standard contractual clauses under Art. 46 (2) (c) GDPR, which form part of the respective processing agreements, and, where the provider is certified under it, on the European Commission’s adequacy decision for the EU-US Data Privacy Framework.

Despite those safeguards it cannot be ruled out that US authorities demand access to data under their own laws. Your loan figures are not affected, because they never leave the device.

8. Retention

Data in the app

until you delete it or remove the app

Website server logs

briefly at Vercel, then deleted automatically

Purchase records at RevenueCat

as long as the purchase stands, which is indefinitely, because it does not expire

Billing records at Apple

under tax and commercial law, up to 10 years

I keep no database of users, so beyond the services named above there is nothing for me to retain.

9. Your rights

Under the GDPR you have the right at any time to:

• access the data held about you (Art. 15)
• correction of inaccurate data (Art. 16)
• erasure (Art. 17)
• restriction of processing (Art. 18)
• portability in a structured format (Art. 20)
• object to processing based on legitimate interests (Art. 21)
• lodge a complaint with a supervisory authority (Art. 77)

Since I keep no accounts, there is usually no data about you on file. An access request can therefore mostly be answered by confirming that nothing is stored. Write to deniz@erginos.io; I answer within the one-month period of Art. 12 (3) GDPR.

The competent supervisory authority is the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate, Hintere Bleiche 34, 55116 Mainz, Germany.

10. Right to object

You have the right to object at any time, on grounds relating to your particular situation, to processing based on Art. 6 (1) (f) GDPR. Here that is the server logs of this website. On an objection I stop that processing unless compelling legitimate grounds prevent it.

11. Deleting

In the app: More, then Delete everything. Or remove the app from the device. The data is then gone, and since no copy sits on a server, that is all of it.

The Pro purchase stays attached to your store account and can be brought back at any time with Restore purchase. If you want the purchase history held at RevenueCat deleted, a mail is enough and the anonymous user id is removed.

12. Security

The site is served over HTTPS only. The app’s data sits in the app’s own storage area, which the operating system shields from other apps. A backup of your phone can carry that data along; the settings and encryption you chose on the device govern it.

13. Changes

When the app or a service it uses changes, this statement changes with it. The date above states the version. An earlier version can be read in the source history.

14. Contact

Privacy questions, access requests and objections go to deniz@erginos.io or to Minty Software, Hauptstr 37, 76872 Steinweiler, Germany.