Privacy Policy

1. Introduction & Core Philosophy

DebtSync ("we", "our", or "the platform") is an open-source collaborative peer-to-peer ledger, interest calculation tool, and debt management portal accessible at https://debt-sync.satya-nayak.dev.

We believe financial record-keeping should be transparent between agreeing parties and invisible to everyone else. We do not sell your personal data, we do not run third-party advertising trackers, and we minimize data collection strictly to what is required to maintain your shared ledgers and dispatch requested notifications.

2. Information We Collect

When you use DebtSync, we collect the following categories of information:

• Account Credentials & Profile: Your email address, display name, profile avatar, and (where phone authentication or OTP verification is enabled) your mobile phone number.
• Transaction & Ledger Records: Transaction principal amounts, selected currency (e.g. INR, USD), interest engine parameters (Simple or Compounding APR), transaction dates, due dates, settlement status, and two-sided personal notes recorded between lender and borrower.
• Repayment Receipts: Recorded repayment amounts, timestamps, lender verification states, dispute records, and optional payment method tags (UPI, Cash, Bank Transfer, or transaction reference identifiers).
• Notification & Device Tokens: Web Push subscription endpoints and notification preference toggles stored to deliver transaction alerts, reminder dispatches, and due date alerts.

3. Purpose & Legal Basis of Processing

We process your data strictly to provide and maintain the core functionality of DebtSync:

• Facilitating two-sided peer transaction consensus and repayment tracking between you and your invited counterparties.
• Performing real-time mathematical interest accrual calculations according to your selected APR rules.
• Dispatching agreement invitations, payment verification alerts, friendly lender reminders, and 1-day due date notifications.
• Enforcing security rate limits (such as preventing OTP flooding or reminder spamming) and safeguarding against abusive platform behavior.

5. Service Providers & Infrastructure

To operate securely, we utilize established infrastructure providers who adhere to strict data processing standards:

• Supabase Inc.: Cloud database (PostgreSQL), user authentication, Row-Level Security (RLS) enforcement, and Edge Function orchestration.
• Brevo (formerly Sendinblue): Transactional email delivery for account signups, agreement notifications, and payment reminders.
• Messaging Gateways (Fast2SMS / Meta): SMS, RCS, or WhatsApp message delivery strictly for user-requested phone number authentication and OTP verification.
• Cloudflare / Vercel: DNS, SSL/TLS termination, DDoS mitigation, and global edge content delivery.

7. Data Retention & Account Deletion

Your transaction records are retained for as long as your account remains active or until you choose to delete them. You can take back or cancel pending agreements directly from the UI.

To request complete deletion of your account, authentication credentials, and all associated personal records, simply send an email from your registered address to [email protected] with the subject "Account Deletion Request". Deletion requests are permanently processed within 48 hours.

8. Security Safeguards

We implement industry-standard safeguards including PostgreSQL Row-Level Security (RLS) policies ensuring users cannot query or modify unauthorized ledgers, 256-bit TLS encryption in transit, cryptographic password hashing, strict API rate-limiting, and sanitized inputs preventing injection vulnerabilities.

9. Open Source Transparency

DebtSync is an open-source project. Our full codebase, database schemas, and notification pipelines are publicly auditable at https://github.com/Satya-Siba-Nayak/Debt-Sync.