Debty

📋 Overview

Debty ("the App") is a local-first debt tracking application developed by Fennec Software. This Privacy Policy explains what data the App collects, how it is used, and your rights regarding that data.

📦 Data We Collect & Why

1. Financial records (debts & payments)

• Stored exclusively on your device in an AES-256-encrypted SQLite database.
• Never transmitted to our servers (we have none).

2. Contact information Optional

• When you choose to import contacts, the App reads names and phone numbers from your device contacts to pre-fill person records.
• This data is stored exclusively on your device in the same encrypted local database and is never uploaded to any server, including our own (we do not operate any servers).
• The App does not collect, transmit, share, or sell your contact data to any third party.
• Before accessing your contacts, the App displays a consent dialog clearly explaining how your data will be used and that it remains on your device. You may decline and still use all other features of the App.
• Permission: READ_CONTACTS (read-only — the App never modifies your device contacts)

3. Notifications Optional

• The App may send local push notifications to remind you of upcoming or overdue debts.
• Notifications are generated on-device; no notification content is sent to external servers.
• Permission: POST_NOTIFICATIONS, RECEIVE_BOOT_COMPLETED

4. Biometric authentication Optional

• The App supports fingerprint / Face ID lock via the device's secure biometric APIs.
• Biometric data is processed entirely by the operating system — the App never accesses or stores raw biometric data.

5. Google Drive backup Optional

• If you choose to enable cloud backup, the App uploads an encrypted backup file to your personal Google Drive account (in a folder named "Debty Backups").
• This uses the Google Drive API (drive.file scope) — the App can only access files it creates, not your other Drive files.
• We never have access to your Google account credentials or Drive content.
• You can disconnect Google Drive and delete backups at any time from within the App.

6. Crash reports Optional

• The App may use Sentry for anonymous crash reporting in release builds.
• Crash reports do not include financial data, contact information, or personally identifiable information.
• Crash reporting is completely disabled in debug builds.

✅ User Consent

The App obtains your explicit consent before accessing any sensitive data:

• Contacts: Before requesting the system contacts permission, the App shows a clear in-app consent dialog that explains: (1) what data will be accessed (names and phone numbers), (2) that data is stored only on your device, (3) that data is never uploaded to any server or shared with any third party, and (4) a link to this Privacy Policy. You must tap "Agree & Continue" before the system permission prompt appears. If you decline, the App does not access your contacts.
• Notifications: The App requests permission before sending any notifications.
• Google Drive backup: You must explicitly sign in and authorize the App before any backup is created.
• Biometrics: Biometric authentication is opt-in and configured in Settings.

🔒 Data Security

• Local database encrypted with SQLCipher AES-256.
• Encryption key stored in the device's secure keystore via flutter_secure_storage.
• PIN codes hashed with PBKDF2-SHA256 (100,000 iterations) + random salt.
• Cloud backups are end-to-end encrypted before upload.
• Escalating lockout on failed PIN attempts (3 attempts → 5 min, 6 → 15 min, 9 → 60 min).

🌐 Third-Party Services

The App may interact with the following third-party services:

• Google Sign-In & Google Drive API — for optional cloud backup. Governed by Google's Privacy Policy.
• Sentry — for optional anonymous crash reporting. Governed by Sentry's Privacy Policy.
• Open Exchange Rates / similar APIs — for live currency conversion rates (no personal data sent).

The App does not use advertising SDKs, analytics SDKs, or social media trackers.

🗑️ Data Deletion

You have full control over your data:

• Local data: Uninstalling the App removes all local data from your device.
• Cloud backups: Delete them at any time from Settings → Backup → Google Drive.
• Google account access: Revoke it from your Google Account settings.

👶 Children's Privacy

Debty is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided data through the App, please contact us so we can take appropriate action.

✏️ Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be reflected on this page with an updated "Last Updated" date. We encourage you to review this policy periodically. Continued use of the App after changes constitutes acceptance of the updated policy.

📧 Contact Us

If you have any questions or concerns about this Privacy Policy or your data, please contact us:

• Email: info@fennecsoft.net
• GitHub: github.com/nacertaker/debty