Privacy Policy
Your Privacy Matters
Last updated: 5 October 2026
Deby is a tool for keeping track of debts and splitting bills. It works without an account, and what you enter stays on your phone. This policy says exactly what the app does with data.
In short
- No account, no ads, no analytics, no tracking.
- Your debts, groups, bills, photos and payment details are stored on your phone, and in your own phone backups if you make them. We cannot see them.
- One thing leaves your phone: when the app needs an exchange rate, it asks our server for it (see below).
- Receipts are read on your phone. No photo is uploaded.
What stays on your phone
Everything you enter: names of people, amounts, descriptions, dates, groups and expenses, saved bills, reminders, your own name, your payment details (for example your IBAN or PayPal name) and the photos you attach. The records are kept in an encrypted database on your phone. Photos are kept as files in the app’s own folder; Deby does not encrypt them itself, your phone’s own protection applies to them. None of it is sent to us.
If you updated from an earlier version of Deby: that version kept the records without encryption, and a copy from before the update is still in the app’s private storage. It is not part of backups and goes when you delete the app. If the encrypted database cannot be set up on a phone, the app tells you and keeps working on that older storage.
What leaves your phone
Exchange rates. When a debt, a group or a bill is in a currency other than your default currency, the app asks our server for the rate. The request contains the two currency codes (for example USD and EUR) and nothing else: no amounts, no names, and no number that identifies your phone or your copy of the app.
Our server runs at Convex, Inc., a hosting provider based in the United States. It gets the rate from ExchangeRate-API, which receives only the currency code and nothing about you. To keep the service available, the server counts how many rate requests arrive per hour in total; that count says nothing about any phone. Our server code does not read or store your IP address or the technical details every request carries (app version, system version, language setting); the hosting provider processes them to deliver the request, as with any internet connection.
If everything you enter is in your default currency, nothing is sent at all.
What the app asks your phone for
- Camera and photos: to attach a photo to a debt, an expense or a bill, to give a person or a group a picture, and to read a receipt. The text of a receipt is recognised on your phone; on iPhones with Apple Intelligence, Apple’s on-device model may help to list the items. Nothing is uploaded.
- Contacts: only when you tap the contact button, to pick a person. The app keeps the name, the phone’s internal reference for that contact and, if there is one, the picture. Phone numbers and e-mail addresses are not kept. (An earlier version kept them for the contacts you picked; they can still be in the old copy mentioned above.)
- Face ID / Touch ID: only if you switch on the app lock. Your phone does the check and tells the app only whether it passed or not.
- Notifications: reminders are scheduled on your phone. No push service is used. A notification shows what it is about, also on the lock screen unless your phone is set to hide notification previews: a reminder shows the person’s name or the text you wrote; a repeating debt shows its description and amount; a repeating expense shows its description, its amount and the name of the group.
Backups and a new phone
If you back up your phone with iCloud or a computer, Apple includes Deby’s data in that backup, under your Apple settings. The database stays encrypted in the backup; photos are in it as ordinary files. The key of the database is kept in your phone’s keychain. If you use iCloud Keychain, an end-to-end encrypted copy of the key is kept there, which only your own devices can open, so that a new phone can open your data. We have no access to your backups or to the key.
When you share
You can send a summary, a PDF, a CSV file or a payment request through your phone’s share sheet. What you share and with whom is your decision. It goes through the app you choose (Messages, Mail, WhatsApp …) and is handled under that app’s rules. A payment request contains the payment details you entered, the amount and the name of the group; the code shown for banking apps holds the bank part of it: the name on the account, the IBAN and BIC, the amount and the name of the group.
Purchases, ads and analytics
The app is free. It has no purchases, no advertising, and no analytics or crash-reporting services. As for every app in the App Store, Apple shows us how many times Deby was downloaded, as numbers only: never who downloaded it. If you have chosen on your phone to share analytics with app developers, Apple may also show us anonymous figures for Deby: crashes, performance, and how often the app is opened or deleted. None of it contains what you entered. If you test Deby through TestFlight, Apple sends us your crash reports, usage information and any feedback you submit, with your name and e-mail address if you were invited by e-mail. If any of this ever changes, this policy will be updated first.
Children
Deby is not directed at children.
Your choices and rights
- You can change or delete any entry in the app at any time. Deleting the app deletes its data from your phone. The key of the database stays in your keychain (and in iCloud Keychain, if you use it); without the data it opens nothing. Backups made earlier still contain the data until they are replaced.
- You can refuse camera, photos, contacts, Face ID or notifications in your phone’s settings; the rest of the app keeps working.
- Under the GDPR and similar laws you may ask what data we hold about you, have it corrected or deleted, have its use restricted or object to it, and complain to your data-protection authority. The only data on our side is any e-mail you send us. Write to us and we will help as far as we can.
Changes
If the way the app handles data changes, we update this policy in the app and at and change the date above.
Contact
Questions about this policy or your data: .