Privacy Notice

1. What We Collect, and Why

Account information — your email address and sign-in records. You sign in using a magic link or a one-time code we email you, or with Google Sign-In. Source: you, Google if you choose Google Sign-In, and records generated when you use the Service. Purpose: signing you in, receipts, renewal reminders, security, and legal notices. Required to have an account.

Your plan data — the information you enter and calculations derived from those inputs, including creditor labels, balances, APRs, minimum payments, due days, payments, corrections, commitments, strategies, journey names, and projections. We use it to operate the planning features, store and display your plan, secure and troubleshoot the Service, and provide support when you ask. We do not use it for advertising, sell it for money, disclose it to advertising platforms, or use it for third-party profiling. Required for the Service to work.

Achievement cards — generated from your real progress. Shared only when you choose to share them.

Subscription and billing data — plan, status, trial dates, and transaction records. Payments are processed by Stripe; we never receive or store your full card number.

Technical and security data — our service providers and systems may record information such as IP address, browser and device type, operating system, timestamps, pages or application routes requested, session and authentication events, error and diagnostic records, and security logs. We use this information to deliver and secure the Service, diagnose problems, prevent abuse, and maintain reliable operations. We do not collect precise GPS location. Our providers may infer an approximate region from an IP address for security, routing, tax, or fraud-prevention purposes.

Consent state — your cookie/tracking choice, stored on your device (see the Cookie & Tracking Notice).

Audience measurement — how the Service is used: the pages you open (host and path only, never the query string), the referring website's domain, campaign tags in the link you followed (only values we registered ourselves; any other value is recorded as "other"), and standard browser details such as browser, operating system, device type, screen size, language and time zone. Source: your browser. Purpose: to count visits and understand which pages and referral sources are used. Processed by PostHog. It never includes your plan data, your email address or your account. If you Allow, an identifier is stored on your device; if you decline, or your browser sends a Global Privacy Control signal, counting continues without an ID, with no PostHog identifier stored on your device.

Advertising measurement (TikTok) — only if you choose Allow, and never while your browser sends a Global Privacy Control signal, our server may report one of two things to TikTok (TikTok for Business) through TikTok's Events API: that you created an account ("CompleteRegistration") or that your free trial started ("StartTrial"). No TikTok code runs on our website or in the app, and our site sets no TikTok cookies. Our site asks our server to report a new account only from the browser you signed up in, only if you had chosen Allow there before your account was confirmed (as timed by that browser's clock) and Allow is still in effect when it asks, and only within 24 hours of your email being confirmed; it asks to report a free trial only from a browser with Allow in effect when you return from checkout, within 48 hours of the trial starting. Each is reported at most once — once per account and once per subscription — however many browsers or devices you use. Each report contains only: the event's name; the time it was sent; a random event number (so TikTok can recognise a duplicate); TikTok's click identifier ("ttclid"), only if one is stored on that device (see Campaign attribution); and a fixed page address, https://dangpayoff.com/app.html — never your IP address, your browser's details, the address of the page you were on, the referring page, a query string or a fragment. We send TikTok no email address, phone number, name, plan data (debts, balances, APRs, payments), account or payment identifiers, prices or plan details, and no hashed identifiers (we do not use TikTok's Advanced Matching). A report already sent is not recalled if you later choose Decline. TikTok handles what it receives under its own privacy policy. Purpose: to measure whether our TikTok ads lead to account sign-ups and free trials. See the Cookie & Tracking Notice for what is stored on your device.

Campaign attribution — if you arrive from one of our registered TikTok ad links and choose Allow, we store that campaign's name (source, medium and campaign — only values we defined ourselves, never the link itself) on your device for up to 30 days. If the link carries TikTok's click identifier ("ttclid") and it consists only of letters, digits, dots, dashes and underscores, we keep it on your device for the same 30 days and send it only to TikTok, inside the reports described above; it is never saved with your account. If you then create an account, we save the campaign tag (not the click identifier) with your account so we can count how many sign-ups and trials came from each campaign. If you decline, or your browser sends a Global Privacy Control signal, no campaign tag or click identifier is stored on your device and none is saved to your account.

Support communications — if you email us, we keep the thread to help you.

The planning features do not connect to your bank, import bank transactions, or retrieve credit reports. Stripe separately processes the payment information you provide at checkout. You type in what you choose to type in.

2. What We Never Do

• We do not sell personal information for money.
• We do not disclose your debt-plan content — creditor names, balances, APRs, due dates, payments, strategies, projections — to advertising platforms.
• We do not use your plan data to train AI models.
• We do not run advertising pixels or any other advertising code on our website or in the app. The only advertising technology we use is the TikTok reporting from our server described in section 1, and it applies only if you choose Allow. If we add any other advertising technology, we will update this notice and the Cookie & Tracking Notice BEFORE it activates, and it will apply only with the consent controls described there.

3. Service Providers

We use service providers to operate the Service. They receive the information needed for their functions and handle it under applicable contracts and law. Our current providers include Supabase (database and authentication hosting), Vercel (web hosting), Resend (email delivery), Upstash/QStash (background jobs), Google (our support, legal, and privacy email service; optional Google Sign-In; and Google profile-image delivery), jsDelivr (delivery of browser software libraries), PostHog (audience measurement — see the Cookie & Tracking Notice), and TikTok (advertising measurement reports sent from our server, only if you choose Allow — see section 1 and the Cookie & Tracking Notice). Stripe processes payments. Stripe may also process payment information for fraud prevention, disputes, compliance, and its own legal obligations, as described in Stripe's privacy notice.

We may also disclose information when required by law, to protect users, the Service, or legal rights, or as part of a merger, financing, acquisition, reorganization, or asset sale, subject to applicable confidentiality and notice requirements.

4. Retention

Plan data. Kept while your account is active.

Deleting your account. When you request deletion, we schedule it to complete seven days later and you can cancel the request at any point during those seven days. This waiting period exists only to protect you from an accidental or regretted deletion; it is unrelated to how long backups are kept. When the seven days elapse and the deletion runs, your account and plan data are removed from active production systems. If a TikTok "CompleteRegistration" was reported for your account, our server keeps a record of that (your account's ID and the time, nothing else) so it is never reported twice; the deletion also deletes that record. If a "StartTrial" was reported, a note of it (the subscription's reference and the trial's start time) is kept on your customer record at our payment provider, Stripe, and is retained with your billing records (see below).

Backups. Backups are a separate mechanism. After deletion completes, limited copies of your data may still exist in routine backups until those backups are overwritten on our providers' normal cycle — currently a rolling seven-day window on our database provider's plan. Provider backup schedules and configurations can change. Backups are used for service recovery, not to fulfill requests to restore an individually deleted account.

Technical, security, and authentication records. Kept according to our providers' log-retention schedules, and otherwise as reasonably necessary to secure, operate, and troubleshoot the Service.

Support communications. Kept as long as reasonably necessary to respond to you, maintain appropriate records of the issue, and meet legal obligations.

Billing, tax, fraud-prevention, legal, and assent records. Kept for up to 7 years as required for accounting, tax, payment, dispute, enforcement, and legal purposes.

Legal holds. We may retain limited information longer when required by law or reasonably necessary to establish, exercise, or defend legal claims.

5. Your Controls (available to everyone, regardless of where you live)

• Export your data anytime (Account → Privacy & data → Export).
• Correct anything by editing it in the app.
• Delete your account and data (Account → Privacy & data → Delete).
• Cookie/tracking choice — change anytime ("Your Privacy Choices" in the site footer, or "Cookie settings" in the app). Choosing Decline removes, from that device, any stored campaign tag and TikTok click identifier, and that browser stops asking our server to report anything to TikTok; a report already sent is not recalled. It does not remove a campaign tag already saved with your account; to have that removed, email privacy@dangpayoff.com.
• Email choices — transactional email (receipts, sign-in links, legal notices) comes with the Service; marketing email, if we ever send it, will be separate opt-in with a working unsubscribe honored within 10 business days.

Depending on your state of residence, you may have additional legal rights (access, correction, deletion, portability, opt-outs). To exercise any right or ask questions: privacy@dangpayoff.com. We respond within the time applicable law requires (and aim for 45 days regardless).

Global Privacy Control. If your browser sends a Global Privacy Control (GPC) signal, we treat it as an opt-out of the sale or sharing of personal information and targeted advertising. We do not use advertising trackers or persistent analytics identifiers on your device. We may continue limited cookieless audience measurement to count visits and understand which pages and referral sources are used. Cookieless measurement does not store PostHog identifiers in cookies, local storage, or session storage on your device and is not used for targeted advertising.

If you decline analytics cookies, we do not use persistent or identified analytics. We may continue limited cookieless audience measurement to count visits and understand site usage without storing PostHog identifiers on your device.

6. Security

We use administrative, technical, and organizational safeguards designed to protect personal information. These include encrypted connections, encryption at rest for our database provider's stored data, access restrictions, and controlled write paths for sensitive records. No system can be guaranteed completely secure.

If a security incident triggers a legal notification obligation, we will provide notices as applicable law requires. For Florida residents, Florida law generally requires notice no later than 30 days after determining that a qualifying breach occurred, subject to statutory investigation, law-enforcement-delay, and harm-assessment provisions.

7. Children

The Service is for adults 18+. We do not knowingly collect information from anyone under 18; if we learn we have, we will delete it and close the account.

8. United States Only

The Service is intended for U.S. residents and is operated from the United States.

9. Changes

We'll update this notice as the Service evolves and give notice of material changes before they take effect.

10. Contact

Dang Apps LLC · privacy@dangpayoff.com · 3206 NE 2nd Ave, Suite 3028, Miami, FL 33137