privacy policy.
Debts collects only the information needed to maintain a shared debt record between people who choose to use the app. Debts contains no advertising or cross-app tracking.
Who is responsible
Verbeet UG (haftungsbeschränkt), Bismarckstrasse 116, 20253 Hamburg, Germany, is the controller responsible for Debts. The company is represented by managing director Markus Verbeet. Contact: hello@verbeet.com. Additional company information is available in the imprint.
Information we process
- Account identifiers, email address, display name, and username.
- Debt claims, amounts, currencies, optional notes, decisions, payment acknowledgements, and timestamps.
- An IBAN when you choose to save one, plus your choices about individual access and automatic approval.
- Authentication, security, and network information needed to operate and protect the service.
- A limited balance snapshot stored on your device for the Home Screen widget, and a per-installation credential allowing the widget to retrieve that snapshot in the background. The server stores a hash of this credential.
- Notification tokens and installation identifiers when notifications are enabled.
- Blocking choices and reports, including the reporter, reported person, reason, timestamps, and a reference to the reported profile or debt content. Legacy version 1.0 reports can also contain a content snapshot.
Why we process it
We process this information to create your account, show shared balances, let participants accept or decline claims and payment acknowledgements, provide optional repayment details, prevent abuse, secure the service, and respond to support requests. For users in the EEA, the principal legal bases are performance of the service you request, our legitimate interests in operating and securing it, and consent where the app asks for an optional choice.
Sharing
Information is shared only as the product requires. Your username is visible to other signed-in BAM users; your full recipient name is stored separately from the public profile and is not shown in search results or debt rows. Claim and payment information is visible to the people involved. Your full recipient name and IBAN stay private by default. You can approve an intended payer individually or turn on public access in the app. Public access automatically approves repayment-detail requests only from signed-in people with a valid debt balance to repay; it does not publish your name or IBAN on the open web. Turning public access off stops automatic approval of future requests, and existing access can be revoked individually.
From version 1.1, Google Firebase provides account authentication, the Firestore database and realtime updates, server functions, Cloud Messaging notifications, and Remote Config for the BAM app directory. These services process the connection and security information needed to operate them. Apple provides Sign in with Apple, push delivery and App Store distribution. Firebase authentication and the BAM profile are shared with other BAM apps using the same account. Debts contains no advertising, analytics SDK or cross-app tracking, and we do not sell personal information. Version 1.0 and its legacy records use a separate Supabase backend.
Storage and retention
The version 1.1 Firestore database is located in Frankfurt, Germany. This location does not mean that all Firebase services process data only in that region. Legacy Supabase service data is held in the configured European Union project. We retain account and debt records while the account is active and as needed to preserve an agreed shared record, resolve disputes, secure the service, or comply with law.
Deleting your BAM account removes the shared Firebase authentication identity and private account details, revokes device and widget access, and anonymizes retained shared debt records. It also affects other BAM apps using that Firebase account, including Reminders. A username reservation and deleted-identity marker are retained to prevent impersonation. Data already cached on another device may remain until that device reconnects. Firebase account deletion does not automatically remove legacy records from the separate Supabase backend; contact hello@verbeet.com for legacy-data requests. Limited report evidence may remain where necessary to investigate abuse, protect users, resolve disputes, or comply with law; it is reviewed and removed when no longer needed.
Safety and moderation
A server-side text filter checks usernames, names, and debt notes before publication. Rejected text is not saved as a report. You can report content or block another person. Reports and their evidence are available only to authorized administrators for investigation, not to other users. Blocking prevents new debt interactions and hides that person's text without erasing existing balances. You can undo your own block in Profile. We process this information to protect users and investigate abuse, based on our legitimate interests in maintaining a safe service. Contact hello@verbeet.com with moderation or privacy concerns.
Your choices and rights
You can decline unrecognized claims, choose private or public repayment-detail access, revoke another person's access to your full name and IBAN, sign out, and delete your BAM account. Depending on where you live, you may also have rights to access, correct, export, restrict, object to, or erase personal information. Contact hello@verbeet.com to exercise a right or ask a privacy question.
Children
Debts is not directed to children. Do not use the app if you are below the minimum age required to consent to this service in your country.
Changes
We may update this policy when the service or law changes. Material changes will be reflected here with a new effective date.