1. Who we are
DebitMate is made by BeAlpha Group Limited, registered in England and Wales, company number 17391394, registered office 66 Paul Street, London, England, EC2A 4NA. For the personal data described on this page we are the data controller under the UK GDPR.
Contact us about anything on this page at info@debit-mate.com.
2. What the apps store, and where
Everything you enter into DebitMate — bills and payments, what you spend, categories and limits, contracts and the details of who to contact — is written to a database on the device you entered it on.
- iPhone: inside the app's own private storage, which iOS keeps to the app alone. That includes your payments, spending, limits, notes, contact details and reference numbers, and any contracts or letters you keep in the app. Like the data of every app, it is included in your own iPhone backup if you have iCloud Backup or computer backups switched on; that backup belongs to your Apple account, and we cannot see into it.
- Windows:
%USERPROFILE%\.debitmate\
We have no copy of your figures and no way to obtain one. There is no sync, no cloud backup and no “recover my data” feature, because all three would require us to hold your finances on a server. If you lose the device and have no backup of your own, the data is gone — that is the direct cost of the promise, and we would rather state it than quietly weaken the promise.
Uninstalling DebitMate on Windows deliberately leaves the folder alone, so an accidental uninstall does not destroy your records. Deleting the iPhone app deletes its data with it.
3. The Windows licence check, field by field
This section is about the Windows app only. The iPhone app makes no network requests of its own — see section 4.
When DebitMate for Windows has an internet connection it confirms its licence with debit-mate.com, at most once a day. This is the complete contents of that request:
| Field | What it is | Why |
|---|---|---|
licence | The licence key you were sent | To identify which licence is being checked |
device | A device fingerprint — a one-way hash, not a serial number | To count how many computers a licence is used on |
platform | Always windows | To send back the right update information |
version | The version of the app, e.g. 2.0.0 | To tell you when an update is out |
hash | A checksum of the app's own program files | To notice a copy that has been modified |
uuid, serial | Machine identifiers reported by Windows | To tell a replaced motherboard from a different computer, so that support questions can be answered honestly |
Our server additionally records, against that check-in, a salted hash of your IP address. We do not store the address itself. The hash exists so that one machine cannot flood our endpoints; it is not reversible and is not used to work out where you are.
What is not in the request, and has no way to get there: no bills, no transaction descriptions or amounts, no balances, no account names, no categories, no budgets, no savings goals, no names of people you split costs with, no file contents, no usage statistics, no crash reports, no advertising identifiers, and no name or email address.
You can watch this for yourself. The request is a single HTTPS POST to https://debit-mate.com/api/licence/check, and any network monitor will show you its entire contents.
If the check cannot be made — you are offline, or our server is down — nothing happens. The app carries on. It is never treated as a problem with your licence.
4. The iPhone app, its subscription and your calendar
The iPhone app makes no network requests of its own. It has no licence check, no analytics, no tracking, no advertising and no crash reporting, and it contains no third-party code that does any of those. The licence check in section 3 applies to the Windows app only.
Its only connection is to Apple, through Apple's own purchase system, to sell and check your subscription. There is no account, no sign-in, and no server or cloud backup run by us.
When it goes online
Only for your subscription, and only to Apple. Links in the app to this website — this privacy policy, and support — open in your web browser, not in the app.
Your subscription
The iPhone app is a subscription — 1 week free, then £2.99 a month, renewing automatically — sold and billed by Apple through the App Store. When you subscribe, you are dealing with Apple: iOS handles the purchase, and Apple takes the payment under its own privacy policy. We never receive your card details, your name, your email address or your Apple ID. Apple tells us only what it tells every developer — anonymous totals of sales — which do not identify you.
You can cancel at any time in your iPhone's Settings: tap your name, then Subscriptions.
Contracts and letters
You can keep contracts and letters, as PDFs or photos, in the app. A file you choose is copied into the app's private storage on your iPhone.
When you ask the app to read a contract for you, it uses Apple's own PDFKit and Vision text recognition, which run on your iPhone. No document is uploaded anywhere. The app suggests the amount and dates; nothing is added until you confirm it.
You choose files with the iPhone's standard file picker, so the app never asks for access to your photo library.
Putting your payments in your calendar
In Settings you can choose Add my payments to my calendar. It is off unless you turn it on, and the app asks for calendar access only when you do.
If you turn it on, the app adds one event for each payment to a calendar you choose — either a new calendar called “DebitMate”, or one already on your iPhone. Each event contains the payment's name, amount and due date, how it is paid, any reference number you entered, and a reminder.
The app asks for full calendar access, because it has to change or remove the events it added when you change or delete a payment, and iOS's “add events only” access does not allow that. It uses that access for two things only: to list your calendars so you can choose one, and to add, update and remove the events DebitMate created. It does not read, change or delete any other event in your calendar.
Where the events go after that depends on the calendar you chose. If it belongs to an account such as iCloud, Google or Microsoft Outlook, your iPhone syncs those events to that provider under your own account, and that provider's privacy policy applies to them there. DebitMate itself sends nothing to any of them, or to us.
Turning the feature off, or using Delete everything in the app, removes the events DebitMate added — and the “DebitMate” calendar, if the app created it. You can withdraw calendar access at any time in your iPhone's Settings → Apps → DebitMate → Calendars.
Permissions the app can ask for
- Calendars — only if you turn on the calendar feature.
- Nothing else. No location, contacts, camera, microphone or photo library. The app does not ask to track you across other apps, and does not use the advertising identifier.
Deleting your data
Delete everything, in the app's Settings, removes every payment, all spending, every limit and every stored contract from your iPhone, and takes DebitMate's events out of your calendar. Deleting the app removes everything stored inside it.
What we collect from it
Stated the way the App Store asks it: we collect no data from the iPhone app. Its App Store privacy label reads Data Not Collected, and that describes what the app is built to do, not a policy we could quietly change. The calendar feature does not change that: the events go from the app into your own calendar on your iPhone, and nothing is sent to us.
There is nothing of yours for us to delete on request, because none of it ever reached us.
5. This website
This site runs no analytics, no tag manager, no advertising and no third-party scripts, and its fonts are served from this site rather than from Google. See the cookies page.
If you choose light or dark with the switch at the top of the page, that choice is kept in your own browser so the site remembers it. It is never sent to us.
The site is hosted by Vercel, which keeps ordinary server logs of requests made to it.
6. If you buy a Windows licence or write to us
Buying a Windows licence or sending a support message means we hold ordinary personal data about you. (An iPhone subscription does not: that is bought from Apple — see section 4.)
- Your name and email address, so we can send your licence key and reply to you.
- Billing details if you ask for an invoice — a name and an address, and a company name and VAT number if you give them.
- Your Windows licence records — which licence you have, when it was issued, when it expires, and which computers have used it.
- Your messages to us, and our replies.
We never hold your card details. Windows licence payments are handled by a payment provider; the card number never reaches us and is never stored by us.
7. Why we are allowed to hold it
| What | Lawful basis |
|---|---|
| Your name, email and Windows licence records | Performance of a contract — we cannot sell you a licence or support it otherwise |
| Windows licence check-ins and computer counts | Legitimate interests: confirming that software is licensed as agreed, balanced against the deliberate decision to collect nothing about your finances |
| Hashed IP addresses | Legitimate interests: keeping the service available and preventing abuse |
| Invoices and accounting records | Legal obligation — UK company and tax law |
| Support messages | Legitimate interests: answering you, and remembering what was said if you write again |
We do not send marketing email. There is no mailing list to be on.
8. How long we keep things
- Licence and customer records — while your licence is live, and for six years afterwards, which is how long UK accounting rules require the underlying records to be kept.
- Check-in records — 24 months, then deleted.
- Support messages — 24 months after the conversation ends.
- Hashed IP addresses — with the record they belong to, and never longer.
9. Who else sees it
We do not sell personal data, share it for advertising, or pass it to anyone for their own purposes. The only third parties involved are the ones that make the service work:
- Vercel — hosting for this website and its API.
- Supabase — the database holding Windows customer and licence records.
- Our payment provider — handles Windows licence payments; we receive confirmation of payment, not card details.
- Our email provider — carries the messages between us.
Each acts on our instructions under a written agreement. Where any of them processes data outside the UK, that transfer is covered by the UK's approved safeguards.
Apple is not on that list because it is not acting for us: when you subscribe on iPhone, Apple is the seller, and it handles your payment details under its own privacy policy.
Nor are calendar providers such as iCloud, Google or Microsoft. If you put your payments in a calendar that belongs to one of those accounts, your iPhone syncs the events to it under your own account — we send them nothing (see section 4).
We would disclose data if the law genuinely required it. We would tell you unless we were forbidden from doing so.
10. Your rights
Under UK GDPR you may ask us for a copy of what we hold about you, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable form. Write to info@debit-mate.com and we will respond within one month.
Two honest notes on that:
- Everything inside the apps is already entirely in your hands. There is nothing for us to send you, because we do not have it. On Windows you can export it yourself at any time. On iPhone, Delete everything in the app's Settings removes all of it, including DebitMate's calendar events.
- Deleting your customer record means we can no longer prove which Windows licence is yours, re-send a lost key, or free up a computer for you. We will do it if you ask; we will say this first.
If you think we have handled your data badly, please tell us so we can put it right. You are also entitled to complain to the Information Commissioner's Office at ico.org.uk.
11. Changes
If this page changes in a way that affects what we collect or why, the date at the top changes and we will say what changed rather than quietly re-uploading it. A change that widened what either app sends would be described here before the version making the change was released.
16 October 2026 — section 4 now describes the iPhone app's optional calendar feature, which is off unless you turn it on, and the one permission it can ask for. It also states plainly that the app's only connection is Apple's purchase system, how contracts are read on your iPhone, and how to delete everything. Nothing the app sends to us has changed: it still sends nothing.