Privacy Policy

• We store only what is needed to run a loan agreement between you and your friend.
• We never see or touch your bank details — PayFriends does not move money.
• Agreement data is visible only to the two people in that agreement.
• We do not sell data, run ads or use tracking for advertising.

• Account — your name and email address, used to sign you in and to contact you about your agreements.
• Agreements — amounts, repayment schedules, notes and the other party's name and email, as entered by you or the other party.
• Payments — the amounts and dates you or the other party log, and their status (reported, confirmed, rejected).
• Assistant input — text you type to the loan-setup assistant and documents you upload for it to read. Uploads are stored in a private bucket that only you and our servers can access.
• Technical data — server logs (IP address, browser, time of request) kept briefly for security and debugging, and a session cookie that keeps you signed in.

We do not collect payment card numbers, bank account numbers or government IDs.

• to run the service: show agreements, calculate balances, and record payments;
• to send transactional email: sign-in links, invitations, payment confirmations and repayment reminders;
• to help you draft an agreement when you use the assistant;
• to keep the service secure, prevent abuse and fix problems.

Legal bases (GDPR): performance of the service you asked for, our legitimate interest in keeping it secure, and your consent where we ask for it.

• The other party in an agreement sees the agreement, its schedule and its payments — that is the point of PayFriends.
• Service providers that process data on our behalf: Supabase (database and authentication, hosted in London, UK), Vercel (hosting), Resend (email delivery) and Anthropic (the model behind the loan-setup assistant, which receives only the text and documents you give it — never your other agreements or users).
• Authorities when the law requires it.

We never sell personal data and do not share it with advertisers.

Agreements and payment records are kept while either party has an account, because both sides rely on the same shared record. Server logs are kept for a short period. Text you give the assistant is used only to create your draft and is not used to train AI models; uploaded documents stay in your private storage until you or we delete them. When you ask us to delete your account we remove your profile and personal details; records that the other party still needs are kept in anonymised or minimal form.

All traffic is encrypted in transit. Access to the database is restricted with row-level security so that a user can only read the agreements they are part of. Sign-in is passwordless — there are no passwords to leak — and sign-in links are single-use and expire quickly.

You can access, correct, export or delete your personal data, object to or restrict processing, and withdraw consent at any time. Send a request via the contact form and we will respond within 30 days. If you are in the EU/EEA you can also complain to your local data-protection authority.

PayFriends uses only strictly necessary cookies: the authentication session that keeps you signed in. We do not use advertising or third-party tracking cookies.

We will update this page when our practices change and show the date at the top. For material changes we will notify you by email or in the app.

Privacy questions? Use the contact form.