Privacy
Last updated 4 September 2026 · BeAlpha Group Limited, company number 17391394
The short version. Your bills, transactions, balances, budgets and everything else you enter into DebitMate stay in a file on your own device. They are never uploaded, never backed up by us, and never seen by us — there is no server they could be sent to.
The app makes exactly one kind of network request: a licence check, roughly once a day. This page lists every field in it. Buying a licence and writing to support involve ordinary personal data — a name and an email address — which we hold in order to sell you software and answer you.
Contents
1. Who we are
DebitMate is made and sold by BeAlpha Group Limited, registered in England and Wales, company number 17391394, registered office 66 Paul Street, London, England, EC2A 4NA. For the personal data described on this page we are the data controller under the UK GDPR.
Contact us about anything on this page at privacy@debit-mate.com.
2. What the app stores, and where
Everything you enter into DebitMate — bills, imported transactions, categories, rules, budgets, accounts, balances, savings goals, split-expense groups and the names of the people in them — is written to a SQLite database file on the device you entered it on.
- Windows:
%USERPROFILE%\.debitmate\ - iPhone: inside the app's own sandboxed storage, which iOS keeps private to the app
That file is yours. You can copy it, open it with any SQLite tool, export it as CSV or JSON from inside the app, or delete it. Uninstalling DebitMate on Windows deliberately leaves the folder alone, so an accidental uninstall does not destroy your records.
We have no copy of that file and no way to obtain one. There is no sync, no cloud backup and no "recover my data" feature, because all three would require us to hold your finances on a server. If you lose the device without a backup of your own, the data is gone — that is the direct cost of the promise, and we would rather state it than quietly weaken the promise.
3. The licence check, field by field
When DebitMate has an internet connection it confirms its licence with debit-mate.com, at most once a day. This is the complete contents of that request:
| Field | What it is | Why |
|---|---|---|
licence | The licence key you were sent | To identify which licence is being checked |
device | A device fingerprint — a one-way hash, not a serial number | To count how many devices a licence is used on |
platform | windows or ios | To send back the right update information |
version | The version of the app, e.g. 2.0.0 | To tell you when an update is out |
hash | Windows only: a checksum of the app's own program files | To notice a copy that has been modified |
uuid, serial | Windows only: machine identifiers reported by Windows | To tell a replaced motherboard from a different computer, so that support questions can be answered honestly |
Our server additionally records, against that check-in, a salted hash of your IP address. We do not store the address itself. The hash exists so that one machine cannot flood our endpoints; it is not reversible and is not used to work out where you are.
What is not in the request, and has no way to get there: no bills, no transaction descriptions or amounts, no balances, no account names, no categories, no budgets, no savings goals, no names of people you split costs with, no file contents, no usage statistics, no crash reports, no advertising identifiers, and no name or email address.
You can watch this for yourself. The request is a single HTTPS POST to https://debit-mate.com/api/licence/check, and any network monitor will show you its entire contents.
If the check cannot be made — you are offline, or our server is down — nothing happens. The app carries on. It is never treated as a problem with your licence.
4. The website
This site sets no cookies and runs no analytics, no tag manager, no advertising pixels and no third-party scripts. See the cookies page, which is short for that reason.
The site is hosted on Vercel, which keeps ordinary server logs of requests made to it. Fonts are served by Google Fonts, which means your browser makes a request to fonts.googleapis.com and fonts.gstatic.com when a page loads; Google may log that request. No other outside service is contacted by any page here.
5. If you buy or write to us
Buying a licence or sending a support message means we hold ordinary personal data about you:
- Your name and email address, so we can send your licence key and reply to you.
- Billing details if you ask for an invoice — a name and an address, and a company name and VAT number if you give them.
- Your licence records — which licence you have, when it was issued, when it expires, and which devices have used it.
- Your messages to us, and our replies.
If you paste a licence key into the support form, only the licence number is stored, never the key itself — a support system holding working licences for every customer who ever wrote in is a liability we would rather not have.
We never hold your card details. Payments are handled by a payment provider; the card number never reaches us and is never stored by us.
6. Why we are allowed to hold it
| What | Lawful basis |
|---|---|
| Your name, email and licence records | Performance of a contract — we cannot sell you a licence or support it otherwise |
| Licence check-ins and device counts | Legitimate interests: confirming that software is licensed as agreed, balanced against the deliberate decision to collect nothing about your finances |
| Hashed IP addresses | Legitimate interests: keeping the service available and preventing abuse |
| Invoices and accounting records | Legal obligation — UK company and tax law |
| Support messages | Legitimate interests: answering you, and remembering what was said if you write again |
We do not send marketing email. There is no mailing list to be on.
7. How long we keep things
- Licence and customer records — while your licence is live, and for six years afterwards, which is how long UK accounting rules require the underlying records to be kept.
- Check-in records — 24 months, then deleted.
- Support messages — 24 months after the conversation ends.
- Hashed IP addresses — with the record they belong to, and never longer.
8. Who else sees it
We do not sell personal data, share it for advertising, or pass it to anyone for their own purposes. The only third parties involved are the ones that make the service work:
- Vercel — hosting for this website and its API.
- Supabase — the database holding customer and licence records.
- Our payment provider — handles card payments; we receive confirmation of payment, not card details.
- Our email provider — carries the messages between us.
Each acts on our instructions under a written agreement. Where any of them processes data outside the UK, that transfer is covered by the UK's approved safeguards.
We would disclose data if the law genuinely required it. We would tell you unless we were forbidden from doing so.
9. Your rights
Under UK GDPR you may ask us for a copy of what we hold about you, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable form. Write to privacy@debit-mate.com and we will respond within one month.
Two honest notes on that:
- Everything inside the app is already entirely in your hands. There is nothing for us to send you, because we do not have it — you can export it yourself at any time.
- Deleting your customer record means we can no longer prove which licence is yours, re-send a lost key, or free up a device for you. We will do it if you ask; we will say this first.
If you think we have handled your data badly, please tell us so we can put it right. You are also entitled to complain to the Information Commissioner's Office at ico.org.uk.
10. Changes
If this page changes in a way that affects what we collect or why, the date at the top changes and we will say what changed rather than quietly re-uploading it. A change that widened what the app sends would be described here before the version making the change was released.
← Back to DebitMate