Privacy Policy

Personal information you disclose to us. We collect personal information that you voluntarily provide when you register for or use PayoffPilot, including:

• Email address
• Password
• Contact or authentication data
• Self-reported financial account information — card nickname, issuer, balances, credit limit, and due dates. This is manually entered by you and is not linked to any real bank account or card number; PayoffPilot never connects to your bank and never collects actual card, debit, or bank account numbers.
• Timezone preference, used to schedule payment reminder notifications

We do not process sensitive information (e.g. health, race, religion, biometric data).

Social login data. If you register using Google Sign-In, we receive certain profile information from Google, as described below.

Information automatically collected. When you use PayoffPilot, we automatically collect log and usage data — IP address, browser and device characteristics, operating system, and information about how you interact with the app — needed to operate and secure the service and for internal analytics.

Google API. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We process your personal information to:

• Facilitate account creation, authentication, and account management
• Deliver and facilitate the PayoffPilot service itself
• Respond to your inquiries and offer support
• Send administrative information, such as changes to our terms or policies
• Protect the service, including fraud monitoring and prevention
• Evaluate and improve the service and identify usage trends

We only process your personal information when we have a valid legal reason to do so — such as your consent, to fulfill our contractual obligations to you, to protect your rights, or to comply with applicable law. You may withdraw consent at any time by contacting us.

We share information with third-party vendors and service providers who perform services on our behalf, under contracts that restrict their use of your data to only what we instruct:

• Google — for Google Sign-In (Allow Users to Connect to Their Third-Party Accounts)
• Render, Vercel, and Neon — cloud computing, hosting, and database services
• New Relic — website/application performance monitoring
• Resend — transactional email delivery

We do not sell or share your personal information for advertising purposes, and we do not use it for targeted advertising. We may also share information in connection with a merger, sale of assets, financing, or acquisition of our business.

PayoffPilot uses a single essential session cookie to keep you signed in. We do not use analytics or advertising cookies, and we do not permit third parties to place tracking technologies on the app for advertising purposes.

If you register using Google, we receive certain profile information (such as your name and email address) from Google. We use this only for the purposes described in this notice. We do not control, and are not responsible for, Google's own use of your information — see Google's privacy policy for that.

We keep your personal information for as long as you have an account with PayoffPilot. If you delete your account, we permanently delete your account and all data it owns — cards, payments, reminders, and history — rather than retaining it. This is a deliberate exception to our general practice of never destroying user-entered financial data, since closing your account is understood to mean the data is actually gone.

We use reasonable technical and organizational security measures to protect your personal information, including encrypted connections and hashed passwords. However, no method of transmission or storage over the internet is 100% secure, and we cannot guarantee absolute security.

PayoffPilot is not directed at, and we do not knowingly collect personal information from, children under 18. If you believe a child has provided us with personal information, please contact us and we will delete it.

Depending on your province of residence, Canadian privacy law (including PIPEDA and Quebec's Law 25) may give you the right to access, correct, or request deletion of your personal information, and to withdraw consent to its processing. You can exercise most of these rights yourself, at any time:

• Log in to your account settings to review or update your information
• Delete your account and all associated data at any time from your account settings
• Contact us at falifirenko@proton.me for anything else

We do not currently respond to Do-Not-Track browser signals, as no uniform standard for these signals has been adopted.

We may update this Privacy Notice from time to time. The “Last updated” date at the top will reflect the most recent revision. Material changes will be announced prominently in the app.

Questions or comments about this notice can be sent to falifirenko@proton.me.