Privacy policy

In short

Debix doesn’t move money or lend it. It only keeps the records you write down. Debix doesn’t need your bank card.
Your address book is never uploaded. Contacts are read on your phone; only the name and number or email of someone you add, or whose debt you accept, goes to the server.
Your partners see shared records. Entries in a shared debt or a group are kept on their side too.
The app has no ads. We use Google Firebase statistics and crash reports to improve it.
You can delete your account at any time. Your own data is deleted from our server; your name and shared records stay with your partners.
Questions? Write to us. support@debix.uz, we reply within 30 days.

Who we are

The Debix app and the debix.uz website are built and run by Alif Service. “We” in this policy means Alif Service. We are responsible for the data you put into Debix.

Name: Alif Service
Email: support@debix.uz

This policy covers the Debix app for Android and this website. The rules for using the app are in the Terms of use.

What data we collect

Below is all the data the app collects. Most of it is needed for the app to work; statistics and crash reports help us improve it. Why we need each kind of data is explained in section 4.

Your account

If you sign in with Google: your name and email address. Google Firebase Authentication checks the sign-in; we ask for no other permissions on your Google account.
If you sign in with Telegram: you tap “Send my number” in the @DebixUz_Bot bot. When you open the bot, we receive your Telegram ID and name; when you tap the button, we receive your phone number. Your Telegram username also reaches the bot, but we don’t store it. If you already have a Debix account with this Telegram account or this number, you’re signed in to that account.
You don’t create a separate password for Debix.

Phone number and contact email (optional)

You can verify your number through the Telegram bot so friends can send you debts by phone number. Once it’s verified, pending debt requests and group invites sent to that number reach you. If the number was verified on another Debix account, it’s removed from that account. You can also add a contact email; it’s confirmed with a code we email to you.

If your number is registered with Debix, another user who knows it can see that it’s on Debix when sharing a debt.

Debts, groups and entries

Everything you enter: debts, entries, amounts and currency, dates and due dates, notes, folders, payment requests; groups with their names, members, expenses, shares and payments; and the list of users you’ve blocked.

Reminders are stored on the server so they can be delivered on time: reminders you set on a debt (date and time, repeat, note and your time zone) and reminders you send to your partner on a shared debt or in a group (who sent it and when, plus an optional note). In the app, only you see your own reminders, and a reminder sent to a partner is seen by you and that partner. When you delete your account, your own reminders and the reminders on shared debts are deleted from the server, and reminders you sent in a group lose their note. A notification your partner has already received may stay in their app.

Photos

Your profile photo, contact and folder photos, photos attached to an entry or a group expense (up to 5 each), and screenshots you send to the support chat. You pick photos in Android’s photo picker or take them with your camera app. Debix can’t see the rest of your gallery and doesn’t ask for camera permission.

Before uploading, the app resizes and re-compresses each photo, which removes metadata such as location. If a photo can’t be processed, it’s uploaded as is, metadata included. The file name is sent too. An uploaded photo opens through a long link that can’t be guessed: anyone who has the link can view it without signing in.

People you add

When you add someone to a debt, their name and phone number (if you enter one), and when you add them to a group, their name and phone number or email, are stored on the server as part of your records, even if they don’t use Debix. If you add someone to a group by email, we send them an invite with your name in the group, the group name and an invite code. Please only add people who won’t mind.

Phone contacts

Debix asks for contacts access only after showing its own explanation. If you allow it, the app reads names, numbers, emails and contact photos on your phone to show a quick picker. Your address book is never uploaded or stored. If you don’t allow access, you type the name and number yourself.

Only the name and one number or email of the person you pick go to the server.
We match group members’ numbers against your contacts on your phone only, so they appear with names and photos you recognise.
When you accept a shared debt, the name you saved for that partner in your contacts may be sent to the server, and the debt then shows under that name for you.

Support chat

Messages and screenshots you send through “Contact support” in the app, and anything you email us.

Device and technical data

A device token for notifications (Firebase Cloud Messaging), platform and app language; your last sign-in and last activity time; and the days you used the app, for statistics.
Each request carries the app language, your time zone, the app ID and the app version.
Your IP address is visible when you connect. The server uses it to limit the number of requests and doesn’t record it on your account.
If you installed the app from an invite link, it gets the invite code from Google Play and connects you to that group or debt.
QR codes are scanned on your phone by Google Play services.

Premium purchases

Premium isn’t on sale yet, so no payment data is collected. Once it launches, it will work like this. Google Play takes the payment for Premium, so we never see your card details. To confirm your subscription, the app sends the purchase token and the chosen plan to our server. Google Play receives a code derived from your account ID, so the purchase is tied to your account. We keep a history of your Premium periods.

Statistics and crash reports

The app uses Google Analytics for Firebase and Firebase Crashlytics. Both are on by default, and there is no switch in the app to turn them off yet.

Analytics: which sections you open and when you switch theme. Firebase also records app opens and sessions, device model, Android version, language and an approximate region based on IP. Firebase also receives the app installation ID. The Android advertising ID is not collected.
Crashlytics: when the app crashes, the error details, device model, and Android and app versions.
We don’t send them your name, phone number, account ID or debts.

Why we use your data

To create your account and verify your sign-in.
To store your debt and group records and sync them across your phones.
To share records with the people you choose and send invites.
To notify you when a partner adds an entry or sends a request.
To confirm your Premium subscription (once Premium launches).
To answer your support requests.
To protect accounts from abuse with rate limits, confirmation codes and blocks.
To fix bugs and improve the app using overall statistics.
To meet legal requirements.

We don’t use your data to show ads. There are no ads in Debix.

Legal basis and consent

We process your data under the Law of the Republic of Uzbekistan “On Personal Data”. By signing up and using Debix, you consent to the processing described in this policy. Android asks for separate permission for contacts and notifications, and you can withdraw it at any time in your phone settings. We process some data because we need it to provide the service, to keep it secure, or because the law requires it.

Your partners

When you share a debt, your partner sees the entries, amounts, notes and photos for that debt. Group members see your name in the group, expenses, shares, payments and attached photos. In notifications, your partner sees your name, the group name, the amount and the note.

Service providers

These companies process data on our behalf so the app can work:

Service	What for	What data
Google: Sign-In and Firebase Authentication	Signing in with Google	Name, email, Google account ID
Google: Firebase Cloud Messaging	Notifications	Device token and notification text: names, group name, amount, note
Google: Firebase Crashlytics	Crash reports	Error details, device model, versions
Google: Analytics for Firebase	Usage statistics	In-app actions, installation ID
Google Play	Premium payments (once launched)	Purchase, plan, code derived from your account ID
Telegram	Bot sign-in, phone verification, confirming account deletion	Telegram ID, name, phone number
Google (Gmail)	Codes and invite emails	Email address, message text
Sarkor Telecom	Server, database and photos	All data on the server

Our team

Our support staff may view your account and records to handle your request or look into abuse. Access is limited by each staff member’s role.

We may disclose data to authorised public authorities where and as the law requires.

Where your data is stored

Your account, records and photos are stored on our hosting provider’s server (Uzbekistan). Data that passes through Firebase and Google Play is processed by Google on its servers, including outside Uzbekistan; data that passes through Telegram is processed by Telegram.

A copy of your records is also kept on your phone so the app is fast and works offline. See section 12.

How long we keep your data

Your account and records: until you delete your account.
Debts you delete, with their entries, and photos you delete are fully erased from the server after 30 days. During that time the deletion also reaches your other phones.
Expenses and payments deleted from a group currently stay on the server as part of the group’s shared record.
Photos uploaded but never attached to a record: 7 days.
History of email and SMS codes sent: 30 days.
Telegram sign-in attempts (Telegram ID, name, phone): the sign-in link works for 10 minutes, and the data is kept for 1 more day. Phone verification attempts: 2 days.
Statistics and crash reports aren’t linked to your account; Google keeps them for the period set in our Firebase settings.
Server logs (they include your account ID): 14 days.
Server backups: 30 days; deleted data also disappears from backups within that time.

Your rights

Access. Most of your data is visible in the app. If you need a full copy, write to us.
Correction. You can change your name, number, email and records in the app.
Deletion. You can delete single records or your whole account in the app. See section 10.
Withdrawing consent. You can turn off contacts and notifications access in your phone settings.
Complaints. You can contact the authorised public body for personal data.

Send requests to support@debix.uz and we’ll reply within 30 days. We may ask you to confirm the account is yours.

Deleting your account

You can delete your account in the Debix app (developer: Alif Service) at any time. In the app: Settings → your profile → Delete account. If you signed in with Google, we email you a confirmation code (valid for 10 minutes); if you signed in with Telegram, you confirm the deletion in the bot. If you can’t sign in to the app, email support@debix.uz with the email address or phone number linked to your account. We’ll check that the account is yours and reply within 30 days. More details: Delete account.

Deleted from our server at once

Your profile: name, email, phone number, Telegram ID, profile photo
Your debts, entries, folders and contact cards
Photos you uploaded, including the files on disk (except those your partners see)
Support chat, notifications, devices, codes and sign-in sessions
Your Google sign-in record (Firebase Authentication)

Stays with your partners

Your partner’s copy of a shared debt: entries, amounts, notes and the photos they see
Expenses, payments, attached photos and history in groups
Your name and number as your partner saved them
The copy on your partners’ phones, including cached photos they opened

Your name and shared records stay with your partners. You leave shared debts and groups, but the records your partners saw don’t change, so their balances stay correct.

In our database, only a numeric ID and your name remain in place of your account, because your partners’ records point to it. It holds no login, email, phone number or Telegram ID.
The history of your Premium periods (start and end dates) is kept for overall statistics, and the staff action log for accountability. For now these records, the ID and the name are kept with no time limit.
Firebase statistics and crash reports aren’t linked to your Debix account, so they aren’t deleted with it. Google keeps them for the period set in our Firebase settings.
Emails we sent you stay in your inbox and in the email service’s logs.
Data disappears from server backups within 30 days.
Your chat with the bot stays in your Telegram; we can’t delete it.
Signing in again with the same Google or Telegram account creates a new, empty account. Deletion can’t be undone.

Security

The app talks to the server only over encrypted HTTPS connections.
You sign in with Google or Telegram, so no Debix password is stored.
Your app lock PIN is stored only on your phone, as a salted hash, and is never sent to the server. Android checks your fingerprint; Debix never sees it.
While the app lock is on, screenshots of Debix are blocked and its content is hidden in recent apps.
Notifications are marked private, so depending on your Android settings their content isn’t shown on the lock screen.

No system is perfectly secure. If you notice anything suspicious on your account, write to us right away.

The copy on your phone and backups

Your phone keeps a copy of your records, the names and numbers of people you’ve added, and changes waiting to be sent. This copy is cleared when you sign out; the cache of viewed photos is cleared when you delete your account. Protect your phone with a screen lock.

If Android backup is on, Debix’s copy on your phone (records, your profile including your phone number, and photos waiting to upload) may be included in the backup in your Google account and moved to a new phone. Sign-in tokens and app lock settings are left out of backups. You manage this backup in your Google account settings; deleting your Debix account doesn’t delete it.

Children

Debix is not intended for children under 13, and we don’t knowingly collect their data. If you learn that your child has created a Debix account, write to us and we’ll delete it.

This website

The website uses no cookies or ads. The theme you choose (light or dark) is saved only in your browser. The site is served by the Debix server (the same one the app uses); when you open a page, it processes your IP address and browser request to deliver it and doesn’t log them. The site has no analytics scripts.

Changes to this policy

When the app changes, we update this policy and the date at the top. We’ll point out important changes separately in the app or on this page.

Contact us

For any privacy question or request: support@debix.uz. You can also write to us through “Contact support” in the app.