Privacy Policy
betweenus is a shared ledger for the money between two people. We believe the agreements and numbers you track are personal, and we treat your data with the care and clarity we would expect for our own.
Overview & scope
This Privacy Policy explains how betweenus (“we”, “us”, or “our”), operating via betweenus.credit, collects, uses, and safeguards personal information when you use our web application and associated services.
betweenus is a financial record-keeping and interest-calculation platform designed to give two counterparties a transparent, shared record of loans, splits, and IOUs. We are not a bank, registered credit provider, or financial institution. By using betweenus, you consent to the practices described in this policy.
Information we collect
We only collect data that is necessary to deliver, secure, and maintain the shared ledger service:
Account credentials & profile data
When you sign up via email and password or Google Sign-In, we store your email address, unique user ID (UID), and display name.
Shared ledger & transaction records
The data you input into your accounts: counterparty names and email addresses, transaction dates, descriptions, monetary amounts, initial interest rates, rate changes, compounding day settings, and settlement records.
Billing & subscription information
When you upgrade to a paid plan (Personal or Business), your transactions are processed directly by Stripe. We store your Stripe customer ID, subscription tier, and renewal status. We never collect, transmit, or store your credit card or bank account numbers on our servers.
Technical, device & security logs
To guard against malicious attacks and spam, our systems collect IP addresses, browser user agents, and security tokens via Firebase App Check (reCAPTCHA Enterprise). We also collect anonymized page view metrics to help understand overall platform usage.
How we use your information
We process your data strictly for legitimate operational purposes:
- Providing the ledger: Synchronising account balances, computing accurate interest accruals chronologically, and presenting shared views to invited counterparties.
- Account administration & authentication: Verifying identity, managing session states, and enforcing workspace access controls.
- Transactional communications: Sending account invitations, balance statements, password reset emails, and billing receipts.
- Platform security & integrity: Mitigating abuse, enforcing rate limits, preventing fraudulent registrations, and securing callable functions.
- Customer support: Diagnosing issues and replying to support queries initiated by you.
Third-party service providers
We partner with trusted industry providers to host and operate our infrastructure. We require all sub-processors to implement stringent data protection standards:
Google Cloud Platform / Firebase
Provides database hosting (Cloud Firestore), user authentication (Firebase Auth), serverless compute (Cloud Functions), and bot protection (reCAPTCHA Enterprise). Data is hosted in secure, enterprise-grade cloud infrastructure across Google Cloud regions (including US and global multi-region deployments).
Stripe
Handles billing, subscriptions, and payment processing under PCI-DSS Level 1 certification.
Resend
Delivers transactional emails such as workspace invitations and counterparty connection requests.
Sentry
Records application errors and page performance so we can find and fix bugs, tagged with your pseudonymous user ID rather than your name or email. When you send a “Report a problem” form, Sentry also receives the message you write and any screenshot you attach. Data is hosted in the United States.
Google Analytics
Aggregates anonymous website visits and client errors to improve stability. IP masking is enabled.
Our zero data-monetization commitment
We do not sell, rent, trade, or monetize your personal or financial data. We never share your ledgers or contact lists with advertising brokers, third-party data aggregators, or credit scoring agencies.
Data security & retention
We employ robust technical and organizational security measures to protect your information:
- Encryption in transit: All data transmissions between your browser and our servers are encrypted using modern Transport Layer Security (TLS 1.3 / HTTPS).
- Encryption at rest: Firestore databases and cloud backups are encrypted using AES-256 encryption.
- Row-level authorization rules: Security rules in Firestore enforce that only the owner, explicitly invited counterparties, or authorized organization members can read or write account records.
We retain your account and ledger data for as long as your account remains active. If you choose to delete your account, your profile and associated private ledgers will be permanently purged from our primary database.
Your privacy rights & choices
Depending on your location (such as under GDPR in the European Union, the California Consumer Privacy Act / CCPA, and applicable global privacy frameworks), you have specific statutory rights regarding your personal data:
- Right to Access: You can view all ledger entries, transactions, and contact associations directly within your dashboard at any time.
- Right to Rectification: You can edit or correct counterparty names, rates, and transactions directly through the web interface.
- Right to Erasure (“Right to be Forgotten”): You can request complete deletion of your account and personal data by emailing support@betweenus.credit.
- Right to Restrict or Object: You can revoke shared access with any counterparty or cancel recurring subscriptions at any time.
Cookies & local storage
betweenus uses essential browser storage and standard cookies:
- Authentication & Session: Firebase Authentication tokens stored in IndexedDB / localStorage to keep you securely signed in across browser sessions.
- Preferences: Local browser storage to remember UI state and active workspace selections.
- Analytics: Google Analytics cookies to track high-level traffic trends. You may block analytics cookies using browser privacy settings or standard content blockers without affecting core ledger functionality.
Your cookie & analytics preference
Current status: All cookies accepted (Anonymous Google Analytics enabled)
Contact us & updates
We may periodically update this Privacy Policy to reflect changes in our service or legal obligations. When changes occur, the “Effective Date” at the top of this document will be revised.
If you have any questions, concerns, or requests regarding this Privacy Policy or how your data is handled, please contact our privacy and support team: