Privacy Policy

Last updated: June 24, 2026

IOU ("we", "our", or "us") is a personal favour-tracking app built by Friday Vision. This policy explains what information we collect, how we use it, and your rights over it. We keep this simple — we collect only what the app needs to work.

1. Information We Collect

When you use IOU, we collect:

• Account information — your email address and password (stored securely via Supabase Auth), or your Google account name and email if you sign in with Google.
• Profile information — your display name and profile picture, which you provide when setting up your account.
• App content — IOUs (favours) you create, including their title, category, notes, and status. This content is only visible to you and the friend the IOU is shared with.
• Friend connections — the friend relationships you create within the app.
• Notifications — in-app notification records (friend requests, IOU updates) stored in your account. If you grant notification permission, your device's push token is also collected and stored to deliver push notifications to your device.
• Crash and error reports — if the app crashes or encounters an error, a report is sent to Sentry containing the error details, a stack trace, and an anonymous user ID. No email address, name, or app content is included in these reports.

We do not collect location data, contacts, device identifiers, or any data beyond what is listed above.

2. How We Use Your Information

Your information is used solely to provide the IOU service:

• To authenticate you and keep your account secure
• To display your profile to friends you connect with inside the app
• To store and sync your IOUs between devices
• To send you OTP verification emails during sign-up

We do not use your data for advertising, analytics profiling, or any purpose beyond operating the app.

3. Data Storage & Security

Your data is stored on Supabase, a hosted backend platform running on AWS infrastructure in the US. Supabase encrypts data at rest and in transit. Access to your data is controlled by row-level security policies — you can only read your own data, and your friends can only see the IOUs shared between you.

Profile pictures are stored in Supabase Storage. Each picture is stored under a UUID-based path that is not guessable from your email or display name.

4. Third-Party Services

IOU uses the following third-party services:

• Supabase — database, authentication, and file storage. Supabase Privacy Policy
• Resend — transactional email delivery (OTP verification emails only). Resend Privacy Policy
• Google OAuth (optional) — if you choose "Continue with Google", Google's sign-in service authenticates you. Google Privacy Policy
• Sentry — crash reporting and error monitoring. When the app crashes or encounters an error, Sentry receives the error details, a stack trace, and an anonymous user ID. No personal information (name, email, or app content) is included. Sentry Privacy Policy
• Expo Push Notification Service — if you enable push notifications, your device's push token is sent to Expo's push delivery service to deliver notifications to your device. No other personal information is shared with Expo. Expo Privacy Policy

We do not share your data with any other third parties.

5. Data Retention

Your data is retained for as long as your account is active. If you delete your account, all associated data — profile, IOUs, friend connections, and notifications — is permanently deleted from our systems within 30 days.

6. Your Rights & Account Deletion

You have the right to:

• Access — request a copy of the data we hold about you
• Correction — update your display name or profile picture at any time in the app
• Deletion — delete your account and all associated data directly in the app or by contacting us

To delete your account:

The fastest way is directly in the app: go to Settings → Delete account. This immediately and permanently deletes your account and all associated data — profile, IOUs, friend connections, wishes, and notifications.

Alternatively, email support@myiou.app with the subject line "Delete my account" and include the email address associated with your account. We will process the deletion within 30 days.

No data is retained after deletion except where required by law.

To exercise any of these rights, use the in-app option or email us at support@myiou.app.

7. Children's Privacy

IOU is not directed at children under 13. We do not knowingly collect personal information from anyone under 13. If you believe a child has provided us with their information, please contact us and we will delete it promptly.

8. Changes to This Policy

If we make material changes to this policy, we will update the "Last updated" date above. Continued use of the app after changes are posted constitutes acceptance of the updated policy.

---

Contact

Questions about this policy? Reach us at:
support@myiou.app
Friday Vision