Privacy Policy

Effective Date: May 8, 2026

DRAFT — REQUIRES LEGAL REVIEW BEFORE PUBLICATION. This is a starting template. Before launch, have a privacy lawyer review for your jurisdiction(s). Especially important for GDPR, CCPA, and PIPEDA compliance language.

1. Who We Are

Dibby ("we", "us", "our") is an expense-splitting application operated by [LEGAL ENTITY TO BE FILLED]. You can reach us at hi@dibby.ca.

2. What We Collect

We collect the minimum data needed to make Dibby work:

Account Data

• Email address (if you sign up with email)
• Phone number (if you sign up with phone — stored encrypted)
• Display name
• Profile picture (if you upload one)
• Default currency

Usage Data

• Groups you create/join, members, expenses, splits, settlements, comments
• Receipt photos (if you upload them — kept until you delete)
• Activity log entries (timestamped audit trail)

Device Data

• Device identifier (for push notifications)
• App version and OS (for crash diagnostics, only if you opt in)
• Approximate region (from time zone, never raw IP stored)

What We DON'T Collect

• Location data
• Contacts (lookups happen on-device with hashed comparisons)
• Browsing history
• Health data
• Financial account credentials (we don't have access to your bank, PayPal, etc.)

3. How We Use Your Data

• Provide the service: process expenses, calculate splits, send notifications.
• Authentication: verify your identity via email magic links or SMS OTP.
• Communication: account-critical emails (password reset, security alerts) and SMS (group invites, OTP).
• Improve the app: only with your explicit opt-in (analytics is OFF by default).
• Comply with law: respond to lawful requests, prevent fraud.

4. Who We Share Data With

We do not sell your data. Period.

We share data with these service providers solely to operate Dibby:

We do NOT share data with advertisers or data brokers.

5. Your Rights

Under GDPR, CCPA, PIPEDA, and similar laws, you have the right to:

• Access: download all your data — Settings → Export My Data.
• Rectify: edit your profile in Settings.
• Delete: Settings → Delete Account (30-day grace period before permanent deletion).
• Restrict: opt out of analytics in Settings.
• Object: contact us at hi@dibby.ca.
• Portability: data export is in machine-readable JSON + CSV.

Response time: within 30 days of request.

6. Data Retention

• Active account: data retained as long as you use Dibby.
• Deleted account: 30-day grace period to restore, then anonymized (your name and identifiers removed; expense history retained for other group members).
• Receipt photos: retained until you delete them or your account.
• Activity logs: 1 year, then auto-purged.
• Backups: 30-day rolling, encrypted.

7. Security

• All data encrypted in transit (TLS 1.3)
• All data encrypted at rest (AES-256)
• Phone numbers column-encrypted in our database
• Auth tokens stored in iOS Keychain / Android Keystore
• Strict access controls; only authorized personnel can access infrastructure

No system is 100% secure. We will notify you within 72 hours if we detect a breach affecting your data.

8. Children

Dibby is not intended for children under 13. We do not knowingly collect data from children under 13. If you believe we have, contact us and we will delete it.

9. International Transfers

Dibby's servers are located in [REGION]. If you're using Dibby from outside this region, your data is transferred there with safeguards including [Standard Contractual Clauses for EU users / equivalent for other jurisdictions].

10. Changes to This Policy

We will notify you via email or in-app at least 30 days before any material change. Material changes are tracked in the change log at the bottom of this page.

11. Contact

• For privacy questions: privacy@dibby.ca
• For data subject access requests: privacy@dibby.ca with subject "Privacy Request"
• For security disclosures: security@dibby.ca

Changelog

• 2026-05-08: Initial version.