Privacy policy

This describes what UnifyPay actually stores. Browsing fees and history requires no account and no personal data.

What we collect

If you sign in: Whichever identifier you signed in with, an email address or the account identifier and profile fields returned by Google or Apple. We store a display name and avatar URL where the provider supplies one.
Sign-in codes: One-time codes are stored only as a bcrypt hash, expire after ten minutes, and are deleted once used. The plaintext code never touches the database.
Transactions you record: Amounts, dates, descriptions and the rail used. This is data you enter deliberately; it is visible only to your account and is deleted when you delete the record.
Operational logs: Errors and significant actions (sign-in, rate edits, outbound referral clicks) are logged with a timestamp, and where relevant a truncated IP address and user agent, to keep the service working and auditable. Rate edits are attributed to the account that made them, because an audit trail that cannot say who changed a price is not an audit trail.

What we do not do

We do not sell personal data.
We do not run third-party advertising or cross-site tracking.
We do not connect to your bank or payment accounts.

Retention and your rights

Account data is kept until you delete the account. Operational logs are kept for a limited period and then discarded. Depending on where you live you may have the right to access, correct, export or erase your personal data, and to object to processing. Deleting your account removes your profile and the transactions attached to it.

Processors

Sign-in may involve Google, Apple, an email provider or an SMS provider, depending on the method you choose. Exchange-rate reference data is fetched from a third-party feed; that request carries no information about you.

What we collect

If you sign in

Whichever identifier you signed in with, an email address or the account identifier and profile fields returned by Google or Apple. We store a display name and avatar URL where the provider supplies one.

Sign-in codes

One-time codes are stored only as a bcrypt hash, expire after ten minutes, and are deleted once used. The plaintext code never touches the database.

Transactions you record

Amounts, dates, descriptions and the rail used. This is data you enter deliberately; it is visible only to your account and is deleted when you delete the record.

Operational logs

Errors and significant actions (sign-in, rate edits, outbound referral clicks) are logged with a timestamp, and where relevant a truncated IP address and user agent, to keep the service working and auditable. Rate edits are attributed to the account that made them, because an audit trail that cannot say who changed a price is not an audit trail.

Retention and your rights