Security & Data Protection
Last updated: August 2026 (MVP draft)
This page explains, in plain language, how Clear My Debt / Build My Wealth protects your account and data. We take security seriously, and we also believe in honesty: no online service can promise absolute security, and we will not claim to be unhackable or certified compliant with regimes we have not been audited against.
How your data is protected
- All traffic is encrypted in transit over HTTPS.
- Every user-owned record in our database is protected by row-level security, so it can only be read or changed by the authenticated account that owns it.
- Passwords are handled by our authentication provider and are never stored in plain text.
- Sensitive actions such as account deletion run on the server and verify the signed-in caller first. Administrative credentials never appear in the app your browser downloads.
- The coach applies server-side daily usage limits to protect the service from abuse.
What the app never does
- It never stores your card details; payments, when enabled, are handled by a third-party processor.
- It never asks for passwords, PINs, full card numbers, bank login credentials, or national ID numbers in the Coach or any free-text field. Do not enter them.
- Its offline support caches only public pages and static assets. Your financial data, coach conversations, and account pages are never stored in the offline cache.
Storage and cookies
The app uses essential storage only: your sign-in session and preferences such as language. There are no advertising or cross-site tracking cookies. If non-essential analytics or marketing tools are ever added, consent will be requested first.
Your controls
- Export a full JSON copy of your data from Settings.
- Delete your account and all associated data from Settings.
- Sign out from any screen, which ends your local session.
Reporting a concern
If you believe you have found a security issue, please report it through the contact listed in the app Settings page rather than testing it against other users' data. We will investigate promptly.