Privacy Policy

Effective October 30, 2026

This policy covers Bayad Tracker ("Bayad") as run at bayad.jvles.dev. Bayad is open-source software, so other people may run their own copies. Each copy is responsible for its own data, and this policy only covers this one.

If you don't sign in

Your bills, income and loans are saved in a database inside your browser on your own device. None of it is sent to our server. Clearing your browser data or uninstalling the app deletes it, so download a backup from the app now and then.

If you sign in with Google

Signing in is optional and only used to sync your entries between devices. When you sign in, Google shares the following with Bayad:

your email address, and whether Google has verified it
a Google account ID that stays the same each time you sign in

Bayad requests only the openid and email permissions. It does not receive your name, photo, contacts, Gmail, Drive files or any other Google data, and it never gets your Google password.

Once you're signed in, the server stores:

Your account: your email address, your Google account ID, and when you first signed in.
Your synced entries: the bills, income and loans you enter, including amounts, dates, notes, payment reference numbers and any names you type (for example, the friend who owes you money, or the person you borrowed from). When you delete an entry, its contents are removed and only its ID and deletion time are kept so the deletion can sync to your other devices.
Sign-in sessions: a hashed copy of your session token and when it expires (after 180 days).

How your information is used

Your email and Google account ID are used only to sign you in and keep your entries separate from other people's. Your entries are used only to sync them back to your devices. We do not use your data for advertising, sell it, share it with data brokers, or use it to train AI models. There are no analytics or tracking scripts.

Bayad's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Cookies

Bayad sets two cookies, both needed for sign-in:

bayad_session keeps you signed in, for up to 180 days or until you sign out.
bayad_oauth protects the sign-in step and is deleted after about 10 minutes.

Reminders

Reminders are optional and only work while you're signed in.

Notifications: when you turn them on, your browser gives us a push address from its push service (Google, Apple, Mozilla or Microsoft, depending on your browser), along with your time zone. We use them only to send one reminder a day about what's due. The message is encrypted so the push service can't read it. Turning notifications off, signing out or deleting your account removes the push address.
Calendar: making a calendar link creates a secret web address that lists your upcoming due dates with their names and amounts. Anyone who has the link can see them, and the calendar app you add it to (such as Google Calendar) fetches and keeps a copy under its own privacy policy. Making a new link in the app stops the old one from working. Deleting your account removes it.

Other services involved

Google Sign-In, when you choose to sign in. Google's own Privacy Policy applies there.
Google Fonts: the app loads its fonts from Google's servers, which can see your IP address and browser details.
Our hosting provider, which stores the server and may keep standard request logs such as IP addresses.

We may disclose information if required by law.

Security

All traffic is sent over HTTPS. Session tokens are stored only as hashes. Synced entries are stored on the server without end-to-end encryption, so whoever runs the server can technically access them. Don't store information you aren't comfortable keeping there, such as bank passwords or card numbers.

Keeping and deleting your data

Synced data is kept until you delete your account. Signing out ends your session on that device but keeps your synced data, so it's there if you sign in again.

To delete your account, open the app, go to Sync & backup and tap Delete account. Your account, your email address and all your synced entries are removed from the server immediately and can't be recovered. You can choose whether to also erase the entries saved on that phone. If you can't use the app, email mr.ijules@gmail.com from the address you signed in with, and we'll delete it within 30 days. Copies may remain in the server's daily backups for up to 7 days before they are overwritten.

You can also remove Bayad's access to your Google account at any time at myaccount.google.com/permissions.

Children

Bayad is not meant for children under 13, and we don't knowingly collect data from them.

Changes

If this policy changes, the new version will be posted on this page with a new effective date. If the change is significant, we'll tell signed-in users in the app.

Contact

Questions or requests: mr.ijules@gmail.com