A plain-language view of the data Repaya uses.

Repaya helps families and friends track informal loans. This policy explains what data we collect, how we use it, and the choices you have.

• Account data: email address, Clerk user ID linkage, and authentication or session data handled by our auth provider. We do not store your password.
• Profile data: lender name, borrower-facing name, timezone, and optional payment handles such as Venmo or PayPal.
• Loan data: loan titles, amounts, schedules, notes, and borrower-facing details you enter.
• Borrower contact data: borrower email addresses you provide for reminder notifications.
• Payment tracking data: payment amounts, dates, and notes you record.
• Marketing and mailing list data: email address and signup source details when you subscribe to beta updates or marketing messages on Repaya properties.
• Feedback and support data: the contents of messages, support requests, or feedback links you open or submit.
• Usage, analytics, and security data: IP address, user agent, device or browser information, page and event activity, and request metadata used to operate the service, measure performance, and prevent abuse.

We do not collect bank account numbers or card details, and we do not process payments.

• Provide and maintain the Repaya service.
• Authenticate users and keep sessions secure.
• Display and organize your loans, payments, and lender settings.
• Send reminder notifications you enable.
• Respond to support requests and feedback.
• Prevent abuse, detect issues, and improve reliability.
• Measure usage, product performance, and beta interest.
• Communicate about service updates, marketing updates, or support requests.

We use audit and security logs to investigate errors, enforce rate limits, and understand activity on both authenticated and public loan routes.

We use trusted service providers to host data, manage authentication, send emails, measure analytics, support marketing subscriptions, measure marketing performance, and run the app. These providers only process data to deliver the service on our behalf. We do not exchange personal information for money today. Depending on the laws that apply to you, some limited advertising or measurement disclosures may be treated differently, and you can use our privacy choices tools where available.

• Clerk Authentication: manages sign-in, sessions, and account credentials.
• Supabase: hosts the application database and stores account, profile, loan, payment, reminder, audit-log, and related application records.
• Resend: delivers account notifications and borrower reminders.
• Buttondown: may handle beta signup and mailing list subscription emails on Repaya marketing properties.
• Cloudflare: helps host and deliver Repaya properties and provides traffic, performance, analytics, consent-management, and tag-management tooling for the site.
• Amplitude: may receive product and marketing analytics events through our Cloudflare tag-management setup so we can understand flows such as page views, navigation paths, and CTA interactions.
• Microsoft Clarity: may receive marketing-site interaction data, heatmap activity, and session-replay style usage data after analytics consent so we can understand where visitors engage or get stuck.
• Meta: may receive marketing-site page, referral, campaign, and signup-CTA interaction data through the Meta Pixel setup in Cloudflare Zaraz so we can measure ad performance, attribute visits, and understand which campaigns lead to signup interest.

We may also disclose information if required by law, to protect the security of the service, or in connection with a merger, acquisition, or asset sale.

If you share a public loan link, anyone with the link may be able to view loan and payment details associated with that record, including balance progress, payment history, lender display information, and any borrower-visible notes or payment notes shown on that page.

Public loan routes may also generate audit and abuse-prevention logs, including request IP, user agent, and related request metadata. Share those links carefully.

Repaya and our providers may use cookies, session storage, or similar technologies to keep users signed in, protect the app, and measure product performance.

We currently use Clerk for authentication-related session handling, Cloudflare for website delivery, traffic and performance measurement, and Cloudflare Zaraz / Tag Management to control analytics and consent behavior on the marketing site. Through that setup, Amplitude may receive page, navigation, referral, campaign, and CTA event data, Microsoft Clarity may receive heatmap and session-replay interaction data, and Meta may receive page, referral, campaign, and signup-CTA interaction data for ad attribution and marketing measurement when the relevant tools are enabled. We also use Buttondown for marketing signup flows on Repaya properties when those flows are available.

Repaya marketing pages may store limited first-party analytics identifiers or attribution details in browser storage, including session storage, to understand visit flow, landing pages, referrers, and campaign context. When consent tools are enabled for a region, consent preferences may also be stored in a first-party cookie or similar technology. Some marketing or advertising-measurement providers, including Meta, may also rely on cookies or similar identifiers for attribution, measurement, or fraud prevention when those tools are enabled. Browser settings or extensions may block some of these technologies, but doing so can affect analytics, marketing measurement, consent handling, or how the product works.

We keep your data as long as you maintain an account, remain on a marketing list, or as needed to provide the service, maintain records of reminder delivery, investigate abuse, and comply with legal obligations.

You can request deletion of your account and related data by contacting us. Some records may be retained for security, fraud prevention, backup, or legal compliance purposes for a limited period after deletion.

• Update your profile information in the app.
• Delete loans or payments you no longer want stored.
• Request account deletion or data export.
• Unsubscribe from marketing emails when available.
• Use the marketing-site "Privacy choices" link to review or update analytics and marketing consent where available.

If you are a California resident or have privacy rights under another applicable law, you can contact us to make an access, correction, deletion, or similar request and we will review it under the laws that apply to your request.

We may update this Privacy Policy from time to time to reflect product, vendor, or legal changes. When we do, we will update the "Last updated" date above. Material changes will be reflected in the updated policy before the new practice takes effect.

Questions about privacy? Reach us at hello@repaya.co.