Your information.

01 · What sign-in uses

Email access uses your address, a provider account identifier and short-lived session information. Google sign-in requests basic identity: name, email and profile information. It does not request Gmail, contacts or calendar access. Account setup separately saves your chosen name and eligibility and notice acknowledgements.

Device setup is optional. If you save a phone number, we keep it encrypted as private account contact information. It is not verified, is not a sign-in or recovery method, and does not prove ownership of a WhatsApp number. You can change or remove it in Me → Device setup. Removal clears the current account copy; older encrypted backups follow the retention process described below.

This browser or installed app remembers which setup steps you reviewed or left for later, separately for each account. These choices contain no phone number, calendar secret or passkey. They stay after sign-out to avoid repeated prompts, but clearing site data can reset them. Permission choices remain under your browser and operating system’s control. Passkeys store public-key credentials with the service, not your fingerprint, face or device PIN; your device or chosen password manager controls the private credential.

Optional profile and birthday card · added 9 September 2026

Your editable profile name, optional phone and optional date of birth are private account details, stored with application encryption. Google sign-in supplies only the basic name, photo and email already authorised. We do not request Google birthday, phone, demographic or address-book API access. Browser autofill may suggest details; check them before saving.

Saving an optional birthday makes a birthday cash-gift request card available. The image is prepared on your device. Your birth date, age, phone and email are not automatically put on it. You choose the wording, download or share it, select recipients and send it yourself. A custom message may reveal anything you put into it. Trust Me Nuh does not collect gifts, guarantee delivery, contact anyone automatically or treat a birthday request as a gift received.

Where supported, the contact picker requests one person at a time. Alternatively you may import a single contact file; its original contents remain on your device. Only the name and number you confirm enter the form and are saved if you then save that record. Contacts are not continuously synced. You can clear your optional phone or birthday and save to remove the current values; older encrypted backups and copies you shared require separate handling under the retention section below.

In Your profile data, you can download the current saved profile or clear its app-specific name, phone and birthday together. The download is profile-only, not a complete ledger or identity-provider export. Clearing this copy leaves your verified sign-in email, Google profile and historical records unchanged. Contact the operator for a broader access or deletion request.

02 · What your ledger keeps

A record can contain the other person's name and optional phone number; a purpose or private note; money amounts and dates; or an item's name, category, description, condition, identifier and expected return. We also keep who submitted it, the time, its status, the submitted acknowledgement and a technical receipt. A gift is recorded as given or received, not as a debt.

Enter only what is needed. Do not put bank credentials, card details, identity documents, medical information or information about children in a record. The person you name need not have an account. Tell them that you are keeping a private record and direct them to this notice if they have a question or need a correction. Their silence is not agreement.

03 · What we use it for

We use account information to sign you in and provide your private ledger. Record details let you find and understand your own history. Acknowledgements document the choices you made; limited request, error and abuse-prevention information helps secure and operate the service. We do not sell records, run advertising profiles, make lending decisions or send repayment history to a credit bureau. Creating your account is not consent on behalf of somebody else.

04 · Who processes information and where

Vercel hosts the app and processes requests. Neon Auth manages identities and sessions; Neon Postgres stores the ledger in the AWS US East region in Northern Virginia, United States. Resend handles sign-in email. Google processes your basic identity when you choose Google sign-in. These services and their subprocessors can process information outside Jamaica. Their privacy and processing terms are available from Vercel, Neon, Resend and Google.

The operator also keeps encrypted recovery copies on a locally held external drive in Jamaica and uses an encrypted, access-controlled Mac for recovery and reviewed support work. Restored working copies can contain readable information. Cloudflare routes incoming support email to the operator's Google Gmail inbox. These email providers also process messages outside Jamaica. Do not send unnecessary record details by email. This is not a promise that all information remains in Jamaica or that a provider's certification establishes compliance for this service.

05 · Private does not mean invisible to the service

Access checks limit records to their creator. Names, phone numbers and descriptive private details receive separate application encryption. Amounts, dates, status, identifiers and technical receipts do not all receive that extra encryption; the hosting and database services process them. Identity-provider profile information is held by the identity service. This is not end-to-end encryption: the authorised server, and the operator through controlled support procedures, can access information needed to provide the service.

The ledger is private, not a public blockchain. Hash-linked receipts help detect changes; they do not prove that money changed hands, that somebody agreed, or that the service cannot lose data. Sign-in uses session cookies. Offline app files are separate from a confirmed database record. Sharing or exporting a copy is your choice and may disclose it outside the app; removing a record cannot recall copies another person already received.

06 · Retention and your requests

Live records are not seven-day test data. We keep them while needed for your account and recordkeeping, subject to correction, restriction and deletion requests and any specific lawful reason for retention. We do not promise permanent storage. Access and privacy requests are handled by a person, not an automatic debt-resolution service.

You can ask to see your information, correct it, restrict its use or have it deleted, including if somebody else named you in a record. We verify the request without giving you another person's ledger. We explain any information that must be retained and why. Technical receipts and older encrypted backups require separate handling; a removed screen entry must not be described as instant erasure from every copy.

Descriptive corrections have a separate receipt: we do not silently rewrite an original loan amount or say both people accepted a change. Removing a private record hides it from the active ledger and removes its live descriptive details. Original amounts, dates and technical history, account acknowledgements and identity-provider information need separate review. Restriction can stop new records while preserving access to your own information. An account export is not an export of somebody else's account or every provider's internal logs.

Requests are reviewed by the operator. We explain what can be corrected, restricted or removed and what must be retained, with reasons. Older backups and identity-provider information need separate handling. Before restored information is made available, the operator must check it against later verified privacy requests. This is a manual safeguard, not automatic deletion from every copy.

Use the contact above for a request or privacy concern. Do not send passwords or sign-in codes. You can also contact Jamaica's Office of the Information Commissioner.

Optional device services · added 8 September 2026

You can separately enable private calendar dates and browser push reminders in Me. These are optional additions to the initial live release described above. They do not contact your counterparty, confirm a payment or change an agreement. Delivery and calendar refresh times depend on your device and calendar provider.

Push setup stores an encrypted browser subscription and a keyed identifier. Your browser’s push service (such as Apple, Google, Mozilla or Microsoft) processes delivery, potentially outside Jamaica. Notifications contain no names, amounts or item descriptions. Disconnect a device to stop future sends; delivery already in progress may still arrive. Routine cleanup removes reminder jobs older than seven days; outages can delay cleanup. Removing a device connection also removes its queued jobs.

A private calendar link is a bearer credential: anyone holding it, including the calendar provider you choose, can retrieve payment and return dates and opaque record identifiers, without names or amounts. Keep the link private. Replacing or revoking it blocks future refreshes but cannot remove copies already downloaded. The database stores a keyed digest, not the recoverable link. Hosting services process the requested URL; never send your link to support or a public page.