Privacy Policy
Last updated October 10, 2026. Written in plain language on purpose, this covers Debt Payoff, Budget, Net Worth, this website, and the Downslope Finance Foundations books.
Each tool works without an account. You never enter a login, and none of the tools asks you to connect a bank. The numbers you enter, debts, budgets, balances, are stored using your browser's local storage (IndexedDB) on the device you're using. That data never leaves your device as part of normal use, and it never touches a Downslope server.
Because it lives in your browser, clearing your browser's site data, switching browsers, or switching devices will remove it unless you've turned on the optional sync feature described below. Exporting your own data as a file, and importing it back in, is a built-in feature of each tool for exactly that reason.
Some tools include an optional AI feature, such as Budget's weekly "Money check-in." When you use one of these, the app sends the relevant prompt (built from the numbers you've entered) to a Downslope-run server, which forwards it to Anthropic's API to generate a response. The Anthropic API key stays on our server, your browser never talks to Anthropic directly.
These features are clearly labeled every time you use them, and using the tool never requires turning one on. We don't log or store the prompts or responses that pass through this server, they're relayed and discarded. Anthropic processes the request under its own API terms, which govern how it may retain or use that data on its end.
Sync is off until you turn it on. If you turn on cross-device sync, the app stores a copy of that tool's data (your debts in Debt Payoff, your budget in Budget) in Cloudflare's key-value storage, keyed to a random pairing code, not to your name, email, or any account. That copy expires 30 days after your last change, and in Debt Payoff, turning sync off deletes it right away. Push notification reminders store only a browser push subscription endpoint. When you send your debts from Debt Payoff to Budget or Net Worth, a copy passes through the same storage and expires after 30 days. If you never enable these features, none of this is created in the first place.
One exception to "nothing leaves your device" is a diagnostic report. If Debt Payoff finds that debts it saved earlier have disappeared, it sends one short report per browser session saying which storage layers it found, how many debts it last saved, and what browser you use, so data-loss bugs can be traced and fixed. The report contains no debt names, balances, or rates, and no IP address, and it expires after 90 days.
The one-time $14.99 Pro purchase is handled entirely by Stripe on its own checkout page. We never see or store your card number. Stripe sends us a webhook confirming the purchase, which includes the email address and name you gave Stripe at checkout.
We use that email and name for one thing: generating a license key and emailing it to you via Resend, our transactional email provider. We don't keep a customer database, your email and name pass through our server just long enough to send that one email, they aren't stored afterward. The license key itself is a self-contained, signed code, validating it doesn't require looking anything up about you.
The "get notified" signup on the Foundations page is a Substack newsletter. Substack collects and manages that email address under its own privacy policy, we only see that someone subscribed, not anything else about you. If you buy a print or Kindle copy of a Foundations book through Amazon once they're live, that purchase is handled entirely by Amazon under its own privacy terms, we never see that transaction.
PDF editions are paid for on Stripe's own checkout page, the same way Pro is. We never see or store your card number. When checkout finishes, Stripe sends us a webhook, and our server asks Stripe directly to confirm the payment went through and which books you bought. That confirmation includes the email address and name you gave Stripe at checkout.
We use that email and name for one thing: emailing you your download links via Resend. They pass through our server long enough to send that one email and aren't stored afterward. Stripe's checkout then sends you to a thank-you page showing the same links. That page's address contains Stripe's reference number for your checkout, and the page works by asking Stripe whether that checkout was paid, not by looking you up anywhere on our side.
What we do keep is deliberately small: Stripe's reference number for your checkout, which books it included, when we first saw the payment confirmed (that's when the 72-hour download window starts), and when the email went out. That record exists to time your links and so a delayed retry from Stripe doesn't email you twice, and it's deleted automatically after 30 days. If delivery fails (for example, our email provider rejects the send, or checkout came back without an email address), we keep the same reference number, the books, and what went wrong, with no email or name, until it's resolved, so we can find the purchase in Stripe and fix it.
The PDFs live in private storage that can't be browsed or reached by a public address. Each download link is signed for your purchase and that specific book, and stops working 72 hours after you pay. The file is yours to keep once downloaded, there's no tracking inside the PDF and nothing checks in when you open it. Stripe keeps its own record of the transaction under its own privacy policy, as it does for Pro.
This site and the apps are hosted on Cloudflare, which sees standard web traffic metadata (like IP address and request timestamps) as part of serving any page on the internet, the same as any host. We don't layer our own analytics or tracking pixels on top of that. We use HTTPS everywhere and standard security headers to protect the site itself, details are in the site's changelog on the Updates page if you want to see the specifics.
If what we collect changes, meaningfully, we'll update this page and update the "Last updated" date at the top. Given how the site works today, that would only happen if we added a genuinely new feature, not as a routine legal refresh.
Questions about any of this?
Email dan@downslopefinance.com