The Meridian Shift

Privacy policy

What we collect, why we collect it, where it goes and how to get rid of it. Written from what the app actually does, in the same plain language as the rest of the site.

Last updated 11 October 2026

1. The short version

We collect what the tools need to work and nothing else. We do not sell it, we do not share it for advertising, and there is no analytics or tracking code anywhere on this site. If you want your data gone there is a button in your account that removes all of it.

The rest of this page is the detail behind those four sentences. Nothing below contradicts them.

2. What we collect

Your account. Your email address, a password and your first name. The password is handled by our authentication provider and stored as a hash — we never see it and cannot recover it, which is why resetting is the only way back in.

The contractor assessment. Your first name, your email, whether you ticked the box asking for occasional email, your answers, and the result. Two things worth saying plainly: the row is written before the first question, so if you stop halfway we still hold the answers you gave; and every attempt is kept, so if you take it twice we have both.

DebtFree. The figures you enter: what you bring in each month, your bills, living expenses and subscriptions, your debts with their balances, minimum payments, interest rates and due dates, your savings balances, and what each weekly sit-down recorded. This is the most sensitive thing here and it is the reason the rest of this page exists.

The updates list. If you asked to be kept posted from the product, pricing or University page: your email address and which page you asked from.

Feedback you send us. If you use the feedback button inside DebtFree Shift: what you wrote, your email address, the screen you were on including anything in the address bar, and your browser's user-agent string. The form says so above the box before you send it. No screenshot is taken and nothing is captured from the screen itself.

What we do not collect. No bank connection, no account numbers, no card details, no credit report, no location, no device fingerprint, no contacts. DebtFree works by you typing the figures in, which is a deliberate choice about how the tool teaches as much as it is about privacy.

3. Why we collect it

  • To run the tools. DebtFree cannot plan a week it has not been told about.
  • To keep you signed in and bring you back to your own numbers.
  • To send you the email you asked for — confirming your address, resetting a password, and the occasional note if you ticked that box.
  • To know how the assessment is doing. One internal summary a day, to us, counting people rather than attempts. It is about whether the thing works, and it goes to nobody outside the business.

4. Who sees it

Nobody buys it and nobody is given it for advertising. Three companies hold it on our behalf because the site runs on them:

  • Supabase — the database and the sign-in system. Everything in section 2 lives here.
  • Vercel — hosts the site itself and serves the pages. Its server logs record requests in the ordinary way a web server does.
  • Resend — sends the email. It handles the address a message is going to and the message.

That is the whole list. We would also hand something over if the law required it, and we would tell you unless we were prohibited from doing so.

5. Cookies and what your browser keeps

One cookie, and only when you are signed in. It holds your session so the server knows it is you on the next page. It is not an analytics cookie and it is not shared. Signing out clears it. There is no cookie banner because there is nothing to consent to.

Some things stay in your browser and never reach us. How far through the DebtFree walkthrough you got, the result of an assessment you took on that device so the page can offer it back, and any overhead calculation you saved. Clearing your browser data removes all of it, and nothing breaks if it is already gone.

6. How it is kept

Every table holding your data has row-level security switched on, scoped to your own account — so a request for somebody else’s rows comes back empty at the database rather than relying on the app to remember to filter. Traffic is over HTTPS. Passwords are hashed by the authentication provider and never reach our own code.

What we are not going to tell you is that it is unbreakable, or quote a certification we do not hold. We rely on Supabase and Vercel for the infrastructure underneath, and their security is theirs to describe.

7. How long we keep it

Until you delete it. Nothing here expires on a schedule, and we would rather say that than invent a retention period nothing actually enforces. Assessment attempts, including ones nobody finished, are kept on the same terms.

8. Getting it back, or getting rid of it

Deleting is a button. Sign in, open your account, and delete it. That removes every figure you have entered, every week you have recorded, your assessment answers, any feedback you sent us and your place on the updates list, along with the account itself. It cannot be undone and we cannot get it back for you afterwards.

We email a six-digit code to the address on the account and ask for it before anything is removed, so nobody else can do this from a browser you left signed in. If a code arrives that you did not ask for, you do not have to do anything — ignoring it keeps the account exactly as it is.

One case it refuses: an account with an active subscription. Deleting it would take away your way in while the billing carried on, so that gets cancelled first.

Downloading is a button too. On your account page, Download my data gives you one file holding everything we keep about you — every figure and week in DebtFree Shift, your University lessons, your assessment answers, anything you sent us and your account details — as spreadsheets you can open in Excel, Numbers or Google Sheets. A note inside says what each one is, and names the few things left out and why: internal ids and settings that mean nothing outside our database, and the scrambled code used to confirm a deletion. It holds your rows and nobody else's.

9. Email we send

Confirming your address and resetting your password are part of having an account, and you cannot opt out of those while the account exists. Anything else — the occasional note about building a contracting business worth owning — only goes out if you ticked the box, and every one of those carries a way to stop them.

10. Children

This is a tool for people running businesses and we do not intend it for anyone under 18. We do not knowingly collect anything from a child. If you believe we have, email us and it will be deleted.

11. Changes to this page

The date at the top is the version. If something material changes — a new company holding your data, a new category of information, a different answer to any question above — we will email account holders rather than quietly editing the page.

12. Contact

contact@themeridianshift.com. A person reads it.

See also the terms of use.