Privacy policy

• Your answers and letter details stay on your device. They are never sent to us.
• Photos you scan are read on your device and are never uploaded.
• If you buy, our payment processor takes your payment and email address, and we keep a small record for 30 days so you can get back to your letters.
• No analytics, advertising cookies or tracking pixels.
• We never sell your information.

Challenge That Debt is operated by Smart Choice Claims Limited, a company registered in England and Wales (company number 13062399), Wellfield House, Park House Lane, Keynsham, Bristol, BS31 2SG, United Kingdom. We are responsible for (the "controller" of) the personal information described here, and Smart Choice Claims Limited is registered with the UK Information Commissioner's Office (ICO) as a data controller, registration reference ZC172418. You can reach us about privacy at [email protected].

When you use the free check or fill in a letter, your answers and the details you type, such as the collector's name, the reference number and the amount, are saved in your own browser's storage, so you can come back to them. They are not sent to us, and we cannot see them.

If you use the photo scanner, the picture is read by software that runs on your device, downloaded from our own site. The photo is never uploaded.

You can delete this information at any time by clearing your browser's site data for our website.

Payments are handled by Stripe. Stripe collects your card details, email address and the billing information needed to take payment and calculate any sales tax. We never see or store your full card number.

To deliver your letters and let you return to them, our server keeps a short record of each purchase: which product you bought, the page you bought it from, the state and collector you selected, a short label for the type of letter, the time of purchase, and a random access code. To let you request your link again, we also keep a one-way coded version (a "hash") of your email address, not the address itself. These records are deleted automatically 30 days after purchase.

If you arrived through a link with campaign labels, such as one from a partner site, those labels are passed to Stripe with your payment so we can tell which links work. We do not use cookies for this.

If you choose our lower price for military, veterans, seniors or people with disabilities, the only thing recorded is that you chose it. We do not ask for or keep any proof, or record which group you belong to.

After you pay, we send one email with the link to your letters, and we send it again only if you ask through our recovery page. These emails are sent through Resend. We do not send marketing emails.

Our site is hosted on Cloudflare, which processes the technical information any website receives, such as your IP address and browser type, to deliver pages and protect the site from attack.

To stop abuse of our checkout and recovery forms, we count requests from each IP address over a few minutes. Those counters are deleted automatically within minutes.

We do not use analytics tools, advertising cookies or tracking pixels. Stripe's own checkout pages may use cookies needed for payment security; see Stripe's privacy policy.

We share information only with the companies that help us run the service, and only for that purpose:

• Stripe, for payments and sales tax;
• Cloudflare, for hosting, security and the short purchase records described above;
• Resend, for sending your letter link by email.

We may also disclose information if the law requires it. We never sell your personal information, and we do not share it for targeted advertising.

As a UK company, we follow the UK General Data Protection Regulation. We use your information:

• to provide what you bought, including delivery and the recovery link (to perform our contract with you);
• to keep the site secure and prevent fraud, and to understand which links bring customers (our legitimate interests, which we balance against your privacy by keeping as little as possible); and
• to keep the payment and tax records the law requires (legal obligation).

Purchase records on our server are deleted automatically after 30 days, and rate-limit counters within minutes. Payment records held with Stripe are kept for as long as the law requires us to keep financial records, which in the UK is generally six years. Information stored in your browser stays until you clear it.

We are based in the UK, and the companies we use process information in the United States and elsewhere. Where information leaves the UK, we rely on recognized safeguards, such as the UK's approved data transfer agreements or the UK-US data bridge where it applies.

You can ask us for a copy of the personal information we hold about you, and ask us to correct or delete it, or to stop or limit using it. Because we keep so little, and only for 30 days, there may be nothing to provide; we will tell you either way. You can also object to our use of your information based on legitimate interests.

If you live in a US state with its own privacy law, such as California, you have similar rights to know about, correct and delete your information, and the right not to have it sold or shared for targeted advertising. We do not sell or share personal information in that way, and we will not treat you differently for using your rights.

To use any of these rights, email [email protected]. If you are unhappy with how we handle your information, you can also complain to the UK Information Commissioner's Office (ico.org.uk), or to the regulator where you live.

The site is intended for adults dealing with their own debts. We do not knowingly collect information from anyone under 18.

The site uses encrypted connections throughout, payments go through Stripe's secure checkout, and the information we keep is minimal and deleted automatically. No system is perfectly secure, but keeping your answers on your own device means there is very little to expose.

If we change how we handle information, we will update this page and the date it was last updated, October 5, 2026. If a change is significant, we will say so on the site.