DuelyPrivacy Policy
DuelyNoted is operated by Gift Robias Phiri, an individual developer established in Ireland, and published on Google Play under the developer name Tanazio Studios. Gift Robias Phiri is the data controller for the personal data described in this policy.
DuelyNoted is a mobile app for manually tracking subscriptions, bills, free trials and renewals. This policy explains what we process, why, where it is handled, how long it is kept, and the controls you have. The short version: we process only what you type in, we never connect to your bank, and we never sell your data.
1. What we process
Account information
Your email address, an optional display name, a unique internal account identifier, and authentication records. Password authentication is handled by Supabase Auth; DuelyNoted does not store your plaintext password.
Information you enter
The subscriptions, bills and trials you choose to track: names, amounts, currencies, due or renewal dates, categories, renewal decisions, notes (for example a cancellation link or plan name), and your Worth-It answers. You decide what to enter. DuelyNoted does not import bank transactions or scrape your accounts, does not access payment-card details, and does not access bank credentials.
Preferences and app settings
Notification and digest settings, default currency and timezone, so the app works as you asked.
Security and operational information
Our service providers may process limited technical information needed to deliver and protect the service, such as IP address, request time, authentication events, and error or security logs. We do not use advertising identifiers or behavioural-advertising SDKs in the current app version.
Support correspondence
When you contact us, we receive your message, your email address, and anything you choose to include.
Account-deletion record
After account deletion we retain a limited pseudonymous deletion reference (an internal account identifier) and a timestamp for up to 12 months, for security auditing and to evidence completion of your request. This record does not contain your email address or app content.
2. What we deliberately do not collect
- No bank logins, bank connections or transaction scraping
- No payment-card details or bank credentials
- No contact lists, location data or advertising identifiers
- No analytics, advertising or crash-reporting SDKs in the current app version
- No RevenueCat or payment processing — DuelyNoted is free and processes no purchases
- No data purchased from, or sold or rented to, anyone
If the product changes, we will update this policy and the subprocessors page before activating materially different processing.
3. Why we process your data
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and operate your account | Performance of a contract — Art. 6(1)(b) |
| Store and sync the items, reminders and settings you create | Performance of a contract — Art. 6(1)(b) |
| Secure the service, prevent abuse and keep a deletion audit record | Legitimate interests — Art. 6(1)(f) |
| Respond when you contact support or make a privacy request | Performance of a contract / legitimate interests |
We do not use your information for automated decision-making or profiling that produces legal or similarly significant effects.
4. Where your data is processed
Core account and app-content data is hosted through Supabase on infrastructure in the European Union (AWS eu-west-1, Ireland). Reminder notifications are scheduled locally on your device; reminder timing is not sent to any advertising network.
The public website is hosted through Vercel, whose global infrastructure may temporarily process standard operational and security logs (for example IP address, request time, browser or device information, and the requested URL). The website does not use analytics or advertising cookies in the current version.
Automated authentication emails (sign-up confirmation, magic link, password reset and account-deletion confirmation) are sent through Resend from auth.duelynoted.app. Email you send to our @duelynoted.app support addresses is handled by Zoho Mail, our business mailbox provider. Namecheap provides domain registration and DNS only. These providers process the sender/recipient address and message content needed to deliver and store the message.
Some service providers may process information outside the EEA. Where required, we rely on the safeguards made available by the relevant provider and applicable data-protection law. The full provider list is on the subprocessors page.
5. Sharing
We disclose personal data only to the providers needed to operate, secure and support DuelyNoted (Section 4), or where required by law. Those providers may process data only for their stated service purpose. We do not sell or rent personal data, and we do not share it for third-party advertising.
RevenueCat, Sentry and PostHog are not active in the current version, and no purchases are processed. If any of these change in a future version, this policy and the subprocessors page will be updated first.
6. Retention
- Account information, app content and preferences are kept while your account is active.
- You can delete individual tracked items at any time.
- When in-app account deletion completes, your active account record and associated app content are removed from the live database.
- Residual copies may remain in encrypted backups until they age out of the rolling backup cycle, currently within 30 days.
- A limited pseudonymous deletion reference and timestamp may be retained for up to 12 months.
- Support emails may be retained for up to 24 months after the matter is resolved.
- Website operational logs are kept for the provider's short operational period and rotated automatically.
More detail is on the data retention page.
7. Your rights and controls
- Export: Settings → Privacy & data → Export my data (CSV or JSON)
- Delete: Settings → Account → Delete account (see how deletion works)
- Everything else: access, rectification, restriction, objection and portability requests to privacy@duelynoted.app — normally answered within one month
- You may complain to your local data-protection authority at any time. In Ireland this is the Data Protection Commission.
8. Children
DuelyNoted is not directed to children. The service may be used by people aged 16 or over, but DuelyNoted is marketed and targeted on Google Play to adults aged 18 and over. We do not knowingly permit children under 16 to create an account. If you believe a child has provided personal data contrary to this rule, contact privacy@duelynoted.app.
9. Changes
We may update this policy when our product, providers or legal obligations change. We will publish the revised date and give reasonable notice of material changes through the app, website or email where appropriate.