Privacy Policy
DuelyNoted is a mobile app for tracking subscriptions, bills, free trials and renewals. This policy explains what we collect, why, where it lives, and the control you have over it. The short version: we store only what you type in, we never connect to your bank, and we never sell your data.
1. What we collect
Account data
Your email address, an optional display name, and your sign-in credentials (passwords are hashed by our authentication provider; we never see them in plain text).
Content you enter
The subscriptions, bills and trials you choose to track: names, amounts, currencies, due dates, categories, renewal decisions, notes (for example a cancellation link or plan name), and your Worth-It answers. You decide what to enter — nothing is imported automatically.
Preferences
Notification and digest settings, default currency and timezone.
Operational records
If you delete your account, we keep a minimal deletion record (an internal account ID and a timestamp — never your email or content) for security auditing. If you email support, we receive the email you send.
2. What we deliberately do not collect
- No bank logins, bank connections or transaction scraping
- No contact lists, location data or advertising identifiers
- No tracking or analytics SDKs in the current app version
- No data purchased from, or sold or rented to, anyone
3. Why we process your data
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the service — storing your items, syncing across your devices, scheduling your reminders | Performance of a contract (Art. 6(1)(b)) |
| Account security, abuse prevention and deletion auditing | Legitimate interests (Art. 6(1)(f)) |
| Responding when you contact support | Performance of a contract / legitimate interests |
| Optional future features (crash reporting, analytics, purchases) | Disclosed and, where required, consented before activation |
4. Where your data lives
App data is stored with Supabase on infrastructure located in the European Union (AWS eu-west-1, Ireland). Reminder notifications are scheduled locally on your device — reminder timing does not leave your phone. Our website is hosted on Vercel and stores no personal data. The full list of processors is on the subprocessors page.
5. Sharing
We share data only with the processors needed to run the service (Section 4). If the optional Pro subscription launches, payments will be handled by Apple App Store / Google Play with RevenueCat managing entitlements — we would receive subscription status, never your card details. If crash reporting (Sentry) or privacy-respecting analytics (PostHog) are enabled in a future version, this policy and the subprocessors page will be updated first. We never sell personal data.
6. Retention
Your data is kept while your account exists. When you delete your account, everything is erased immediately; residual copies in encrypted backups are purged within 30 days. Details are on the data retention page.
7. Your rights and controls
- Export: Settings → Privacy & data → Export my data (JSON)
- Delete: Settings → Account → Delete account (see how deletion works)
- Everything else: access, rectification, restriction, objection and portability requests to privacy@duelynoted.app — answered within 30 days
- You may complain to your local data protection authority at any time
8. Children
DuelyNoted is not directed at children under 13 (or the age of digital consent in your country) and we do not knowingly collect their data.
9. Changes
We will update this page when our practices change and flag material changes inside the app before they take effect.