Privacy Policy

Duezo is a bill and Buy Now Pay Later countdown app for iPhone. This policy describes what it collects, where that goes, and how to get rid of it. It is written to match what the app and its backend actually do.

What we collect

Account

Your email address and an authentication record held by Supabase Auth. If you start using Duezo before creating an account, an anonymous session is created first and carried over when you sign up; if you abandon it, the anonymous identity and anything it accumulated is discarded.

Your bills and plans

The names, amounts, due dates, payment status and installment schedules you enter or confirm, and any payment link you choose to save.

Notifications

An Apple Push Notification service device token, a device name, and your reminder lead-time preferences — kept so reminders can reach the right device.

Nothing else is collected from your phone. Duezo does not read your contacts, your location, your photo library, your messages or your email.

Smart Scan

Smart Scan only processes the images, screenshots, or document pages you deliberately select. Duezo does not browse your photo library, your files, your mailbox, or your email account.

A bill scan usually uses a single image — a photo, a screenshot, or a page of a supported PDF. A Pay Later scan can use several screenshots together, because an installment plan is often spread across more than one screen. In every case, Duezo reads only what you picked for that scan.

What happens when you run a scan

• What you selected is sent over an encrypted connection (TLS) to Duezo’s backend, hosted on Vercel.
• The backend passes it to Anthropic, which reads it and returns the details it can extract. Anthropic processes what you sent in order to return that result.
• For a bill scan, Duezo may also keep a private audit copy of the image you selected in a file store on Supabase, readable only by Duezo’s own server credentials. It is not public and it is not shared. The copy is kept for auditing and troubleshooting — the extraction itself runs on the image in memory and never reads the stored copy — and it is retained until you delete your account.
• For a Pay Later scan, Duezo does not keep the screenshots. They are sent for processing and are not stored afterwards. What is kept is the validated plan Duezo extracted from them, together with the records described below.
• The extracted fields are returned to you for review. Nothing is saved as a bill until you save it.

What Duezo keeps afterwards

Two different kinds of record are created, and they hold different things.

A usage record, for metering and cost. The time of the scan, whether it was a bill or a Pay Later scan, how many scans it counted against your allowance, which model was used, how long it took, the file size, the number of images, and any error code. This record contains neither the document nor any text from it.

A scan and extraction record, for accuracy. This one does contain content taken from what you selected:

• the company, amount and date that were extracted, before and after tidying;
• the raw output returned by the model;
• short passages of evidence text quoted from the document you selected — the wording the model relied on to decide the company, the amount and the due date;
• how confident the model was in each field, the scan’s status, which model ran it, how long it took, and any error;
• any correction you make — what the model proposed, and what you changed it to.

For a Pay Later scan this record also holds the extracted plan itself: the provider, the last four digits of a card if they appear, the amounts and the payment dates.

How this is used

Retained scan results and corrections may be used to troubleshoot scans, measure how accurate extraction is, and improve Duezo’s own extraction system — the prompts Duezo writes, the way it recognises particular billers, and the test cases it checks itself against. A correction you make is the most useful signal Duezo gets, which is why it is kept.

To be exact about the limits of that:

• Duezo does not use your documents to train Anthropic’s model.
• What you select is never used for advertising, never sold, and never shared with data brokers.
• The improvement work is Duezo’s own, on Duezo’s own systems.

What Duezo does not do

• It does not link bank accounts, and never asks for bank or card credentials.
• It does not import transactions or connect to any financial data aggregator.
• It does not read, receive or scan your email account.
• It does not sell your data, share it with data brokers, or use it for advertising.
• It does not build advertising or behavioural profiles.

Service providers

Each provider operates under its own privacy policy and processing terms. Duezo shares with each only what that service needs to do its job.

Diagnostics and analytics

The iPhone app contains no analytics or crash-reporting SDK. There is no general-purpose screen-view, feature-tap, advertising or behavioural analytics of any kind: Duezo does not record which screens you open or which features you use.

Smart Scan is the exception, and it is metering rather than analytics. Running a scan necessarily creates a usage record, because scans are counted against an allowance and cost money to run. That record is described in §02, along with the scan and extraction records. It is created only when you choose to run a scan.

The website uses no product or advertising analytics. Duezo does not run PostHog, Google Analytics or any equivalent, does not build advertising or behavioural profiles, and does not sell browsing data or share it for advertising or marketing. Sentry processes the limited diagnostics described below on Duezo’s behalf.

The website does send diagnostics to Sentry. Sentry receives errors, and a sample — about one in ten — of page-load performance traces. A performance trace identifies the route that was loaded and how long it took, so over a sample of visits Sentry does receive a partial record of which pages were loaded. This exists to find broken and slow pages, not to profile you, and it is not joined to an advertising or marketing profile.

Before anything is sent, web addresses, request details, breadcrumbs and error messages are stripped of identifying information: query strings are dropped wholesale, and cookies, authorization headers, request bodies, account identifiers and email addresses are removed. If that scrubbing cannot be completed, the report is discarded rather than sent.

Duezo does not record your browser session. There is no session replay or screen recording on the website.

How long we keep things

Your bills, plans, preferences and device tokens are kept while your account exists.

Scan images and the scan and extraction records described in section 02 — including the evidence text quoted from documents you selected, and your corrections — are kept until you delete your account. There is no shorter automatic deletion schedule for either today.

Diagnostic data is kept for the retention period of the provider that holds it.

Deleting your account

Open Settings ▸ Delete account in Duezo and confirm. Deleting your account removes:

• your bills, installment plans and installment payments;
• your preferences and reminder settings;
• your APNs device tokens and push subscriptions;
• queued and previously sent reminders;
• your scan sessions, scan attempts, extraction results and corrections — including any evidence text they hold;
• your scan usage records;
• every scan image stored for your account;
• your authentication record.

Deletion is immediate and cannot be undone. Stored images are removed before the account record is deleted, so nothing is left behind.

Security

Data is encrypted in transit using TLS, and at rest by our infrastructure providers. Database access is governed by per-user row-level security, so an account can only reach its own records. The scan image store is private and is not readable from the internet. Passwords are never stored in plaintext.

No system is perfectly secure, and we cannot guarantee absolute security.

Children

Duezo is not directed at children and is not intended for use by anyone under the age required by the App Store listing.

Changes to this policy

We may update this policy. Material changes will be announced by email or in the app, and the date at the top will change. Continuing to use Duezo after a change means you accept the updated policy.

Contact

Questions about this policy or about your data: support@duezo.app