This policy explains what DueProof (“we”, “us”) collects through the DueProof app, who receives it, why, how long it is kept, and how you can stop it or have it deleted. The app shows short notes at the moments you make a choice; this page is the complete version.

1. In short

• Your cards, amounts, dates, photos and journal entries are stored on your phone. Some features send parts of them out — each is described below — and your phone’s own backups copy them.
• Your account details, what you share, list or send in chat, your Market browsing and activity, records of the cards you burn or compost, and crash reports are sent to us — to run the service, show ads in the free version, keep the service safe and improve the app.
• The app asks before AI reads a photo, a PDF, text you share or notes on your bulletin board, and before it turns on Personalized recommendations. My area is on unless you turn it off, except in the regions listed under “My area”, where the app asks first. The support assistant is itself an AI service, and its screen says so before you write. Location and notifications are optional.
• Some of this goes to companies that work for us, such as our cloud host, AI services and Google’s ad service. They are named under “Who receives your data”.
• We do not sell your personal data.

2. What stays on your phone

• The app keeps your cards (titles, amounts, dates, notes and what AI read from your photos), your photos and videos, journal and watering entries, bulletin-board notes, saved payment codes, and the interest tags it works out from them in a database on your phone. Widgets and your phone’s search can show your cards on the phone.
• If you allow the app to use your calendar, it reads your calendar to show your events next to your cards, and can write card due dates into your phone’s Calendar or Reminders. We do not receive your calendar. Your calendar app may sync those entries to your calendar account, for example iCloud or Google.
• Copies of this data are made by your phone’s own backups. On an iPhone, iCloud Backup, a backup to a computer and moving to a new iPhone copy the app’s data; on Android, the system backup may copy some of it. These copies are kept by Apple, by Google or on your computer — not by us. Backup files you make in the app (Settings → Data & Backup) and photos you save to your photo library are kept where you put them; we do not receive them.
• On an iPhone, the app keeps your sign-in, your account ID, your nickname and a few settings in the iOS Keychain. These stay on the phone after the app is deleted, and the app uses them again if you reinstall it on that phone.
• Deleting the app deletes what it keeps on the phone, apart from those Keychain items and any backups.

3. When you first open the app

• The first time you open the app, it shows a short notice about your data. Your account is created, and the app starts syncing your data with our servers, only after you tap “Get started”.
• Crash reporting (see “Crash reports”) starts as soon as the app opens. The app also downloads its settings and help articles from our servers when it opens.

4. Your account

• Your account is created automatically, without your name or email, and is identified by a random account ID. On our servers we keep that ID, the nickname and avatar you choose, the country you set as where you live, the app’s language and your phone’s time zone (used for the language and times of our notifications), the token used to send you notifications, and your notification settings.
• When the account is created, and when you verify an email, an hCaptcha check runs to tell people from bots. hCaptcha receives information about your device and the request.
• Our servers receive your IP address with each request. Our hosting and sign-in providers log it, and we keep the IP addresses involved in suspected abuse.
• Email (optional): the Market, chat and shared Spaces need a verified email. Our sign-in service, Supabase, sends a one-time code to it; we keep the address in our sign-in system and use it to sign you in.
• Phone number (optional): some Market actions can require a verified phone number. We send a code by text message through Twilio, and keep the number and when you verified it. Other people see only that you are verified, not the number.
• We keep these until you delete your account (see “Deleting your account”).

5. Features that send data

A. AI reading of photos, PDFs, shared text and bulletin-board notes

• When: you photograph a document to make a card, share a photo, a PDF or text into the app, add a second photo to a card, retry a reading, pick up an email you forwarded (see B), read a photo onto the bulletin board, or tap “Tidy up” on the bulletin board.
• What is sent: a resized copy of the photo (not the original file), or the PDF; for shared text, the text; for a locked PDF, the password you type; for a second photo, what the card already says; for a forwarded email, its text; for “Tidy up”, the notes you keep about that person — notes marked as allergies are not sent. Your language, the date and your country go with it: your phone’s region (on Android, the country of your phone’s language, or the phone’s own region setting on brands that have one, such as Xiaomi) and — except for the bulletin board — while My area is on and you allowed location access, also the country your location is in.
• To whom: our AI server, hosted by Zeabur, which passes it to Google Cloud Vision (reads the text in photos), OpenAI (understands the document and your notes) and Google Gemini (reads PDFs, and takes over when the others fail).
• Why: to fill in the card, or to suggest notes and updates for you to confirm.
• How long: our AI server does not save the photo, PDF, password or text you send. It keeps a monthly count of your AI readings for your plan’s limit, and its operational logs can include a card’s title. The results come back to your phone and are saved there. How long Google and OpenAI keep what they receive, and what else their terms let them do with it, is set by their own terms; we do not control it.
• Your choice: the app asks before the first AI reading. If you say no, you can create cards by hand. You can turn it off at any time in Settings → Privacy & Safety → Photo recognition (AI).

B. Emails you forward to the app

• Settings → Capture & Integrations → Create cards by email gives you a personal email address. While this address is on, email sent to it is received for us by Mailgun. Our server keeps its subject, its text, the images it picks from it and whether it had a PDF attached. To pick the images, it sends the images’ web addresses and descriptions — not the images — to OpenAI. The images it picks are saved, so that the app can download them, at web addresses that contain your account ID and are not listed anywhere; anyone with the address can open them. It then sends you a notification.
• When you next open the app, it reads the email with AI as described in A and makes the card on your phone. While Photo recognition (AI) is off, the app does not read emails that are already waiting; they wait until you turn it back on.
• Anyone who knows the address can send to it. We keep the emails we accepted until you delete your account. While Photo recognition (AI) is off — including before you first say yes to it — this address is off too, once the app has reached our server; email that arrives while the address is off is discarded — not passed to AI and not kept by us, and we do not tell the sender. Turning AI on brings back the same address. You can also write to privacy@dueproof.app and we will turn it off.

C. Personalized recommendations

• This is off until you turn it on — from the card that offers you local info, or in Settings → Privacy & Safety → Personalized recommendations.
• While it is on, every few journal entries on a card, the card’s title and details and the text of those entries are sent through our servers to OpenAI, which returns interest tags (for example “fitness”).
• About once a day, the app sends us a summary stored under your account ID: your interest tags (tags in health and other sensitive categories are left out), how many tags of each kind you have, your top tags with their scores, and any interests you typed on a local info card.
• The app picks local info, deals and ads for you on your phone, from your tags and, if My area is on, the areas in its log. Advertisers do not receive your data. When you accept one of these cards, the app tells us which one.
• Why: to choose local information, offers and ads for you, and to understand which kinds of offers people want.
• Your choice: turning it off stops the uploads and the AI calls, and deletes the summary from our servers (if you are offline, the next time the app starts while you are online). The tags stay on your phone so that turning it back on restores your recommendations at once. Records of cards you accepted are kept until you delete your account.

D. My area

• When it is on: unless your phone’s region (see A) is a country of the European Union, Iceland, Liechtenstein, Norway, the United Kingdom or Switzerland, My area is on until you turn it off, and the app tells you so. In those countries it is off until you turn it on. While it is off, nothing is recorded.
• What is collected: while it is on and you allow location access, the app notes, as you use it, roughly where you were that day — the district and the map square, not your coordinates. This log stays on your phone (an iPhone’s own backups copy it). From it, the app saves to your account the one or two districts you are in most often or, if you picked or confirmed a district yourself, that district, possibly with the second district the app last worked out alongside it. It may also save to your account the city you were in most recently, if that city is not part of your My area. Today this works only in Taiwan.
• Why: to count how many people each city has, which decides when a city’s Market opens, and how often districts change (the counts do not contain your account ID); to show your city’s Market when the app has no other way to tell your city; and, on your phone, to pick local info and offers for you, including ads, while Personalized recommendations is on (see C).
• How long: the log on your phone is kept for at most 90 days. The districts saved to your account, and the copy of them on your phone, are kept until you turn My area off, tap “I’ve moved” or delete your account; the ones in your account are also deleted after 180 days without an update. The recent city expires 7 days after the last day the app noted you there, and is then deleted.
• How to stop: turn off Settings → Privacy & Safety → My area: the log on your phone and the districts and city saved to your account are deleted together, and recording stops. You can also not allow location access. Turning off Personalized recommendations stops the log being used to pick local info and ads. Your choice is kept on this phone only: after you reinstall the app or set up a phone from a backup, check it again.

E. Location

• Location access is optional. If you allow it, the app uses your location to check whether the Market is open in your city, show nearby listings, fill in the district of a listing when you tap to do so, and add a place name to a journal or watering entry when you tap to add one — and, with My area on, to add your country to AI readings and as described in D.
• In Taiwan, the app works out your district on your phone from a built-in table. Elsewhere, and in a few coastal places the table does not cover, it asks your phone’s location service, which sends the coordinates to Apple (on iPhone) or Google (on Android). The place name for a journal or watering entry always comes from that service, only when you tap to add one, and you can edit or clear it before saving.
• The app does not send your precise coordinates to our servers. What can reach us is your country (with AI readings, while My area is on), your district (when you use the Market or put one in a listing; when you pick a city to browse in the Market, the district you picked or, if you picked none, a representative district of that city; with no city picked and no city known from your location, the district of your My area), the districts and the city My area saves to your account (see D), your city, the city you picked to browse, or the city of your My area (to check whether its Market is open) and your phone’s time zone (stored with your account, see “Your account”).

F. Market

• Listings: what you post — title, description, photos, price, category, district and meeting place — is shown to other signed-in users, with your nickname, avatar, trust score, whether you are verified, and how many trades you have completed; their app also receives your account ID with each listing. Listing photos are stored at public web addresses.
• Chat: the messages and photos you send are stored so that you and the other person can read them, and the other person’s app receives your account ID. A notification to them can include the start of your message.
• Activity: when you open a listing, save it or tap that you are interested, we record that under your account ID to recommend similar listings; these records are deleted after 45 days. We also keep group deals you join, orders, completed trades, reports, disputes and the evidence attached to them, and the people you block.
• We keep a log of Market activity that does not contain your account ID — for example listings posted or closed, and counts of browsing and searches by district.
• Choosing a city to browse: you can pick a city (and, if you like, a district) to browse the Market, without location. Your choice is kept on this phone until you change or clear it; it is not saved to your account and is not counted toward that city’s opening. To show listings there, the app sends that city and district (see E). If you have not picked one and the app cannot tell your city from your location, the Market shows the city of your My area; this does not change where you can list or contact sellers.
• Why: to run the Market, recommend listings, keep it safe, and decide when a city’s Market opens.

G. Shared Spaces

• When you share a card or add records in a shared Space, the card’s title, amount, due date, category, photos and records are stored on our servers and shown to the Space’s members, with a log of who did what. Space photos are kept in private storage that only members can open.
• Members can get notifications about shared cards — for example, when a shared bill is overdue, the other members get its title.
• Shared items you remove are deleted from our servers 30 days after you remove them.

H. Records of cards you burn or compost

• When you burn or compost a card, the app sends us, under your account ID, the card’s title, type and due date, when you finished it and how early or late that was, and when the card was created.
• Why: to understand how cards are used and to improve the app.
• Your choice: Settings → Privacy & Safety → Send records of burned and composted cards. While it is off, the app does not send these records. Records already sent are kept until you delete your account.

I. Support assistant

• The assistant in the Support Center is an AI. What you write, any screenshots you attach (as resized copies), and your phone’s model and system version go through our AI server to OpenAI, which writes the reply. The text of your message is also sent to OpenAI to look up our help articles.
• The conversation is saved on our servers so that a person can follow up. Please do not send passwords, card numbers or other sensitive details.

J. P-Points, purchases and rewards

• Purchases and subscriptions are handled by Apple or Google. We receive the purchase details — not your card number — to unlock what you bought, and keep them with your account.
• We keep your P-Point balance and history, your AI reading credits, rewards you earn (for example from quests, ads you choose to watch, or invitations) and what you unlocked. An invitation link carries your account ID so that both of you can be rewarded.

K. Notifications

• Reminders about your cards are scheduled on your phone.
• Other notifications — new chat messages, P-Point changes, Space reminders, a forwarded email arriving, and announcements from us — are sent from our servers through Expo’s push service to Apple or Google, using your phone’s notification token.
• Announcements from us are notices about the service, such as maintenance or changes to our terms. They are sent to everyone, or to people who used the app recently, whose System Announcements switch is on; the switch is kept with your account on our servers, and you can turn it off in Settings → Notifications & Reminders.
• You can turn notifications off in your phone’s settings, and adjust them in Settings → Notifications & Reminders.

6. Crash reports

• Crash reports (Sentry), always on: when the app crashes or hits an error, it sends Sentry what went wrong and where in the code, your phone’s model and system version, the app version, your account ID, and a trail of recent app events — screens opened, buttons tapped (by name), and network requests and whether they failed. Before sending, the app strips text that looks like an email address, a phone number or a sign-in token. It also sends timing data from some sessions to measure speed, and whether a session ended in a crash. There is no screen recording. Sentry keeps this under its own retention periods.
• Error reports from our servers (Sentry): our servers also send Sentry a report when a request fails on our side: what went wrong, where in our code, and which server function — not your account ID, your sign-in token, or the content of your request; an error message can occasionally quote a short piece of it.
• No usage statistics service: the app no longer uses PostHog, and no other usage-statistics service has replaced it. Earlier versions could send PostHog a small set of usage events (the most recent ones only if you ticked “Share usage statistics”, an option that is now gone). Anything sent before stays with PostHog under its own terms; it was recorded under a random identifier, not your account ID.

7. Ads

• The free version shows a banner ad from Google AdMob, and you can choose to watch ads to earn AI readings. Pro subscribers do not see the banner.
• We ask Google for non-personalized ads only, and the app does not ask for permission to track you across other companies’ apps and websites. To show and measure ads, Google’s software in the app receives information about your device, such as its model, device identifiers and an approximate location based on your IP address. Google receives it under the terms described in “Who receives your data”.
• Local info and offer cards are chosen on your phone (see C). Advertisers do not receive your data.

8. How our team uses AI on the data we hold

• Once a month, a few of the comments people leave in support feedback, without account IDs, are sent to OpenAI to write a summary for our team.
• Support conversations that were resolved and rated well can be sent to OpenAI to draft help articles.
• Our team can run analyses of the data described in this policy — such as interest-tag summaries and records of burned and composted cards — that send the results to OpenAI for a written summary.

9. Who receives your data

• Other people: what you post in the Market, send in chat, or share in a Space, as described above; the other person’s app receives your account ID with it. Anyone can also look up an account — through the app or by querying our servers directly — and see its account ID, nickname, avatar, account type, plan, whether its email is verified, trust score, whether it is suspended, and some of its dates, such as when it was created.
• Companies that work for us:
  • Supabase — our database, sign-in (including the email verification codes), file storage and server code.
  • Zeabur — hosts our AI server.
  • Google Cloud Vision, OpenAI and Google Gemini — AI reading, the support assistant, interest tags and our team’s analyses, as described above.
  • Mailgun — receiving the emails you forward to the app.
  • Twilio — sending phone verification codes.
  • hCaptcha — telling people from bots.
  • Expo — delivering notifications and app updates.
  • Apple and Google — delivering notifications, handling purchases, the phone’s location service, and (Google) ads through AdMob.
  • Sentry — crash reports from the app, and error reports from our servers.
  • Discord — alerts to our team, which can include the IP address involved in suspected abuse, and a summary of support feedback.
  • Cloudflare — runs our website and forwards email sent to our addresses.
• We give data to these companies, including Google for ads through AdMob, only under terms that require them to protect it at least as well as this policy describes. Apple, and Google for notifications, purchases and the location service, handle what they receive under their own privacy policies.
• Others, when the law requires us to.
• These companies store and process data in other countries, which may be outside the country where you live.

10. How long we keep it

• On your phone: until you delete it or the app, except the My area log (below).
• My area: the log on your phone, at most 90 days; the districts saved to your account, until you turn My area off, tap “I’ve moved” or delete your account, and deleted after 180 days without an update; the recent city, until it expires 7 days after the last day the app noted you there (see D).
• Market views, saves and interest marks: deleted after 45 days.
• Shared items you remove from a Space: deleted 30 days after you remove them.
• Everything else tied to your account: until you delete your account, except as listed under “Deleting your account”.
• Copies in our database backups: until those backups expire.
• Our servers’ operational logs, which can include a card’s title or a forwarded email’s subject: for our hosting providers’ log periods.
• What AI services, Sentry and Google receive, and anything an earlier version sent to PostHog: under their own terms.

11. Your choices

• In Settings → Privacy & Safety: Photo recognition (AI), Personalized recommendations, My area, and Send records of burned and composted cards. Each can be turned off at any time; what turning it off does is described above.
• Location, camera, photos, calendar and notifications: in your phone’s settings. The app works without them, except for the features that need them.
• Email forwarding address: turn off Photo recognition (AI) in Settings — while AI is off, including before you first say yes to it, the address goes off once the app reaches our server — or write to us and we will turn it off.

12. Your rights

You can ask us to tell you what we hold about you and let you see it, give you a copy, correct or complete it, stop collecting or using it, or delete it. Email privacy@dueproof.app from the email you verified in the app, or include the Support Code shown in Settings → Account & identity (note it before you delete the app). We may ask you to confirm that it is you. A Support Code alone does not prove that an account is yours, so if your request rests on it, we ask you for a further step to confirm that before we disclose or delete anything.

13. Deleting your account

• In the app: Settings → Account & identity → Delete account. Without the app: see dueproof.app/account/delete.
• Deleting removes from our servers your profile and the data tied to it: your P-Point and purchase records, listings and orders, the Spaces you created, your Space memberships and what you shared in Spaces, support conversations, notification settings, interest-tag summary, records of burned and composted cards, Market activity records, AI reading counts, what My area saved to your account and your forwarded emails. We keep a record of each purchase (the store’s transaction number, the product, the points and the time) permanently, without your account ID, so that the same purchase cannot be credited twice. When our server confirms the deletion, the app signs you out and clears your sign-in, its settings and what My area keeps on the phone; if the deletion does not go through, or the app cannot confirm it, the app tells you, changes nothing on the phone, and you can try again or email us.
• Deleting your account does not cancel a subscription. If you have one, cancel it first in your phone’s subscription settings, or you will keep being charged.
• If you deleted your account in the app on or before October 11, 2026, our servers may still hold your data. Email privacy@dueproof.app from the email you verified in the app. If you never verified one, any Support Code the app shows you now belongs to a new account, so tell us instead what you remember about the old one (for example, when you bought P-Points or used the support assistant), and we will look for it.
• What is not removed, or not yet:
  • Messages you sent or received in Market chats, and records of disputes and reports, stay so that the other person keeps them, with your account ID, nickname and avatar removed; in older chats the first system line still shows your nickname. A listing of yours that a dispute, a report or another buyer’s order refers to also stays, taken off the Market and without your account ID, nickname or avatar, though its photo addresses still contain your account ID. Chats on your other listings are deleted, both sides’ messages.
  • Records you added to cards that someone else shared in a Space stay in that Space.
  • Your sign-in record, including your email address if you verified one, is not removed by the deletion in the app.
  • Photo files uploaded for your listings, chats and forwarded emails, and — from earlier versions of the app — PDFs and the photos uploaded to make a PDF, also when the PDF was never made (they sit at web addresses that are not listed anywhere; anyone with the address can open them), are not all removed automatically yet.
  • Some records tied to your account ID: AI reading credits and rewards, what you unlocked, block lists, notification settings for Spaces you joined, a record of the items you removed from other people’s Spaces, the mark on a group-deal listing that you were its buyer, and the counters and logs we use to prevent abuse.
  • Copies in our database backups, until those backups expire.
  • What other companies already received, as described above.
  If you want any of these removed, email privacy@dueproof.app.
• The cards on your phone are not deleted with your account; delete the app to remove them.

14. Children

DueProof is for people aged 13 or older. If you are not yet an adult where you live, please read this policy with a parent or guardian. If you believe a child under 13 has given us personal data, email us and we will delete it.

15. Security

Data sent between the app and our servers is encrypted in transit. No system is perfectly secure; if a breach affects your data, we will tell you as the law requires.

16. Changes to this policy

When this policy changes, we update the date at the top. If a change means the app will collect something new, the app tells you before that happens. Before the app uses what it already has for a new purpose, it asks you first.

17. Contact us

Privacy questions and requests: privacy@dueproof.app. Other questions: support@dueproof.app.