Privacy policy
Last updated September 23, 2026 · Effective for all accounts
1. Who we are
DueDays ("DueDays", "we", "us") is a web application at duedays.app and app.duedays.app that helps owners of small corporations track filing and payment deadlines and organize the related documents. You can reach us at hello@duedays.app.
2. What we collect
Information you give us
- Account details: your name, email address, and password (stored only as a hash), or your Google account identifier if you sign in with Google.
- Business profile: company name, state, fiscal year end, payroll provider, and the setup answers that shape your calendar.
- Records you enter: deadlines, due dates, amounts, paid/filed dates, notes, insurance policies (carrier, policy number, broker contact, premiums), licenses and permits, and any custom items.
- Documents you upload: the files you attach to deadlines or store in your vault (for example tax returns, payment confirmations, certificates of insurance). These can contain sensitive information — we treat every uploaded file as confidential.
- Early-access sign-up: the email address you enter on our website to request access, the page you entered it on, and your IP address (to stop abuse). Stored in our own database, not with a mailing-list provider.
- Messages you send us: support email and its contents.
Information collected automatically
- Technical logs: IP address, browser type, timestamps and the requests your browser makes to our servers. We use these to run the service, detect abuse and rate-limit sign-in attempts. Logs are kept for a short period and then discarded.
- Local storage: the app keeps your sign-in session and display preferences in your browser's local storage so you stay signed in. We do not set advertising or tracking cookies, and the marketing site sets no cookies at all.
We do not collect Social Security numbers, bank account numbers or card numbers into our own database. When billing launches, payment details will be entered directly with our payment processor (see section 5) and never stored by DueDays.
3. How we use it
- To provide the service: show your calendar, store your documents, generate next year's timeline.
- To send service email: sign-in details, deadline reminders (when that feature launches — you'll be able to turn them off), and notices about changes to the service or these terms.
- To respond when you contact us.
- To keep the service secure and to comply with law.
We do not use your data to train machine-learning models, we do not sell it, and we do not share it with advertisers. We may look at aggregate, non-identifying usage (for example "how many accounts have the PTE option on") to improve the product.
4. Where your data lives and how it's protected
- Application database and sign-in: on a dedicated server we control, hosted by Hetzner Online GmbH in Helsinki, Finland (European Union).
- Uploaded documents and database backups: in private Cloudflare R2 storage buckets in the United States, encrypted at rest (AES-256). Files are never served from a public URL; the application checks that you own a file and issues a short-lived token each time you open it.
- In transit: all connections use HTTPS (TLS 1.3).
- Access control: every record belongs to one account and the database enforces that only that account can read or change it. Administrative access is limited to the operator of DueDays, protected by two-factor authentication, and used only for support you request, for security, or as required by law.
- Backups: the database is backed up nightly; backups are retained for about 14 days and then age out.
Because our database is in the EU and our file storage is in the US, your data crosses borders. By using DueDays you agree to that transfer.
5. Who else touches your data (sub-processors)
| Provider | What they do | What they see |
|---|---|---|
| Hetzner Online GmbH | Hosts the application server (Finland) | Encrypted disk holding the database |
| Cloudflare, Inc. | Serves the website and app, DNS, and stores uploaded files and backups (R2) | Web traffic; encrypted files and backups |
| Google LLC | Optional "Sign in with Google" | Your Google account email, only if you choose it |
| A transactional email provider (Resend or Postmark) | Delivers sign-in and reminder email once enabled | Your email address and the content of those messages |
| A payment processor (planned: Stripe) | Subscription billing once it launches | Your card details and billing address — held by them, not us |
We'll update this table before adding a provider that handles your data.
6. When we share data
Only with the providers above, only as needed to run the service; when the law requires it (a valid subpoena or court order — we'll tell you unless we're legally prevented from doing so); to protect the rights or safety of DueDays, our users or the public; or if DueDays is acquired or merged, in which case your data transfers with the service and this policy continues to apply until you're told otherwise.
7. How long we keep it
- While your account is open: everything you've stored, so the service works.
- After you delete your account (or ask us to): your records and files are deleted within 30 days. Copies in nightly backups age out within about 14 days after that.
- Early-access list: until your account exists or you ask us to remove you — one email.
- Support email: kept as long as needed to help you and for our records.
8. Your rights and choices
- Export: download all of your data at any time from the app's Settings (JSON export today; a full vault export with your files is planned).
- Correct: edit anything in the app.
- Delete: email hello@duedays.app from your account address and we'll delete the account and its data as described above. An in-app delete button is planned.
- Reminders: when reminder email launches you can turn it off per account.
- California residents (CCPA/CPRA): you have the right to know what personal information we collect and how we use it (this policy), to access it, to delete it, to correct it, and not to be discriminated against for exercising those rights. We do not sell or share personal information for cross-context behavioral advertising. To exercise these rights, email us.
- EU/UK residents: although DueDays is built for US businesses, our database is hosted in the EU. If GDPR applies to you, you have the equivalent rights of access, rectification, erasure, restriction, portability and objection, and the right to lodge a complaint with a supervisory authority. Our lawful basis for processing is performance of our contract with you and our legitimate interest in running a secure service.
9. Children
DueDays is for businesses and their owners. It is not directed at anyone under 18, and we don't knowingly collect information from them.
10. Security incidents
If we learn of a breach that affects your data, we'll notify you by email without undue delay and tell you what happened, what was affected, and what we're doing about it.
11. Changes to this policy
If we make a material change we'll email account holders and update the date at the top of this page at least 14 days before it takes effect. Continued use after that date means you accept the updated policy.