Privacy policy

Effective 19 October 2026

Dueo helps couples and the people they plan with record commitments, payments, income and goals together. This policy covers the Dueo iOS and Android apps and these information pages. Dueo is operated by Ngonidzashe Mangudya. For privacy questions, contact ngmangudya@codecraftsolutions.co.za.

Information you choose to share

• Your account: your Apple or Google account identifier and the display name used in Dueo. Apple or Google sends sign-in credentials so we can verify your identity. Dueo does not receive your Apple or Google password.
• Your space: names, commitments, dates, amounts, categories, notes, payments, income, budgets, goals, contributions, grocery lists, plans and money owed (including the names of the people involved) that you or the people in your space enter. Dueo does not connect to your bank or make payments on your behalf.
• Images and receipts: a profile picture, goal images and the receipt images or documents you choose to attach. Camera and photo access are used only when you choose those features.
• Ask Dueo: the questions you ask and the answers and proposed changes Dueo returns.
• Gmail, if you connect it: details of the money emails Dueo finds in the mailbox you connect, as described below.
• Bank statements and files: statements you add, as a PDF, CSV, OFX or QIF download, a screenshot or a photo, and files you attach to an Ask Dueo message. Dueo reads the transactions in them, as described below.
• Subscriptions: if you subscribe, the App Store or Google Play transaction reference, plan and subscription status. Apple or Google handles payment; Dueo never receives your card or bank details.
• Reminders: if you enable notifications, a device delivery token, platform, timezone and reminder preferences. Notifications can contain commitment information and may appear on your lock screen.
• Invitations: when you invite someone by email, their email address, your display name and the invitation code are sent to them.
• Support: the contact details and information you include when you ask for help. Please do not send passwords, sign-in codes or unnecessary financial documents.

How Dueo uses this information

We use it to authenticate you, keep your plans available across devices, share your space with the people you invite, calculate planning totals, deliver requested reminders, verify subscriptions and respond to support requests. Session and request records also prevent replayed requests, duplicate payments and unauthorized access.

Dueo does not sell your personal information or use it for advertising. We do not use your information to track you across other companies' apps and websites. The sign-in and notification SDKs process information for their own service analytics as described below. These information pages use no tracking scripts or cookies.

Features that use outside AI services

Some Dueo features send the information they need to an AI service that writes the answer. Each one is optional, and nothing in your space changes until you review and accept it. You do not need your own AI account or API key. Dueo sends these requests from its server through Cloudflare AI Gateway with prompt logging and caching disabled, except grocery titles sent to TypeSafe, which Dueo's server sends to TypeSafe directly. Dueo does not log the plaintext of what is sent or returned.

• Ask Dueo sends your question and a summary of your space to Anthropic, which runs it on its Claude models. The summary includes this month's commitments and due dates, amounts paid and still due, who covers what, income, goals, money owed and the names in those records, and recent spending. To answer, Dueo can look up more of your space's records the same way. Dueo asks your permission before the first question is sent.
• Grocery aisles send the title of each grocery item you type, with the names of any aisles your space added, to TypeSafe, which runs its Jev model, so the item can be filed in an aisle. When TypeSafe is unsure, the same title and aisle names go to Anthropic, which may also suggest a new aisle; Dueo adds it only if you tap Add. Nothing else about you or your space is sent, and titles are not stored with the answer. Dueo asks your permission before the first item is sent.
• Gmail sorting sends a money email's sender, subject, date and text (up to about 6,000 characters), with the titles and amounts of your space's open records and its category names, to Anthropic so it can tell you what moved and which record it belongs to. The email text is not stored; Dueo keeps only the sorted result. Connecting Gmail asks for your agreement first.
• Category suggestions, typed drafts and spending insights run on an open model (GLM) hosted by Cloudflare Workers AI. A category suggestion sends the entry's title, a short note hint and your space's category names. A financial or goal draft sends the text you typed, which may include amounts and dates, with the task type, locale, time zone and the date used to interpret it; it does not send your account, space or existing records. Spending insights send category-level monthly totals and planned and received income, not titles or notes.
• Reading bank statements turns a PDF statement into text with Cloudflare Workers AI; CSV, Excel, OFX and QIF downloads are read by Dueo's server itself. The statement's text, or the screenshot or photo, then goes to Anthropic, which lists its transactions. Dueo checks every amount and date against what the statement prints. To find what repeats each month, it then sends the checked transactions, grouped by description with their dates and amounts, and the titles, amounts and due days of your space's open records, to Anthropic. Amounts in the suggestions are worked out by Dueo from the statement, not by the AI service. A file attached to an Ask Dueo message is read the same way, and Ask Dueo can read its text when you ask about it. Statements are only read once you allow sharing with these services.
• Receipt reading sends the receipt image, or the text extracted from a PDF, to a vision model hosted by Cloudflare Workers AI. It can suggest a merchant, total, currency and date, which are stored with the receipt. They can be inaccurate: review them before saving a payment. Reading a receipt never records a payment automatically.

Anthropic processes these requests under its commercial terms, which do not allow it to train its models on them; it may keep them for a limited period for safety and abuse monitoring. TypeSafe's privacy policy says it does not train or fine-tune models on what it is sent, and that it keeps personal data for as long as reasonably necessary to provide its service; Dueo has no zero-retention agreement with TypeSafe. TypeSafe's service is hosted in the United States. Cloudflare does not use Workers AI requests to train models. Goal assistance is calculated by Dueo itself and is not sent to an AI service.

You can turn off sharing with Anthropic and TypeSafe at any time in Settings. Ask Dueo, grocery aisle sorting, Gmail sorting and reading statements then stop sending anything, and you can file aisles and emails and add records yourself.

Bank statements

Statements you add, what was read from them and the suggestions they produce are private to you: the other people in your space do not see them. A suggestion you add becomes a record in your space like any other, so they see its title and amount. Dueo stores the file only until it has been read, then deletes it, whether reading worked or not. A file's text is kept, encrypted, for seven days so Ask Dueo can answer questions about it. The checked transactions are kept, encrypted, until you delete the statement. Deleting a statement removes its transactions and any suggestions that came only from it; records you already added stay. When you leave a space, or are removed from it, your statements there are deleted.

Optional Gmail connection

You can connect a Gmail account to one of your spaces so Dueo can find payment alerts, statements and receipts in that mailbox for you to review. Connecting uses Google's read-only Gmail permission. It does not give Dueo permission to send, change or delete anything in your mailbox. The permission Google grants covers reading all of your mail, which is broader than the senders, labels or dates you may choose to narrow Dueo's scanning to: those choices limit what Dueo looks at, not what Google's permission technically allows. This is explained before you connect.

A connection belongs to the space you created it in and to the member who authorized it. Other members of that space do not see your connection or the messages found through it. If you connect the same mailbox to another space, that is a separate connection with its own scan settings and review items.

For each message that matches your scan settings, Dueo keeps the amounts, dates and kind of message it found, and the sender, subject and message link encrypted, so you can review it. Message content is treated as untrusted: it cannot instruct Dueo to change permissions, invite anyone or mark anything paid. Dueo does not create, change or pay anything from an email on its own; you review each item and choose whether to record an expense or income, match it to something you already have, or ignore it. A bank alert is evidence, not a bank balance, and Dueo does not claim to know your balance or that it has seen every transaction.

Dueo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Dueo uses mailbox content only to provide the review and sorting features you asked for, and transfers it to Anthropic only to sort your emails as described above. It does not sell it, use it for advertising, or use it to train general AI models, and Dueo staff do not read your messages as a matter of routine support.

Your authorization credential is encrypted before it is stored. To read new mail, Dueo uses it to obtain short-lived access tokens and keeps those only for the operation that needs them. When you disconnect or delete a connection, Dueo stops access immediately, revokes the stored credential and deletes items you had not accepted. Items you chose to keep remain in your space as your own records, with their source noted. Deleting your account removes your Gmail connections and their unaccepted items.

Subscriptions

Subscriptions are bought through the App Store or Google Play, which process the payment under their own terms. Dueo sends the transaction reference to Apple's or Google's server to confirm the purchase, renewal or cancellation, and keeps the reference encrypted with the plan, status, store environment and dates needed to give the spaces you created their access. Cancel or manage a subscription in the store you bought it from; deleting Dueo or your account does not cancel it.

The people in your space and service providers

The people in your space can view the information and receipts in that space. Dueo does not require you to share a bank account or live together. Only share information you intend them to see.

Dueo relies on these service providers, which process the information needed to provide their services and may process it outside your country:

• Cloudflare hosts the API, database and private file storage, delivers invitation emails, and runs Workers AI and AI Gateway.
• Anthropic processes Ask Dueo, grocery aisle, Gmail sorting and statement reading requests as described above.
• TypeSafe processes grocery aisle requests as described above, in the United States.
• Apple provides Sign in with Apple, the App Store and its subscription services, and Apple's push service.
• Google provides Google sign-in, the Gmail API when you connect Gmail, Google Play billing and Firebase Cloud Messaging.
• Sentry receives crash and error diagnostics.

Their policies are available from Cloudflare, Anthropic, TypeSafe, Apple, Google and Sentry.

Google's sign-in SDK declares collection of account and contact information, including name, email address and phone number; approximate location; user and device identifiers; and service usage information. Google uses this information for sign-in functionality and, for some data types, service analytics. Dueo's account database stores the provider's account identifier and your display name; it does not store your Google phone number or location.

Firebase's notification SDK processes delivery identifiers and device and diagnostic information for message delivery and service analytics. Dueo does not include Google Analytics or Crashlytics. Notification registration is enabled when you choose reminders; your device token is linked to your Dueo account so we can deliver your reminders.

We use Sentry to diagnose application, API and owner-console failures. Reports include error types, code locations, app versions and operating-system details. We exclude account identity, request bodies, financial records, email content, session tokens, screenshots and session recordings from these reports.

Hosting infrastructure processes request information, such as IP addresses, request times and service errors, for delivery, reliability and security. We may also disclose information when required by applicable law.

Storage and account deletion

Account and space records remain while they are needed to provide your account and shared space. The app keeps session credentials, cached plans and pending requests in platform secure storage. API connections use HTTPS, and receipts and images require an authorized account. Apple refresh credentials and Gmail credentials are encrypted before database storage.

Ask Dueo conversations stay in your space until you delete them; a deleted conversation is removed within a day. For a typed draft, Dueo keeps the validated result encrypted for 24 hours so the same request can be returned without another call, and keeps only task identity and status metadata for seven days. Deleting the related account or space also deletes these records.

Deleting your account removes your account profile, provider identity links, active sessions, memberships, Gmail connections and notification registrations. Apple access is revoked as part of deletion. The people still in a shared space keep its names, financial records, notes and receipts while they remain members.

When no member remains, the space and its records are deleted. Private files are queued for deletion, with retries if storage is temporarily unavailable. Expired sign-in challenges and deletion acknowledgments are cleaned up periodically. Session-token hashes are retained to prevent revoked credentials from being reused. Provider backups and security logs may remain subject to the hosting provider's retention practices. Apple and Google keep their own purchase records.

Your choices

You can edit plans, leave a space, turn reminders off, turn off sharing with Anthropic and TypeSafe, disconnect Gmail, delete bank statements, revoke camera or photo permissions in device settings, or delete your account in Dueo. Uninstalling the app does not delete your account. For deletion instructions or a request without the app, visit Delete your account.

You can contact us to request access, correction or deletion of personal information, or raise a privacy concern. We will verify ownership before making account changes. This policy will be updated here when Dueo's data practices change.