Privacy Policy

This policy explains how DueBy Budget Planner ("DueBy", the "App") and the website dueby.app handle personal information. Both are provided by Todd Lahman LLC, 24601 E Mica Peak Rd, Liberty Lake, WA 99019, USA ("we", "us"), which decides how the information described here is used.

The short version

Your bills, budget, transactions, invoices, mileage log, and everything else you keep in DueBy are stored on your devices and in your own iCloud. We can't read them, and we don't keep a copy.

A few things do reach us or the companies that work for us: if you use Bank Sync, bank transactions on their way from Plaid to your device, and an encrypted copy of each bank connection's token, kept so we can end the connection when your Bank Sync subscription ends; the two ends of a drive, if you turn on street addresses; and anything you send us by email or through this website. Each is described below, with who handles it and how long it is kept.

We don't sell personal information, show ads, or track you across apps or websites.

Where your DueBy data is kept

On your devices. DueBy keeps your records in a database on each device you use it on, protected by the device's own encryption. Deleting the App removes that copy.

In your iCloud. DueBy syncs your records through the private iCloud storage of your Apple Account, using Apple's CloudKit service, so each of your devices shows the same data. Apple stores it under Apple's iCloud terms and privacy policy, in data centers Apple chooses, generally in the United States. DueBy writes your records in CloudKit's encrypted fields and your attachments as encrypted files. With iCloud's standard data protection, Apple holds the keys to them; if you turn on Advanced Data Protection for iCloud, they are end-to-end encrypted and only your trusted devices can read them. Either way, we can't read them. Apple can see that DueBy's records exist, with their types and dates.

Some settings, and your answers to DueBy's questions (for example, a merchant you told DueBy to leave alone), sync through iCloud's key-value storage, which doesn't use the encrypted fields described above.

If you use iCloud Backup, your device's backup includes DueBy's copy of your data. Advanced Data Protection encrypts iCloud Backup end to end too.

If you share an account or a household, what you share syncs through Apple's iCloud sharing to the people you invited, and only to them. Each invitation is a link that works once, for whoever opens it first, so send it only to the person it's for. Everyone in your household can see your name and, for each person in it, the names of the accounts you share with them and whether they can change them. The names you give the people you invite, and your list of who may see what, stay in your iCloud. Bank connections are kept in your iCloud Keychain, which Apple encrypts end to end; our relay also keeps an encrypted copy of each connection's token, as "Bank Sync through Plaid" describes.

Apart from that copy of a bank connection's token, we never receive anything in this section. You can see, change, export, and delete it yourself in the App.

Bank Sync through Plaid (optional)

If your DueBy subscription includes Bank Sync, sold per connected bank, you can connect a bank or card account so its transactions appear in DueBy, sorted into your budget categories and matched to the bills they pay and the paychecks they deposit. Bank Sync is available in the United States, is off until you turn it on, and is provided through Plaid Inc. ("Plaid"), a service that connects apps to financial institutions.

When you connect an account, you sign in to your bank inside Plaid's own Link screens. Your bank username and password go to Plaid or directly to your bank; they are never shown to DueBy and never pass through our systems. Plaid then gives DueBy a token that allows read-only access to the accounts you selected. Plaid's collection and use of your information is governed by Plaid's End User Privacy Policy, and you can see and manage every app you have connected through Plaid at my.plaid.com.

Through Plaid, DueBy retrieves the name of your institution, the name and last few digits of each account you chose, and your transactions: date, amount, merchant or description, category, and whether a transaction is still pending. DueBy doesn't keep your account numbers, routing numbers, balances, or identity documents, and can't move money.

These requests and Plaid's answers pass through our relay (described below), which adds our Plaid credentials and passes the answer back to your device. The relay keeps no copy of the transactions and doesn't log what passes through it. Before you subscribe, Check Your Bank sends the bank name you type to Plaid the same way, to search its list. Your Plaid token is stored in your own iCloud Keychain, and the transactions are stored on your devices and in your iCloud like everything else in DueBy.

Plaid charges us for every connected bank until the connection is ended, and only someone holding its token can end it, so our relay also keeps a copy of each bank connection's token. It is encrypted with a key only we hold, and stored with the connection's Plaid ID, the App Store ID of the Bank Sync subscription that pays for it, the Bank Sync plan (how many banks), and the dates it was connected and last synced or checked. It is kept with nothing else: no names, accounts, balances, or transactions. When you connect a bank, the App sends the signed record of your Bank Sync purchase from the App Store with it, and the relay keeps the token only if that record checks out; from version 1.3 the App also sends the banks you connected earlier, once, at its first launch and again when your Bank Sync subscription changes. The relay uses the token only to end the connection at Plaid; while more banks are connected than your Bank Sync plan covers or when you add one while every bank it covers is connected, to ask Plaid which of them still exist, so that it never counts or removes one already gone; and, for a new bank, to send the token to the App with the bank's list of accounts whenever the App asks for it with the same Bank Sync subscription within 24 hours of the sign-in. Before a new bank connects, the relay counts the connections it keeps under your Bank Sync subscription and doesn't start one your plan has no room for. So that a bank you connect is never left connected without the App knowing (if the App closes during the sign-in, for example), Plaid also sends the relay notices about the connections made through it, and the relay ignores any notice that doesn't carry Plaid's signature. For this it keeps, for 1 hour after a new bank's sign-in starts, a one-way fingerprint of that sign-in with your Bank Sync subscription's App Store ID, and its plan. When Plaid says the sign-in finished, the relay asks the App Store whether that subscription is active and how many banks it covers, and only then connects the bank, within your plan. What came of the sign-in (the connection's Plaid ID, or that your plan was full) is kept with the fingerprint for 24 hours, so the App can collect the bank when it next opens; a bank the App doesn't collect in that time is ended at Plaid. Plaid's other notices (for example, that new transactions are ready) are not kept. A new connection made past your plan anyway (on two devices at once, for example), whose accounts can't be read, or that the relay can't keep under your subscription, is ended at Plaid right away, and its token is never sent to the App. For these, and for a bank the App didn't collect, the token is deleted once Plaid confirms the connection ended; until then the relay keeps it, encrypted, only to try again each day, 30 days at most, with the connection's Plaid ID, the App Store ID of the Bank Sync subscription it was made under, if any, and the date of the first try. It ends a connection when you disconnect the bank, or 7 days after the App Store tells us your Bank Sync subscription, or every DueBy Personal and Business subscription you have, expired, couldn't renew because a payment failed, or was refunded, even if DueBy is never opened again, or, when your Bank Sync plan changes to fewer banks and you don't choose which to remove, for the connections it no longer covers, picked at random, once 7 days have passed since the smaller plan started and DueBy hasn't synced or checked your banks for 7 days. To know when that is, it asks the App Store about your subscription by that ID, whether it is active and how many banks it covers, and whether your DueBy Personal or Business subscription is active (the App Store's answer lists both; the relay keeps nothing about the latter), and receives notices from the App Store about it. If you revoke DueBy's access at my.plaid.com instead, the copy is deleted the next time DueBy syncs or checks that bank, or when the relay checks it for a smaller plan, or, if DueBy isn't used again, 7 days after your Bank Sync subscription, or your DueBy Personal or Business subscription, ends.

We use bank data only inside DueBy: to list your transactions, sort them into your categories, keep transfers between your own accounts out of spending, match charges to your bills and deposits to your paychecks, and find recurring charges. We never sell it, never use it for advertising, and never share it with anyone other than Plaid and your bank as needed to provide the connection.

To disconnect a bank, remove it in the App's Settings › Bank connections. DueBy tells Plaid to revoke the connection and deletes the token from your Keychain and from our relay; if Plaid can't be reached, DueBy keeps the token only to try again until Plaid confirms, and our relay notes that you asked to remove it, so that it is the first one removed if your plan covers fewer banks. Transactions already in DueBy stay until you delete them. Delete All Data disconnects every bank at Plaid before it deletes anything. If your subscription or Bank Sync ends, or can't renew because a payment failed, your connections pause and are removed at Plaid after 7 days. If a smaller Bank Sync plan starts, the App asks you which connections to remove and removes those at once; meanwhile the ones it no longer covers pause, and any you haven't chosen after 7 days are picked at random and removed. Our relay removes them too if the App hasn't. You can also revoke DueBy's access at my.plaid.com, or ask Plaid to delete the data it holds, as Plaid's policy describes.

Apple Card and Apple Cash (optional)

On iPhone you can turn on matching for Apple Card and Apple Cash. With your permission, DueBy reads your recent Apple Card and Apple Cash transactions through Apple's FinanceKit, on your iPhone, only to suggest which bill a payment belongs to and to notice a subscription's price change. They are read on your iPhone and never sent to us, shared, or used for advertising. When you confirm a suggestion, the payment's date and amount are saved with that bill, in your iCloud, like a payment you mark yourself. You can withdraw access at any time in Settings › Privacy & Security › Wallet.

Mileage and location (optional)

The mileage log can measure your drives with your device's location. On iPhone it records a drive you start, and only if you turn on automatic recording and allow Location Always does it notice by itself when you start driving. On Apple Watch it records a drive you start there. Routes, distances, and places are stored on your devices and in your iCloud; we never receive your routes. If you link a vehicle to your car's Bluetooth or CarPlay, DueBy reads the name of the car your iPhone is connected to during a drive to choose the vehicle, and keeps that name in your mileage settings. You can turn off location for DueBy at any time in your device's Settings, and drives can always be added by hand.

Street addresses are optional, part of DueBy Business, and off until you turn them on. With them on, DueBy names where a recorded drive began and ended once you've said what the drive was for: it sends those two points, rounded to about 11 meters, and nothing else, through our relay to OpenCage GmbH, an address service in Germany, which sends back the street address. Neither our relay nor OpenCage keeps the points. DueBy never sends a drive marked Medical for an address. With each request the relay checks the signed record of your DueBy Business purchase from the App Store. Without street addresses, drives are named only by the places you name.

Scans, receipts, and attachments

When you scan a paper bill, a pay stub, or a receipt, or import a bill, a statement, or a spreadsheet, DueBy reads it on your device with Apple's text recognition and, where available, Apple Intelligence on the device. Nothing is sent to us. DueBy keeps the page of a scanned or imported bill only if you turn on Keep a Copy of This Page, and a receipt when you scan it as an expense or add it to a transaction; each is kept with its bill or transaction, on your devices and in your iCloud, until you delete it. A statement's pages are never kept.

Contacts, logo, and your name (optional)

On an invoice's customer, From Contacts fills in the details from the one contact you choose. When you add a person to your household, Choose from Contacts fills in only that contact's name. On iPhone and iPad the system picker shares only that contact; on the Mac, DueBy first asks for permission to read your contacts. Only what you choose is saved, with the rest of your data on your devices and in your iCloud.

A logo for your invoices is chosen the same way, through Apple's photo picker or a file you select. DueBy receives only the image you choose and keeps a small copy with your business's details.

If you tell DueBy what to call you, your first name is kept in DueBy's settings on your devices and in your iCloud, and is used to address you in the App. If you share a household, it is also shown to the people in it as your name. You can change or remove it in Settings; people in your household see the change the next time their devices sync.

Your customers' details

With DueBy Business you can keep customers: a name, a business name, an email address, a phone number, a postal address, a website, and notes. They are stored like the rest of your DueBy data, on your devices and in your iCloud, where we can't read them. We never receive them.

An invoice prints the customer's business, name, address, email, and phone; the website and the notes aren't printed. You send invoices yourself, through Mail, Messages, or another app you choose. DueBy sends nothing by itself.

These details are about other people. You decide what to keep, and you are responsible for keeping it lawfully. Deleting a customer removes them from your customer list; an invoice already made keeps its own copy of the customer's details until you delete the invoice.

Reminders and notifications

Bill reminders are scheduled on your device. DueBy doesn't use a push server, and nothing about your bills is sent to us to deliver a notification. A notification shows a bill's name and when it is due, never an amount.

Public data DueBy downloads

If you track a US federal student loan on an income-based plan (IBR or PAYE), DueBy downloads that year's US poverty guidelines directly from the Federal Register (federalregister.gov), a US government website, to estimate your payment. It asks only a few times each January. The request contains nothing about you or your loan; like any website, the Federal Register can see your device's IP address.

Purchases

DueBy's subscriptions and Bank Sync are sold through the App Store. Apple handles payment; we never see your card or billing details. Apple gives us sales and subscription reports that don't identify you, and the App checks, on your devices, the signed record of your purchase from the App Store. For Bank Sync, our relay also checks that record when you connect a bank, keeps the subscription's App Store ID with the bank's connection, and asks the App Store, and hears from it, whether that subscription has ended or now covers fewer banks, so the connection can be ended with it.

On iPhone and iPad, DueBy asks Apple whether an Apple Ads ad brought you to it and, if one did, which campaign, ad group and keyword the ad was; it asks until Apple answers, for up to a week. Apple says this answer doesn't identify you or your device, and it stays on that device. When a free trial or your first paid period starts, on that device or another of yours, DueBy asks you once whether it may count it. Only if you say yes, or turn on Count Apple Ads Results in Settings › Privacy, does the iPhone or iPad the ad brought you to send our relay those three numbers with the App Store's signed record of that purchase, which the relay checks and doesn't keep. The relay adds one to that day's count for the keyword, plan and App Store country, and keeps a one-way fingerprint of the purchase, which can't be turned back into it, for 70 days so it is counted only once. It keeps no name, Apple Account, device or purchase ID, and no IP address. These counts tell us which ads pay for themselves. If no ad brought you to DueBy, nothing is sent. You can turn the counting off in Settings › Privacy at any time.

If you cancel your subscription from inside DueBy, the one question it asks is answered on your device and never sent anywhere.

Crash reports

If you have chosen to share analytics with app developers in your device's settings, Apple sends us crash reports and usage statistics about DueBy that don't identify you. You can turn this off at any time in Settings › Privacy & Security › Analytics & Improvements.

Our relay

Bank Sync, street addresses and the ad counts described in "Purchases" go through a small relay we run at dueby.app, hosted by Vercel Inc. in the United States. Its only database holds the encrypted bank connection tokens described in "Bank Sync through Plaid" and those ad counts, stored by Upstash, Inc. in the United States and reachable only by the relay and by us. To serve only DueBy, it checks the signed proof from the App Store that a request comes from the App, and it counts requests in memory for up to a day, by the anonymous ID the App Store gives your copy of DueBy (the same on all your devices) and, more loosely, by network address. Vercel keeps records of requests, including IP addresses, for up to a day to run and protect the service. The relay keeps the reasons for errors, never what you sent.

Email, forms, and this website

If you email us at or use the contact, support, or waitlist form on this website, we receive your name, email address, and message, and use them to answer you. Messages from the forms are delivered to us by Twilio SendGrid; email to our address is forwarded to our inbox by Squarespace, our domain host, through Mailgun; our inbox is hosted by Google. The forms use Cloudflare Turnstile to tell a person from an automated program, which looks at information about your browser and device for that purpose only.

If you join a waitlist, we keep your email address to tell you when what you asked about is ready. Every message has a way to unsubscribe.

This website uses cookieless, aggregated visitor and performance statistics from our host, Vercel. It sets no advertising or tracking cookies, and no other company tracks you across sites through it. Because nobody is tracked, browsers that send Do Not Track or Global Privacy Control signals are treated the same as others.

Why we use information, and our legal bases

Where the law asks for a legal basis (for example, in the European Economic Area, the United Kingdom, and Switzerland): we pass on bank transactions and answer your messages to provide what you asked for (a contract, or steps you asked us to take); we keep each bank connection's encrypted token to end the connection when you disconnect it or stop paying for it (the same contract, and our legitimate interest in not paying for connections nobody uses, which doesn't override your rights); street addresses are looked up because you turned them on, which you can undo at any time (your consent); the relay's checks, the website's statistics, Turnstile, and crash reports keep the service working and protected from abuse (our legitimate interest in running a secure service, which doesn't override your rights); counting which ads brought free trials and first paid periods, without identifying anyone, shows us which advertising works, and is done only if you say yes (your consent, which you can withdraw in Settings › Privacy); the waitlist rests on your consent; and we keep what the law requires (a legal obligation).

Who handles information for us

Apple (iCloud, the App Store, Apple Ads, crash reports); Plaid (bank connections); OpenCage GmbH, Germany (street addresses); Vercel Inc., United States (this website, the relay, and the website's statistics); Upstash, Inc., United States (the relay's store: encrypted bank connection tokens, and ad counts); Twilio Inc., United States (SendGrid: form delivery and the waitlist); Squarespace, Inc., United States (our domain, and email forwarding through Mailgun); Google LLC, United States (our inbox); and Cloudflare Inc., United States (Turnstile). Each handles information only to provide its service to us. We may also disclose information when the law requires it, or to protect someone's rights or safety.

Where information is processed

We are in the United States. What reaches us is processed in the United States, and the points of a street-address lookup in Germany. If you live elsewhere, your information goes to countries whose privacy laws may differ from yours, and whose authorities may be able to obtain it under their laws. For information from the European Economic Area, the United Kingdom, and Switzerland, we rely on our providers' certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, or on the standard contractual clauses.

For people in Japan: what you send us, such as a message or your email address for a waitlist, goes to Todd Lahman LLC and to the providers named above, in the United States. The United States has no comprehensive privacy law; personal information there is protected by federal laws for particular areas and by state laws (Japan's Personal Information Protection Commission describes the US system). We protect it as the “Security” section describes, and our providers handle it only to provide their service to us. By sending a message or joining a waitlist, you agree to this.

How long we keep it

Bank transactions and the points of a street-address lookup: not kept; passed on at once. A bank connection's encrypted token, with the connection's Plaid ID and the App Store ID of the Bank Sync subscription that pays for it: while the bank is connected; deleted when you disconnect it or use Delete All Data, or when the connection is removed at Plaid 7 days after that subscription, or your DueBy Personal or Business subscription, ends, or after a smaller plan no longer covers it. A note that we ended a connection because its subscription ended or no longer covered it (its Plaid ID and a one-way fingerprint of its token, so the App can tell you why): 400 days. When we first saw your Bank Sync subscription paying for fewer banks than are connected (a date, kept with the subscription's App Store ID): until the count is back within the plan or the extra connections are removed. A note that you asked to remove a connection Plaid couldn't confirm removing: until the connection is removed, 30 days at most. A new connection we ended (past your plan, with its accounts unread, one we couldn't keep under your subscription, or one the App didn't collect within 24 hours) while Plaid hasn't confirmed that (its encrypted token, its Plaid ID, the App Store ID of the subscription it was made under, if any, and the date of our first try): until Plaid does, 30 days at most. A one-way fingerprint of a new bank's sign-in, with your Bank Sync subscription's App Store ID, and its plan: 1 hour. What came of that sign-in (the connection's Plaid ID, or that the plan was full), with the same fingerprint: 24 hours. A note that a bank the relay connected hasn't reached the App yet (its Plaid ID and when it was connected): until the App collects it, or until it is ended at Plaid after 24 hours. The relay's request counts: in memory, up to a day. Ad counts: 13 months. A counted purchase's one-way fingerprint: 70 days. Vercel's records of requests: up to a day. Your emails and messages: up to two years after our last exchange, unless the law requires longer or they are needed for a legal claim. A waitlist address: until you unsubscribe or we close the list. Website statistics: kept by Vercel in aggregated form only.

Your rights

Depending on where you live, you may have the right to know what personal information we have about you, to get a copy, to correct it, to have it deleted, to object to or limit how we use it, and to withdraw your consent at any time. Your DueBy data is on your devices and in your iCloud, so you can see, correct, export, and delete it yourself in the App; we can't reach it.

For what we hold, such as your emails, write to or use our contact form. We answer within 30 days. We may ask you to confirm that the request comes from you, and we won't treat you differently for making it. If we decline, you can ask us to reconsider; if you're still not satisfied, you can complain to your data protection authority or, in the United States, to your state's attorney general.

Deleting your data

Delete All Data, in DueBy's Settings, disconnects every bank at Plaid, which also deletes our relay's copy of each bank's token, and then deletes your DueBy data from iCloud and from every device signed in to it. Deleting the App removes its data from that device only; a bank still connected then stays connected until you stop paying for Bank Sync or for DueBy Personal or Business, and is removed at Plaid, with our copy of its token, 7 days after that. You can also remove DueBy's iCloud data in Settings › your name › iCloud › Manage Account Storage. To have us delete your emails or a waitlist address, write to us.

Security

Your DueBy data is protected by your devices and by iCloud. For what we handle, the relay stores only the bank connection tokens described above, each encrypted with a key that only we hold, and ad counts that identify no one, every connection to it is encrypted, and only we can sign in to our accounts with the providers named above. If a breach affects your information, we will tell you and the authorities as the law requires.

Health information

DueBy doesn't send health information to us. A drive you mark Medical, and the places it went, stay on your devices and in your iCloud. DueBy looks up a recorded drive's street addresses only after you've said what the drive was for, and never for a drive marked Medical.

Children

DueBy is intended for adults managing their own finances. We don't knowingly collect personal information from anyone under 13. If you believe a child has given us information through this website, contact us and we will delete it.

Privacy contact

Todd Lahman, Managing Member of Todd Lahman LLC, is responsible for privacy at DueBy. Write to , use our contact form, or write to Todd Lahman LLC, 24601 E Mica Peak Rd, Liberty Lake, WA 99019, USA.

Changes

If this policy changes, the date at the top changes with it, and material changes are noted in the App's release notes.