Privacy Policy

Last Updated: October 2, 2026 • Effective Immediately

At DueDash (developed by Mrutyunjay Studio), we value your trust and are strictly dedicated to protecting your privacy. This Privacy Policy details how DueDash collects, uses, handles, and protects your data when you use the DueDash mobile application and related web services.

1. Information We Collect

When you use DueDash, we may collect the following information:

• Account Information: When you sign in using Google Sign-In, we receive your name, email address, profile avatar URL, and an authenticating Google User ID (UID).
• Guest mode: if you continue as a guest we create an anonymous account with no name, email or other personal details. If you later sign in with Google or Apple, everything you recorded is kept; leaving guest mode deletes it.
• Sign in with Apple (iOS only): we receive a user identifier from Apple and, only if you choose to share them, your name and email address. If you choose Hide My Email, we only ever receive Apple's private relay address. When you delete your account in the app, we also revoke DueDash's Sign in with Apple authorization.
• Financial Records: Transaction amounts, merchant names/descriptions, dates, expense categories, payment modes (UPI, Cash, Credit Card, Bank Transfer), and loan/EMI schedules that you add manually, that are added from bank SMS on Android, or that are added from bank messages your own Shortcuts automation passes to the app on iOS.
• Advertising data: both apps show ads through Google AdMob. On Android the Google Mobile Ads SDK collects your device's Android advertising ID and shares it with Google to serve and measure ads. On iOS the SDK does not receive the advertising identifier (IDFA), because the app never requests tracking permission; it still receives technical data such as device type, app interactions with ads and approximate IP-based location, used to serve, cap and measure non-personalised ads. See section 4 below.
• What we do not collect: DueDash contains no analytics or crash-reporting SDK on either platform. We do not collect your precise (GPS) location, contacts, usage analytics or crash diagnostics. We do not track you across other companies' apps or websites. Apart from the advertising data the ads SDK receives, described above, we collect no device identifiers.

2. SMS Permissions & Transparency Policy (Android only)

DueDash requests the following Android system permissions to deliver automated expense detection:

• android.permission.RECEIVE_SMS
• android.permission.READ_SMS

Strict Safeguards for SMS Data:

• Only From The Day You Start: DueDash only examines messages that arrive after you enable the feature. Your existing message history is never read or imported.
• Strict Filtering: The app’s regex engine selectively examines only transactional messages originating from recognized commercial bank/financial sender IDs (e.g., HDFC, SBI, ICICI, AXIS, PNB, KOTAK).
• No Personal Messages: DueDash completely ignores personal one-on-one text messages, conversations, contacts, and non-financial notifications.
• No OTPs or Sensitive Codes: DueDash specifically filters out and discards One-Time Passwords (OTPs), verification codes, account passwords, and ATM PINs.
• On-Device Only: The raw content of your SMS messages is never transmitted to our servers or stored in cloud databases. Only the expense details read from it (amount, merchant, category, payment mode and date) are synchronized to your private cloud storage.
• Automatic adding: with Add bank expenses automatically on (Profile tab), a debit is saved as soon as its message arrives and a short notification tells you what was added; you can edit or delete it in the app at any time. With it off, detected transactions wait for you to review them in the app.

2B. Automatic Expenses on iPhone (optional)

iOS does not let any app read your messages. If you choose to, you can create a Shortcuts automation on your iPhone that passes a bank message to DueDash's Log Bank Message action.

• Only what you send: DueDash sees only the messages your own automation passes to it, and only while that automation exists. You can delete it in the Shortcuts app at any time.
• Read on your iPhone, never stored: the message text is parsed on the device and is never uploaded or stored. Only the amount, merchant, category, payment mode and date are saved as an expense in your private cloud storage.
• Filtered: one-time passwords, promotions, failed payments and money coming in are ignored.
• You stay in control: a short notification tells you what was added, and you can edit or delete it in the app at any time.

3. How We Store and Protect Your Data

DueDash uses Google Firebase Realtime Database and Google Firebase Authentication.

• All communications between the mobile application, web services, and Firebase servers are encrypted using industry-standard TLS 1.3/256-bit SSL encryption.
• Your data is protected by Firebase Security Rules that enforce strict user isolation: only the signed-in owner of the account can read or write their respective expense, EMI, and profile records.

4. Advertising

DueDash is free and is funded by ads. We use Google AdMob to show a banner at the bottom of screens after you sign in, ad cards clearly marked "Ad" between list items and sections, and occasionally a full-screen ad: when you return to the app after being away, or after you save a few expenses. On Android a single full-screen ad may also appear when you leave the app from the home screen. You can also choose to watch a video ad in exchange for two ad-free hours. The sign-in screen never shows ads.

iOS: the iOS app does not track you. It never shows Apple's App Tracking Transparency prompt, never reads your advertising identifier (IDFA), and requests only non-personalised ads.

• What AdMob receives: on Android, the Google Mobile Ads SDK collects and shares with Google your device's Android advertising ID; on both platforms it receives technical data such as your approximate (IP-based) location, device type and the ads you were shown. This is used to serve, cap and measure ads.
• Your financial data is never used for ads: your expenses, EMIs, merchant names, SMS content and account details are never shared with AdMob or any advertiser. Ads are not targeted using anything you record in this app.
• Consent in the EEA, UK and Switzerland: if you are in a region covered by the GDPR, the app asks for your consent before any ad is requested, using Google's official consent form. If you decline you still get ads, but non-personalised ones.
• Changing your mind: where that consent applies, you can reopen the form any time from Profile tab → Legal & Privacy → Ad Privacy Settings. On any device you can also reset or delete the advertising ID from Android Settings → Privacy → Ads. On iOS there is nothing to reset: no advertising identifier is used.
• Google's own terms: Google's use of this data is governed by How Google uses information from sites or apps that use our services.

5. Data Retention & Account Deletion

We store your financial records for as long as your account remains active. If you choose to stop using DueDash, you have the absolute right to have all your data permanently deleted:

• In-App Deletion: Open the app and go to Profile tab → Legal & Privacy → Delete Account & Data, then confirm Delete forever. Your profile, expenses, EMIs, categories, reminders and your Firebase sign-in account are erased immediately and irreversibly.
• Web Deletion Portal: If you have already uninstalled the app, submit a deletion request at our Account Deletion Page. Requests are recorded automatically and the account is purged within 7 days.

6. App Store and Google Play Compliance

Google Play (Android): DueDash operates in full compliance with Google Play's User Data Policy, Financial Services Policy, and Permissions Policy concerning Sensitive App Capabilities. We only request permissions necessary to execute the core features you explicitly enable, and SMS access is requested only after an in-app disclosure that you can decline.

Apple App Store (iOS): the data described in section 1 as collected on iOS - your Apple or Google account details and the financial records you enter - is linked to your identity and used solely to provide the app's functionality. The advertising data described in section 4 is collected by Google AdMob, is not linked to your identity, and is used only for third-party advertising. Nothing is used for tracking as Apple defines it: no data is shared with data brokers, and nothing is combined with data from other companies' apps or websites. The only device permission the iOS app requests is notifications, used to confirm expenses it adds automatically.

7. Changes to this Policy

We may occasionally update this Privacy Policy to reflect new app capabilities or regulatory requirements. Any updates will be posted on this URL with an updated "Last Updated" timestamp.

8. Contact Us & Grievance Officer

If you have questions, feedback, or concerns regarding your privacy or data handling, please contact our developer team at:

Mrutyunjay Studio
Lead Developer: Sharad Sonawane
Email: welldayreview@gmail.com
Website: https://duedash-3778c.web.app