Privacy Policy
Duneed keeps as little as it can get away with. This page lists everything, in the order it matters.
The short version
- Receipt photos are never stored. The image is read once and deleted, on your phone and on our server. What is kept is the text you approved.
- No location, no contacts, no photo library, no names. The only thing about you we hold is an email address.
- Nothing is sold, and nothing is shared for advertising.
- You can take everything with you or delete all of it, from inside the app, without asking us.
- Your data lives in Germany, inside the European Union.
Who is responsible
Duneed is an independent app. For anything in this policy — a question, a request, a complaint — write to support@duneed.app and you will reach the person who built it.
What Duneed holds, and why
| What | Why | How long |
|---|---|---|
| Your email address | Signing in, verifying the address, resetting a password, service notices | Until you delete the account |
| A one-way hash of your password (Argon2id — never the password) | Checking a sign-in without being able to read what you typed | Until you delete the account |
| Session records | Keeping you signed in, and letting a session be revoked | 7 days, extended while you keep using the app; gone on sign-out |
| What you put in the app: receipts (shop, date, total), pantry items (name, brand, category, quantity, price, expiry, your notes), shopping list, categories | This is the product | Until you delete it, or delete the account |
| Household membership and invite codes | Sharing one pantry with the people you live with | Until you leave the household or delete the account |
| A random device identifier, created on your phone and held in the Keychain or Keystore, plus the platform name and when the device was last seen | Counting scans per device so the free limit cannot be reset by signing out, and stopping automated abuse | While the app is installed and in use |
| Scan counts for the current and past periods | Enforcing the free and premium limits | Until you delete the account |
| Whether a subscription is active and which one, as reported by the app stores through RevenueCat | Unlocking premium | Until you delete the account |
| A security log: an account identifier, what happened (a sign-in bootstrap, a household change, an account deletion) and when | Investigating abuse and incidents — see the note under deletion | Kept |
What Duneed never holds
- The receipt image. It is sent once for reading and deleted immediately on every path out of that screen, including when the scan fails. It is never written to storage we own.
- Your location. The app does not ask for it and cannot read it.
- Your contacts, calendar, or photo library beyond the single image you choose to scan.
- Your name, phone number, address, or date of birth. There is nowhere to type them.
- Card details. Payment happens entirely inside the App Store or Play Store. We are told whether you are subscribed, never how you paid.
- Personal data in server logs. Logs carry request identifiers, timings and counts. Never an email address, never a session token, never a line of a receipt.
Who else sees anything
Five companies process something on Duneed's behalf. None of them is allowed to use it for their own purposes.
| Who | What they get | What for |
|---|---|---|
| OpenAI | The receipt image, once | Reading the text off it. It goes through OpenAI's API, whose data is not used to train their models. We never store the image, and our own logs record only that a scan happened — never the picture, never what was read from it. |
| Resend | Your email address | Delivering the verification and password-reset messages |
| RevenueCat | An app-specific identifier and the store's purchase record | Telling the app whether premium is active, and keeping it in sync across devices |
| Apple and Google | The purchase itself | Taking the payment. Their own privacy policies govern that. |
| Hetzner Online GmbH | Everything, as the machine it runs on | Hosting, in Falkenstein, Germany |
Advertising
The free tier shows a banner under two of the lists — never on the scanner, the review screen or the paywall. No ads are being served in the current release: the app ships without ad unit identifiers, so nothing is requested and no advertising identifier is read.
When ads are switched on this page will be updated first, and people in the EEA and the UK will be asked for consent before anything is collected. iOS users will see Apple's tracking prompt, and declining it means generic ads rather than no app.
Getting your data out
Settings → Export produces a machine-readable file of everything the server holds for you. You do not need to ask, and there is no waiting period.
Deleting it
Settings → Delete account erases the account and its data immediately and permanently. There is no soft delete, no grace period and no hidden copy: the rows are gone from the database that serves the app, in one transaction.
Two things survive, and both are deliberate:
- A security log line recording that an account with that identifier was deleted, and when. The identifier no longer points at anything.
- A shared household you started, if other people are still in it. It passes to the member who joined earliest. Their receipts and their pantry are theirs, and your leaving must not take them. Nothing in a household is keyed to you personally.
Deleting the app without deleting the account leaves the account intact — that is what makes reinstalling work. Use the Settings row if you want it gone.
Your rights
Under the GDPR and Türkiye's KVKK you may ask for a copy of your data, correct it, delete it, take it elsewhere, or object to a particular use. The Export and Delete rows in Settings answer the first four immediately. For anything else, write to support@duneed.app. If the answer does not satisfy you, you can complain to the data protection authority where you live.
Children
Duneed is not built for children and is not directed at them. If you believe a child has created an account, write to us and it will be removed.
How it is protected
Everything travels over TLS. Passwords are hashed with Argon2id. The database and cache are reachable only from the application container — they are not published to the internet at all. Session tokens live in the phone's Keychain or Keystore, never in ordinary app storage, and can be revoked from the server at any moment.
Changes
When this policy changes, the date at the top changes with it. A change that affects what is collected or who receives it will be announced in the app before it takes effect, not after.