Privacy Policy

Duefield is a business tool and is not intended for children. You must be at least 16 years old to create an account. If we learn that we hold information about a child under 16, we will delete it.

When you sign in with Google, we receive your name, email address, and profile photo from your Google account. We use this only to create and identify your account.

When you use the app, we store the data you enter: project names, client names, costs, currencies, due dates, start dates, status, add-ons, invoices, and your business profile including any logo you upload.

This includes details you enter about your clients, such as their name, company, email address, postal address and tax number, and any link you attach to a project. That information is your content and belongs to you.

We do not collect payment card information, and we do not track you across other websites.

We use your information solely to provide the service: to show your projects and clients, run live deadline countdowns, build invoices, and let you share individual project links. We do not sell your data or use it for advertising.

We process your information because we need it to provide the service you asked for. That covers storing your projects, running countdowns, building invoices, and sending the email you ask us to send.

We rely on your consent for anything optional, such as deadline reminders, which you can withdraw at any time in your account settings. Where we act to keep the service secure and working, such as limiting how much email one account can send, we rely on our legitimate interest in protecting the service and its other users.

We do not use analytics, advertising or tracking cookies. There is no Google Analytics, no advertising pixel, and no third party watching what you do in the app.

Signing in stores a session on your own device so you are not asked to sign in on every visit, and we store your theme choice the same way. Signing in with Google happens on Google's own pages under their policies.

We send you a welcome email when you first sign in. We send deadline reminders about your own projects, at most three per project, which you can turn off at any time in your account settings.

When you choose to email an invoice, we send it on your behalf to the address you enter. It is sent from our servers, so the sender shown is your business name followed by "via Duefield", with your own email address set as the reply address. We do not email your clients for any other reason, and we never send them marketing.

Where the information you store is about other people, such as your clients, you decide what to collect and why. Under data protection law that generally makes you the controller of it and us your processor: we hold and process it only to run the service for you, only on your instructions, and we do not use it for our own purposes.

You are responsible for having a lawful basis to store your clients' details and to email them. If you ask us to delete your account, their details go with it.

We use a small number of providers to run Duefield, and your data passes through them:

Google Firebase, for sign-in and database storage. Vercel, for hosting the website. Resend, for sending email, including invoices you send to your clients.

These providers operate internationally, so your information may be stored or processed outside your country. Each is bound by its own contractual and legal obligations to protect it.

Your data is stored securely using Google Firebase (Authentication and Cloud Firestore). Access is restricted so that only you can read or change your own projects and clients.

If you create a share link for a project, anyone with that link can view that single project's name, client, cost, add-ons, deadline and status, along with your business name and logo, without signing in. The link is protected only by being unguessable, so treat it as you would any private URL and do not share it if the information is confidential.

If you attach a deliverables link to a project, it is stored as ordinary text and shown to anyone with the share link. It is not encrypted, and we are able to see it.

A share link stays active until you delete the project.

We use your browser's local storage to remember your theme preference and, in demo mode, to keep your data on your own device. This is not shared with us or anyone else.

Your data is held by established providers, sent over encrypted connections, and access is restricted by rules that stop one account reading another's information. We keep the credentials that reach your data to the smallest number of people, which today is one.

No service can promise perfect security, and we do not. If a breach affects your personal information we will tell you and any regulator we are required to notify, without undue delay.

Your data is kept as long as your account is active. You can remove individual projects, clients and invoices at any time from within the app. To delete your account and all associated data, contact us at the email below.

Email that has already been sent cannot be recalled or deleted, because it is held by the recipient's mail provider rather than by us. Our email provider keeps delivery records for a limited period so we can tell whether a message arrived.

You may request access to, correction of, or deletion of your personal data. To do so, email us and we will respond within a reasonable time.

We do not sell or share personal information, and we never have. You have the right to know what we hold, to ask for it to be deleted, and not to be treated differently for asking. Use the contact address below.

If you think we have handled your information badly, please tell us first so we can put it right. You also have the right to complain to the data protection authority in your country.

We may update this policy from time to time. The "last updated" date above reflects the most recent version.

Questions about this policy? Email us at legal@duefield.com.