Effective: 6 November 2026
This explains how long different kinds of data are kept and what deletion does.
Your documents, files, reminders and settings stay on your device until you delete them or remove the app. They are protected by your phone's own storage encryption; DueSoon does not add a separate encryption layer on the device.
If you enable backup, encrypted blobs are kept in our object storage so you can restore later. They remain until you delete the backup, turn backup off and remove it, or delete your account. We can't read their content. The Privacy Policy explains how they are encrypted and what stays unencrypted (see How encrypted backup works). A file larger than 25 MB isn't included in the backup. It stays on your phone, and the app says so on that file.
The anonymous account the app creates the first time you open it — a random account id, the app's random device id and an internal account address — is kept while your account exists, so Smart Scan, backups and Plus reach the right account. It is removed when you delete your account; only a keyed, one‑way hash of the device id stays, together with the number of starter scans used on that phone (see Scan counters).
The result of a successful Smart Scan — the details found, such as dates, amount, provider and document type, each with the short passage of the document it was read from — is kept on our server, linked to your account id and to a fingerprint (hash) of the text, until you delete your account. There is currently no shorter expiry. The full text of the document is never stored on our server, and a result from the fallback provider is not kept.
The text read from the document goes to the AI provider (OpenAI, or Anthropic if that fails). This text is not used to train AI models; the provider keeps it only to check for abuse and deletes it within 30 days. The provider may keep it longer where a legal obligation requires it, or where the content is flagged as suspected of violating the provider's usage policy. Links to the providers' own explanations are in the Privacy Policy.
Your monthly scan counts (with their total processing size and an estimated cost) and your remaining starter scans are kept while your account exists, to apply your plan's Smart Scan allowance. Deleting your account deletes them.
There is one exception: the number of starter scans used on a phone is kept apart from the account, linked to a keyed, one‑way hash of the device id, and is not deleted with your account. This way, deleting your account and creating a new one on the same phone does not renew starter scans; the new account continues from where the phone left off. This record holds no account id, no document content and not the device id itself, and it is deleted 12 months after it last changed.
Subscription and entitlement records associated with your account are kept while the account exists, to apply your plan correctly. Payment details are handled by the App Store or Google Play, not by us. RevenueCat keeps its own record of your purchases under your anonymous account id.
In the test (TestFlight) build used for the invited pilot, one row per anonymous account records a few days and the notification status (see the Privacy Policy). It is kept only until the pilot results are read, and deleted 30 days after that; deleting your account deletes it at once. Turning the measurement off in Settings deletes the row and stops further reports; after the pilot the server turns reports away without storing them. The App Store version does not include it.
Erase data on this phone removes your on‑device records, files and database, anything waiting in Inbox, cancels pending reminders and resets your settings. Your account, your recovery key and any cloud backup stay, so a backup can still be restored later.
Deleting your account erases your server‑side data: the encrypted backup, Smart Scan results, scan counters, purchase and entitlement records, device and recovery records, the internal account address and, in test builds, the pilot measurement row. The account id is kept only as an empty marker that it was deleted, so other devices can no longer use it. A hashed proof of the deletion is kept until your phone confirms it has finished erasing, and for 30 days after that, so that an interrupted deletion can still be completed; if your phone never confirms, the proof stays until it does. The number of starter scans used on this phone also stays, linked to a keyed, one‑way hash of the device id, for up to 12 months after it last changed (see Scan counters).
We back up our database every night for disaster recovery, store the backups in our object storage (Cloudflare R2) and keep each one for 14 days. Data you delete therefore disappears from these backups within 14 days.
Crash reports are kept at our crash‑reporting provider (Sentry) only for the retention period of our Sentry plan, and are then deleted automatically. Because they are not linked to your account, deleting your account does not find or delete them; they contain no document content.
If backup is off, there is no cloud copy to restore on a new phone. Restore needs an encrypted backup plus your recovery key.
Your encrypted backup is opened with your recovery key. If you lose it, we can't open the backup for you.
An email‑updates signup that has not yet been verified is kept for at most 12 months from the date you signed up. Active, verified subscriptions are kept until you withdraw your consent, the purpose ends, or the record is no longer needed. If you unsubscribe or withdraw consent (privacy@duesoon.co), your address is removed from marketing sends immediately; a minimal suppression record may be kept solely to prevent accidentally emailing you again.
Operational logs (for example, request ids and error traces used to keep the service running) do not contain your document content, but they can include your account id. Our web server's access log records each request's time, path and IP address but not its headers, so it does not hold your device identifier. Logs are rotated automatically once they reach a fixed size, so older entries are overwritten. They are not used for advertising or cross‑app tracking.
Questions about retention or deletion: privacy@duesoon.co