Effective: 6 November 2026
DueSoon helps you keep track of document, bill, subscription, warranty and contract dates so you don't miss them. It is built local‑first and privacy‑first.
DueSoon stores your documents and reminders on your device and shows you what's coming up. Reminders are scheduled on your phone itself. The internet is needed for your anonymous account (below) and for three optional features: Smart Scan (reading a document's text with AI), encrypted backup, and buying DueSoon Plus.
Your documents, their files and the records you save are kept on your device. They are not uploaded to our servers. The only things that leave your phone are described below: your anonymous account, the text of a document you choose to read with Smart Scan, your encrypted backup if you turn it on, your purchase if you buy Plus, content‑free crash reports and — in test builds only — the pilot measurement report.
They are protected by your phone's own storage encryption and the app's sandbox, and by the app lock if you turn it on. DueSoon does not add a separate encryption layer to files on your device; your cloud backup is always encrypted (see below). If you add the DueSoon widget, it shows a short summary of upcoming records (names, days left and amounts) on your Home Screen, where it can be seen without opening the app; the widget sends nothing over the network.
The first time you open DueSoon, the app creates an anonymous account on our server, so that Smart Scan, backup and Plus can reach the right account without asking who you are. It consists of:
No name, email address or phone number is asked for.
During the invited pilot, the test (TestFlight) build of DueSoon sends a small status report to our own server — not to any analytics company — so we can tell whether the app is actually useful. The report contains only two things: how many records you have saved, counted up to 3 (0, 1, 2 or 3), and whether notifications are allowed on your device. It contains nothing from your documents: no content, type, name or amount.
On our server this becomes one row linked to your anonymous account id: the day of your first and of your third saved record, the day you first opened the app in your second week, and whether notifications were allowed at your last open in that week. The row stores days, not times, and no IP address, device identifier or app version.
Your backup is end‑to‑end encrypted. It is encrypted on your device with AES-256-GCM before it is uploaded. Each file has its own random key. The file keys are locked with a random master key, and the master key is locked with a key derived from your recovery key using Argon2id. The index that holds your records, your settings and the list of your files is encrypted with the master key as well. The encrypted files and the index are kept in our object storage (Cloudflare R2); the locked master key is kept in our database.
Only technical details are left unencrypted, such as the Argon2id settings and a random salt that a new phone needs to derive the same key again, how many encrypted files there are, how large they are and when they were uploaded. The content and names of your documents and your records are stored only in encrypted form. Neither our server nor our storage provider can read them.
The app never sends your recovery key to us or to our storage provider, and we have no copy of it. After each backup, our server receives only a check value derived one‑way from the key. A new phone uses it to find your account. The value is not enough to open the backup.
A file larger than 25 MB isn't included in the backup. It stays on your phone, and the app says so on that file.
Your encrypted backup is opened with your recovery key. If you lose it, we can't open your backup for you — that is the trade‑off of end‑to‑end encryption.
Smart Scan runs only when you choose it — there is no automatic mode, on any plan, and nothing is ever read without your explicit tap. You can also switch it off completely in Settings › Your data › Smart Scan. It sends the document's text (not the file) to an AI provider to suggest dates, amounts and types. This text is not used to train AI models; the provider keeps it only to check for abuse and deletes it within 30 days (details under Third‑party services). Results are always shown to you as a draft to review and confirm — DueSoon does not add them to your records or act on them automatically. AI can be wrong; please check important details.
If the app crashes or hits an unexpected error, it sends a crash report to our crash‑reporting provider (Sentry) so that we can find and fix the problem. A report contains only technical details: the type of the error and where in the app's code it happened (the stack trace), the app and operating‑system versions, and facts about your device at that moment — its model, memory, processor and whether the app was on screen. It does not contain the error message, your documents or their text, your records, what you tapped or typed, your account id or any identifier of your device, and it is not linked to your account.
DueSoon uses a small number of providers to deliver features:
DueSoon does not show ads, does not track you across apps or websites, does not include third‑party analytics, and does not sell your data.
Data on your device is protected by your phone's storage encryption and the app's sandbox, and by the app lock if you turn it on. Backups are end‑to‑end encrypted. Network traffic uses HTTPS. No method is perfectly secure, but we aim to minimise what leaves your device and to encrypt what does.
If you sign up for DueSoon email updates on our website, we process only: your email address, your language, where you signed up, the subscription topic (product updates), the version of the consent text you ticked, the time of your consent, and the subscription's status. The purpose is to send you beta and launch news, product updates, new features and occasional DueSoon offers. The address is not used for third‑party advertising, and the list is never sold or shared. We do not permanently store your IP address or browser user‑agent with your signup. Signing up is optional and is never a condition of using DueSoon. Before real email updates begin we will ask you to verify your address, and every marketing email will include a way to unsubscribe. You can also withdraw your consent at any time via privacy@duesoon.co; retention periods are described in Data Retention.
DueSoon is not directed to children and is not intended for use by children.
Questions about privacy: privacy@duesoon.co
We may update this policy. Material changes will be reflected here with a new effective date.
Last change (21 October 2026): added how the encrypted backup is protected and which technical details stay unencrypted (AES-256-GCM, a separate key for each file, Argon2id); stated that only a one‑way check value derived from the recovery key reaches our server; added that a file larger than 25 MB isn't included in the backup.