Privacy Policy
Version 1.0 · last updated 21 September 2026.
Plain-language privacy: what we hold, why, and what you can do about it.
1. The short version
We collect the minimum needed to run DueArmor: your account details, the business data you enter, a login cookie, and basic server logs. We never sell data, never show ads, never store payment-card details, and never let one customer see another’s data. Delete your account any time and your data goes with it.
2. What we collect
Account information: your name, email address, and a one-way scrypt hash of your password (we never see or store the password itself).
Business data you enter: clients, invoices, payments, promises, disputes, outflows, and workspace settings. This is your data; we only host it.
Session cookies: a single httpOnly login cookie that expires after 7 days, plus a theme preference. No advertising or cross-site trackers.
Technical logs: standard server logs from our hosting provider (Cloudflare) for security and debugging, and email-delivery records when reminder emails are enabled.
3. What we never collect
Payment-card numbers or bank credentials: billing, when launched, is handled entirely by our payment provider and card data never touches our servers. We also run no third-party analytics, fingerprinting, or ad trackers on the product.
4. How we use your data
Only to provide, secure, and support the service: signing you in, computing your queue, forecasts, and scores from your own data, stopping abuse, and answering your support requests. Your data is never used to train shared models and never mixed across accounts; every database query is scoped to your user id.
5. Where it lives
Hosting and database (D1) run on Cloudflare’s global network with encryption at rest. Backups exist for disaster recovery and roll over automatically. Email, when enabled, is sent through Resend. These providers process data only on our instructions.
6. Who we share with
No one, except the infrastructure providers above and where the law requires it. There is no sale, rental, or “anonymised” resale of your data, full stop.
7. Your rights
Access, correct, export, or delete your data at any time: most of it is visible and editable directly in the app, deleting your account deletes everything, and contact us for an export or any request you cannot do yourself. We answer every request.
8. Retention
Your data lives as long as your account does. Delete the account and the data is deleted with it; server logs and rolling backups expire on their own cycles after that.
9. Children
DueArmor is a business tool and is not directed at children under 16. If you believe a child has created an account, tell us and we will delete it.
10. Changes to this policy
This policy is versioned and dated (see top of this page). Material changes will be announced in the app and, for account holders, by email before they take effect. The version in force when your data was processed is what applies.
11. Contact
Anything privacy-related, such as questions, requests, or concerns: use the account page in the app, or the support address published on our homepage once it is live. If we ever appoint a data-protection contact, their details will appear here.