Privacy Policy
Effective:
In short: Get-Due stores what you enter and what it needs to sign you in and send reminders. It has no ads, no third-party trackers and no bank connection, and we do not sell your data.
Who is responsible
Get-Due is run by Paul Buzakov, an individual in Yerevan, Armenia ("we"). Contact: team@get-due.com.
What we collect
- Account. Your email address and sign-in details. Sign-in is handled by Amazon Cognito (password, passkeys, multi-factor).
- What you enter. Accounts, balances, payments, debts, currencies, amounts and dates. If you record a debt, the name of the other person. Get-Due sends nothing to that person.
- Push token. If you use the iPhone app and allow notifications, the push token of your device.
- Security records. Every change to your data is recorded: who made it, what changed (values before and after), when, the IP address and the user agent (browser or app).
- Technical logs. Logs for finding errors. They do not contain personal data or amounts. We keep them 30 days; error logs 90 days.
- Visit statistics. We count site visits without cookies, on our own servers.
We do not ask for your bank login. Get-Due does not connect to banks.
How we use it
To show your payments and forecast, to send reminders by email and push, to keep Get-Due secure, and to answer you. We do not send marketing emails. You can turn off the weekly digest in settings or with one click in the email.
Legal bases (GDPR)
If GDPR applies to you: contract (to provide Get-Due to you), legitimate interests (security, audit records, fixing errors), consent (push notifications, which you can switch off in iOS), and legal obligation where the law requires it.
Who processes data for us
- Amazon Web Services: app hosting, database, sign-in and email sending. Data is stored in us-east-2 (Ohio, US). Backups are copied to us-west-2 (Oregon, US).
- Apple (APNs): delivers push notifications. A push contains no amounts and no names.
- Cloudflare: hosts this site (get-due.com), DNS and email routing for team@get-due.com. To serve a page, Cloudflare sees your IP address, user agent (browser) and the page address, in data centers around the world, not only in the US.
- Google (Gmail): receives email sent to team@get-due.com, which Cloudflare forwards.
- Paddle (web payments, seller of record) and Apple (iPhone purchases through the App Store): process your payment.
- Anthropic (Claude): text you type in plain words is sent to Anthropic to be parsed. Anthropic processes it for us and does not use it to train models.
What we do not do
- We do not connect to your bank.
- We do not sell your personal information and do not share it for advertising (in the sense of the California CCPA).
- We show no ads.
- We use no advertising, analytics or tracking cookies, and no third-party trackers.
- Signing in sets cookies from Amazon Cognito that are needed only to sign you in. The web app keeps your sign-in in your browser on app.get-due.com, and the iPhone app keeps it in the iOS Keychain.
- This site saves your language and motion setting in your browser's localStorage, which stays on your device.
Where your data goes
Your data is stored in the United States. Cloudflare serves this site from data centers around the world, so a visit to it may be processed outside the United States. We work from Armenia, so when we access your data, it is transferred to Armenia.
Your rights
Everyone, wherever you live, can ask us to: show the data we hold about you, correct it, export it (CSV or JSON), and delete the account. You can delete your account in the app or on the web. Or write to team@get-due.com. If you are in the EU or UK, you can also complain to your data protection authority.
You can also object to or restrict processing and withdraw consent. We answer within 30 days and may ask you to write from your account email. Using your rights never changes your price or service.
How long we keep data
- Your data: until you delete your account.
- Technical logs: 30 days; error logs 90 days.
When you delete your account, we erase your data and sign-in from our live systems within 30 days. Backups (14 days of point-in-time recovery and daily backups for 35 days, including the copy in us-west-2) age out within 35 days. Security records are locked so that no one, including us, can change or erase them. We delete them 1 year after they are made and use them only for security and disputes. If an email to you bounced or was marked as spam, we keep the address on a do-not-send list.
Age
Get-Due is for people 18 and older.
Security
Data is encrypted at rest with AWS KMS keys. Each family's data is kept apart from other families' data. Sign-in supports multi-factor and passkeys. No system is perfectly safe. If you find a problem, write to team@get-due.com.
Changes
We change this page by updating the date above. If a change matters to you, we tell you by email.
Other languages
The Spanish and Russian versions are translations. If they differ from this English version, the English version applies.