Privacy Policy — Duly AI

Summary: Duly AI collects only the data necessary to provide the service. We do not sell your personal data to third parties. Financial data is encrypted in transit and at rest. You can delete your account and all data at any time.

1. Information We Collect

Account Information

When you create an account, we collect your name, email address, and profile photo (if provided via Google or Apple Sign-In). For phone number sign-in, we collect your phone number.

Financial Data

Duly stores the expense data you enter, including amounts, categories, descriptions, dates, and any notes. This data is stored in your personal account and is not shared with third parties.

Voice and Audio Data

When you use the voice assistant, audio is processed in real-time by Google's Gemini Live API to generate responses. We do not store raw audio recordings. Transcribed text may be stored as part of your conversation history.

Receipt Images

Receipt photos you capture are uploaded to Firebase Storage and processed by Google Document AI for text extraction. Original images are stored in your account and can be deleted at any time.

Device Information

We collect device type, operating system version, and app version for crash reporting and compatibility purposes. We use Firebase Crashlytics for crash reporting.

Usage Analytics

We collect anonymized usage data (features used, session length) to improve the app. This data cannot be used to identify you personally.

2. How We Use Your Information

To provide and improve the Duly AI service
To process voice commands and generate AI responses
To sync your data across your devices
To send push notifications you've opted into
To process subscription payments via RevenueCat
To diagnose crashes and fix bugs via Firebase Crashlytics
To comply with legal obligations

3. Data We Collect — App Store Privacy Labels

Data Type	Collected	Purpose	Linked to You
Financial Info (expenses, amounts)	Yes	Core functionality	Yes
Email Address	Yes	Account creation	Yes
Name	Yes	Account creation	Yes
Phone Number	Optional	Phone sign-in	Yes
Audio Data	Processed, not stored	Voice commands	No
Photos (receipts)	Yes	Receipt scanning	Yes
Crash Data	Yes	App stability	No
Usage Data	Anonymized	Analytics	No
Location	No	—	—

4. Data Sharing

We do not sell your personal data. We share data only with the following service providers who help us operate Duly:

Google Firebase — Authentication, database, storage, and crash reporting
Google Gemini API — Voice AI processing (audio processed in real-time, not stored)
Google Document AI — Receipt OCR processing
RevenueCat — Subscription management and payment processing
Google AdMob — Advertising for free tier users (can be removed by upgrading to Pro)

All service providers are contractually bound to protect your data and may not use it for their own purposes.

5. Data Security

We implement industry-standard security measures to protect your data:

All data is encrypted in transit using TLS 1.3
Data at rest is encrypted using AES-256
Firebase Security Rules restrict data access to authenticated users only
Firebase App Check prevents unauthorized API access
API keys are stored in Firebase Secret Manager, never in the app binary

6. Data Retention

We retain your data for as long as your account is active. If you delete your account, all your data (expenses, receipts, groups, settings) is permanently deleted within 30 days.

7. Your Rights

You have the right to:

Access — Request a copy of all data we hold about you
Correction — Correct inaccurate data
Deletion — Delete your account and all associated data (Settings → Account → Delete Account)
Export — Export your expense data as CSV at any time (Settings → Export Data)
Opt-out — Opt out of analytics data collection in Settings → Privacy

To exercise these rights, contact us at privacy@dulyai.app.

8. Children's Privacy

Duly AI is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us immediately.

9. California Privacy Rights (CCPA)

California residents have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information is collected, the right to delete personal information, and the right to opt-out of the sale of personal information. We do not sell personal information. To exercise your CCPA rights, contact us at privacy@dulyai.app.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via push notification or email. Continued use of the app after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or how we handle your data, please contact us: