Privacy Policy
Duneed keeps as little as it can get away with. This page lists everything, in the order it matters.
The short version
- Receipt photos are never stored. The image is read once and deleted, on your phone and on our server. What is kept is the text you approved.
- No location, no contacts, no photo library, no names. The only thing we hold that names you is an email address — and, if you send us feedback, what you chose to write. Alongside them are the technical records the service needs — a random device identifier, session records, and usage events that carry no content — each listed below.
- Nothing is sold.
- You can take what is in the app with you and delete your account, from inside the app, without asking us. The few records that survive a deletion are listed below.
- Your data lives in Germany, inside the European Union.
Who is responsible
Duneed is an independent app. For anything in this policy — a question, a request, a complaint — write to support@duneed.app and you will reach the person who built it.
What Duneed holds, and why
| What | Why | How long |
|---|---|---|
| Your email address, as Apple shares it | Identifying the account, and showing who is in a household you share | Until you delete the account |
| The identifier Apple gives Duneed for your Apple account | Signing you in. Sign in with Apple is the only way to have an account, and Duneed asks Apple for an email address only | Until you delete the account |
| Session records, including the IP address and app or browser identifier (user agent) of the device that opened the session | Keeping you signed in, and letting a session be revoked | 7 days, extended while you keep using the app; gone on sign-out |
| What you put in the app: receipts (shop, date, total), pantry items (name, brand, category, quantity, price, expiry, your notes), shopping list, categories | This is the product | Until you delete the account. Removing an entry marks it as removed rather than erasing it. In a household shared with others, until that household is deleted — see the note under deletion |
| Household membership and invite codes | Sharing one pantry with the people you live with | Until you leave the household or delete the account |
| A random device identifier, created on your phone and held in the Keychain or Keystore, plus the platform name and when the device was last seen | Counting scans per device so the free limit cannot be reset by signing out, and stopping automated abuse | Kept; deleting the account removes the link between the device and you |
| Scan counts for the current and past periods, per account and per device | Enforcing the free and premium limits | Counts kept against the account: until you delete it. Counts kept against the device: kept |
| Whether a subscription is active and which one, as reported by the App Store through RevenueCat | Unlocking premium | Until you delete the account |
| A security log: account identifiers, what happened (an invite created or accepted, a member leaving or removed, premium starting or ending, a household changing owner, an account deletion) and when | Investigating abuse and incidents — see the note under deletion | Kept |
| Usage events: which of a fixed list of things happened in the app (for example that a scan started or succeeded) and when, small counts and codes attached to it, the app version and platform, the random device identifier, and your account identifier once you are signed in | Knowing whether the app works — where scans fail, where people stop — measured on our own server, with no analytics company involved | Kept; deleting the account removes your account identifier from them |
| Feedback you send from Settings → Tell us what went wrong: the topic you picked, what you wrote, the email address if you typed one, and — only if you leave the switch on — the app version and build, platform, operating system version and language and region setting. With it, the random device identifier, and your account identifier if you were signed in | Reading what went wrong and, if you left an address, answering it. The device identifier limits how many reports one phone can send and tells one phone's reports apart from another's | 12 months, then deleted. Reports sent while signed in are deleted sooner, with the account |
What Duneed never holds
- The receipt image. It is sent once for reading and deleted immediately on every path out of that screen, including when the scan fails. It is never written to storage we own.
- Your location. The app does not ask for it and cannot read it.
- Your contacts, calendar, or photo library beyond the single image you choose to scan.
- Your name, phone number, address, or date of birth. There is no field for them — though a feedback message is kept exactly as you wrote it, so leave out what you would rather we did not have.
- Card details. Payment happens entirely inside the App Store. We are told whether you are subscribed, never how you paid.
- Personal data in the app server's logs. The logs of the server the app talks to carry request identifiers, timings and counts. Never an email address, never a session token, never a line of a receipt, never what a feedback message says. The website's own access log is different: for each page or file requested, it records the IP address, the forwarded-for address, the browser's identifier (user agent), what was requested, the referring page and the time. It is rotated by size: at most three files of up to 10 MB are kept, and the oldest is removed first.
Who else sees anything
The companies below receive something when you use Duneed: what, and what for.
| Who | What they get | What for |
|---|---|---|
| OpenAI | The receipt image, once | Reading the text off it, through OpenAI's API. We never store the image, and our own logs record only that a scan happened — never the picture, never what was read from it. |
| RevenueCat | An app-specific identifier and the store's purchase record | Telling the app whether premium is active, and keeping it in sync across devices |
| Apple | The purchase itself | Taking the payment. Apple's own privacy policy governs that. |
| Google (AdMob) | The app's requests for a banner ad, on the free tier | Showing the banner. See Advertising below. |
| Hetzner Online GmbH | Everything, as the machine it runs on | Hosting, in Germany |
Advertising
The free tier shows a banner from Google's AdMob under two of the lists — never on the scanner, the review screen or the paywall. Premium shows no ads, and the app does not request one for a Premium account.
When a banner is about to load and you have not yet answered Apple's tracking prompt, the app shows it. Ads are personalised only if you allow tracking; otherwise the app asks Google for ads that are not personalised, and the app works the same either way.
Getting your data out
Settings → Data produces a machine-readable file of what is currently in the app — pantry items, shopping list, receipts and categories — built from the copy on your phone. Entries you have removed are not in it. You do not need to ask, and there is no waiting period. For the other records listed above, write to us.
Deleting it
Settings → Delete account erases the account and its data immediately and permanently. There is no soft delete, no grace period and no hidden copy: the rows are gone from the database that serves the app, in one transaction. Deleting the account does not cancel a Premium subscription; that is cancelled separately, in your App Store account settings.
Deleting also asks Apple to revoke Duneed's Sign in with Apple authorisation, so the app stops appearing in your Apple ID settings. If Apple cannot be reached, the deletion still goes through and the app tells you how to remove it there yourself.
Some records survive, and each is deliberate:
- Records no longer linked to an account. The security log keeps its lines for that account identifier, including one recording that the account was deleted, and when; in Duneed's database the identifier no longer points at anything. Usage events stay, with your account identifier removed. The scan counts kept against the device stay, so that deleting an account does not reset the free limit. The device record stays as well, without its link to your account.
- Shared households, if other people are still in them. One you started passes to the member who joined earliest; from one you joined, only your membership is removed. Their receipts and their pantry are theirs, and your leaving must not take them. Nothing in a household is keyed to you personally.
Feedback you sent while signed in is deleted with the account. Feedback sent without an account carries nothing that ties it to one, so it stays until its 12 months are up.
Deleting the app without deleting the account leaves the account intact — that is what makes reinstalling work. Use the Settings row if you want it gone.
Your rights
Under the GDPR and Türkiye's KVKK you may ask for a copy of your data, correct it, delete it, take it elsewhere, or object to a particular use. Without asking us, you can edit what is in the app, export it from Settings → Data, and delete the account in Settings. For anything else, write to support@duneed.app. If the answer does not satisfy you, you can complain to the data protection authority where you live.
Children
Duneed is not built for children and is not directed at them. If you believe a child has created an account, write to us and it will be removed.
How it is protected
Everything travels over TLS. There is no password to steal: signing in goes through Apple, and Duneed never sees one. The database and cache are reachable only from the application container — they are not published to the internet at all. Session tokens live in the phone's Keychain or Keystore, never in ordinary app storage, and can be revoked from the server at any moment.
Changes
When this policy changes, the date at the top changes with it.