Privacy Policy

Account information. Your name, email address, and password. Passwords are hashed by our authentication provider — we never see or store them in plain text.

Business data you enter. Clients and their contact details, proposals, invoices, recurring schedules, notes, email templates, and follow-up history. This includes personal information about your clients (names, email addresses) that you choose to store. You are responsible for having a lawful basis to store your clients' information.

Usage records. Activity events inside your workspace (for example, "follow-up email sent") that power the activity feed and rate limiting, and standard technical logs (IP address, browser type) kept by our hosting provider for security and debugging.

What we do not collect: we do not process or store payment card details, bank credentials, or client funds, and we do not use advertising trackers or analytics cookies.

• All data is stored in a managed PostgreSQL database (Supabase) and is encrypted at rest and in transit (HTTPS/TLS everywhere, enforced with HTTP Strict Transport Security).
• Every workspace is isolated with database-level row security policies: your data is only readable by members of your workspace, enforced by the database itself, not just the application.
• Authentication is handled by Supabase Auth with secure, HTTP-only session cookies.
• The application enforces rate limiting and input limits to protect against abuse.

No system is perfectly secure, but if we learn of a breach affecting your personal data, we will notify you without undue delay.

We share data with a small number of service providers, only as needed to run the product:

• Supabase — database and authentication (stores all account and business data).
• Vercel — application hosting and delivery.
• OpenAI — only when you click to generate an AI email draft, the relevant context (client name, invoice or proposal details, your chosen tone) is sent to OpenAI's API to produce the draft. Under OpenAI's API terms, this data is not used to train their models.
• Resend — email delivery, only when you send a follow-up email through the platform.
• Google — only if you explicitly connect your Gmail account for sending (optional feature; see section 4).

These providers act on our instructions and may not use your data for their own purposes. We never sell your data, and we never "share" it for cross-context behavioral advertising, as those terms are used in California privacy law.

If you choose to connect a Gmail account, we store the OAuth tokens Google issues so we can send emails on your behalf, and your Gmail address so we can show you which account is connected. We request only the permission to send email (gmail.send) — we cannot read your inbox. Tokens are stored encrypted at rest, are accessible only to your user account, and are deleted when you disconnect Gmail or delete your account.

Duebird's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We use only essential cookies: the session cookies required to keep you signed in. We do not use advertising, analytics, or cross-site tracking cookies, which is why you do not see a cookie consent banner.

We keep your data for as long as your account is active. When you delete individual records (clients, invoices, proposals), they are removed from the live database. When your account or workspace is deleted, all associated business data is deleted with it; residual copies in encrypted backups expire on the backup provider's rotation schedule.

Wherever you are located, we extend the same rights to you:

• Access & portability — export your clients, proposals, and invoices at any time with the built-in CSV export.
• Correction — edit any record directly in the app.
• Deletion — delete individual records in the app, or email us to permanently delete your entire account and workspace. We complete deletion requests within 30 days.
• Objection or complaint — contact us with any concern; if you are in the EU/UK you may also lodge a complaint with your local data protection authority.

For any of these, email karmawk6@gmail.com from the address on your account.

If you are a California resident, the California Consumer Privacy Act as amended by the CPRA (Civil Code section 1798.100 and following) gives consumers rights to know, delete, correct, and limit the use of their personal information, and the right not to be discriminated against for exercising them.

Being straight with you about where we stand: the CCPA's duties fall on a business that crosses one of its thresholds — a high annual gross revenue figure that the state adjusts for inflation, personal information on 100,000 or more California residents or households in a year, or at least half its revenue from selling or sharing personal information. Duebird is a pre-revenue, invite-only product and crosses none of them, so we are not currently a "business" with CCPA obligations. We are telling you this rather than claiming compliance duties we do not have. We honor the access, correction, deletion, and portability rights described in section 7 for everyone regardless, and we will update this page if our size changes that analysis.

Two things are true whatever our size. We do not sell personal information and we do not share it for cross-context behavioral advertising — so there is nothing to opt out of, and we have no "Do Not Sell or Share My Personal Information" link because we would have nothing to put behind it. And we do not use your data or your clients' data to train AI models; when you generate a draft, the request goes to OpenAI under API terms that exclude training.

We also do not use automated decision-making technology to make significant decisions about anyone. The California Privacy Protection Agency's newer rules on automated decision-making, risk assessments, and cybersecurity audits apply to businesses covered by the CCPA, and we are not one, so they do not apply to us today.

To exercise any right, email karmawk6@gmail.com. We will verify your request against the account it relates to, and you may use an authorized agent. We do not charge for this.

When you store information about your clients in the Service, you are the data controller — the "business", in California terms — for that information, and we process it on your instructions as your service provider. If one of your clients asks you to delete their information, you can do so directly in the app; deleting a client removes their contact details from your workspace.

In that role we do not sell or share your clients' personal information, do not retain, use, or disclose it for any purpose other than providing the Service to you, do not use it for our own commercial purposes, do not combine it with personal information we get from anyone else except as the law permits, and will help you respond to requests your clients make about their own information. The matching commitments are in section 2 of our Terms & Conditions. If one of your clients contacts us directly, we will point them to you, since the data is yours to correct or delete.

The Service is for business use and is not directed at children. You must be at least 18 to use it, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has given us personal information, email us and we will delete it.

If we make material changes to this policy, we will update the effective date above and take reasonable steps to notify you before the changes take effect.

Privacy questions or requests: karmawk6@gmail.com. See also our Terms & Conditions.