Privacy Policy

Last updated 26 October 2026

DueTrack keeps track of when things expire — documents, cards, medicines, warranties, and anything else with a date on it. To do that it has to hold some information about you, and this page says exactly what — in plain language, because a privacy policy nobody can read is not consent.

Who we are

DueTrack is operated from the United Kingdom. For questions about this policy, or to exercise any of the rights below, write to hello@duetrack.co. We are the data controller for the information described here.

What we collect

Account information

• Your email address, which is how you sign in and how we reach you.
• A display name and, if you sign in with Google, your Google profile photo.
• The country pack you choose, so that the right document types and renewal guidance are shown.
• Whether, and when, you agreed to us storing health information, and if you later withdrew that agreement.
• Whether you have completed setup, and which plan you are on.

What you track

For each item you add — a document, a card, a medicine, a product, a warranty or a subscription — we store the category, the label you give it, the issue (or manufacture) and expiry dates, an optional note, whether it is archived, and the last four characters of its reference or batch number. You may also create "holders" — a partner, a child, a business — with a name and a relationship, so items can be grouped by whose they are.

What we never store

• Images of anything you scan. A photo or PDF you scan or upload — of a document, a card or a packet — is held in memory only for as long as it takes to read the dates from it, and is discarded when you save or close the form. There is no image field in our database and nothing is written to disk.
• Names from pharmacy labels. If a medicine you scan carries a dispensing label with a patient's name, that name is not kept. You choose whose medicine it is from your own holders.
• Full card numbers, or CVV codes. If you track a payment card, only the last four digits are kept.
• Passwords. Sign-in is by one-time email link or by Google, so there is no password for us to hold.
• Your payment details. Card information is entered on Stripe's own checkout page and never reaches DueTrack.

Reminder delivery

If you turn on notifications, your browser gives DueTrack a delivery address at its own push service — Google's for Chrome, Mozilla's for Firefox, Apple's for Safari — together with two public keys. We store those against your account so a reminder can be sent to that device, along with the browser's user-agent string so you can tell your devices apart. The message itself is encrypted to your browser's key: the push service that carries it cannot read it.

You can stop reminder emails at any time — the switch is in Settings → Alerts, and every reminder carries an unsubscribe link that works without signing in. Turning them off changes nothing else: everything you track, its dates and its countdowns stay exactly as they are.

We also keep a record of which reminders have already been sent — the document, the threshold, the date — so that the same reminder is never sent twice. A reminder names the item and its expiry date and nothing else; there is no document number stored to include in one. A reminder about a medicine names the medicine, and a notification can appear on your lock screen, where anyone holding your phone may see it. Turning notifications off in DueTrack deletes that device's delivery address, and deleting your account deletes all of it.

Technical information

Our hosting provider records ordinary server logs — IP address, browser type, the page requested and when. These are used to keep the service running and secure, and to diagnose faults.

Medicines and health information

A medicine says something about the health of the person it is for. UK and EU data protection law treat information about health as a special category, and we hold it only with your explicit consent (UK GDPR Article 9(2)(a)).

• When we ask. The first time you add a medicine — or an emergency medicine such as an adrenaline auto-injector or a rescue inhaler — the app explains what will be kept and asks whether you agree. Nothing about the medicine is saved unless you do. If you say "Not now", you can still track everything else.
• What it covers. The name of each medicine you add, its expiry and manufacture dates, the holder it belongs to, an optional note, and the last four characters of its batch number. It covers medicines you add to any holder in your account, so please add a family member's medicines only if they are happy for you to.
• What we use it for. Reminding you before each medicine expires — by email, by notification, and as an event in your Google Calendar if you have turned calendar sync on — and nothing else. It is not used for advertising, it is not given to ad providers, and it is not sold or shared.
• What we record. When you agreed, and which version of this policy you were shown, so that we can show the consent was given.
• Withdrawing. You can withdraw at any time in Settings → Security → Health information. Withdrawing deletes every medicine on your account, along with the record of reminders sent about them, and the app will ask again before you add another. Withdrawing does not affect anything we held while your consent stood.

Other health-adjacent items — a first aid kit, baby formula, sunscreen — are tracked like any other product. They say nothing about anyone's health, so no separate consent is asked for them.

Sharing an item with someone

You can share an item you track with one other person at a time, by sending an invitation to their email address or by sending them a link yourself — by WhatsApp, text or anything else.

• What they see. Once they accept, the item appears in their own vault: its name, category, dates, the last characters of its reference or batch number, its notes and its renewal history. They can renew or edit it, and you see their changes, as they see yours. They never see the rest of your vault, your other holders, or your email address — only your first name.
• What the invitation shows. Before it is accepted, an invitation shows your first name and the item's name and type. An invitation for a medicine does not name the medicine, in the email or on the link.
• Who can accept. Each invitation works once, for the first person to accept it, and expires after 14 days. An invitation sent to an email address can only be accepted by someone signed in with that address. We keep only a fingerprint (a hash) of each link, never the link itself.
• Invitation emails. When you share by email, we send the invitation to the address you type, on your behalf. We use that address only for that invitation, and keep it with the invitation so the right person can accept it.
• Medicines. Sharing a medicine shares health information about the person it is for, so please share it only with someone they are happy to see it. The person receiving it is asked for their own explicit consent before it is added to their vault.
• Ending it. You can stop sharing at any time, and the person you shared with can remove the item from their vault at any time. If you delete the item, it is removed from their vault too. They receive their own reminders while it is shared, and we keep a record of which reminders were sent to them, which is deleted when sharing ends.
• Referrals. A share link carries your referral code, so if the person signs up through it, it counts as your referral.

How what you scan is read

When you scan or upload something, the image is sent to Google's Gemini API, which returns the text it reads. Google processes the image to produce that answer; it is not retained by us afterwards, and it is not used by us for anything else. If you would rather not have an image leave your device at all, you can type the details in by hand — every field the scanner fills can also be entered manually. That includes medicines: if you would prefer that a packet is never photographed, type its name and expiry date instead.

For passports and identity cards, the reader transcribes the machine-readable strip, and our own code then checks it against the strip's check digits — so a misread strip is caught rather than trusted.

How we use Google user data

Signing in with Google gives us your name, email address and profile picture, and nothing else. We use them to identify your account and to show who is signed in.

Google Calendar is separate, optional, and asked for only at the moment you switch calendar sync on — never as part of signing in. If you agree, DueTrack requests a single permission:

• https://www.googleapis.com/auth/calendar.events — permission to manage events on your calendar.

We use it for exactly three things, all of them events this app created:

• Create an all-day event on the expiry date of a document you are tracking, with reminders before it.
• Update that event when you change the document's expiry date.
• Delete that event when you delete the document or turn sync off.

What we do not do with it: we never read your calendar, never list your events or calendars, never look at anything DueTrack did not create, and never store a copy of your calendar data on our servers. The only Calendar information we keep is the identifier of the event we created, saved against your document so we can update or remove that same event later.

Google Calendar data is never shared with anyone, never sold, never used for advertising, and never sent to any third party — including the document-reading service described above.

You can withdraw Calendar access at any time by turning sync off in DueTrack, or by removing DueTrack from your Google account permissions. Doing so stops all future access immediately; events already created stay on your calendar until you delete them.

Why we are allowed to hold it

Under UK and EU data protection law we rely on:

• Performance of a contract — we cannot tell you when your passport expires without holding the expiry date.
• Legitimate interests — keeping the service secure, preventing abuse, and fixing faults.
• Consent — for optional features you switch on yourself, such as Google Calendar sync. You may withdraw it at any time by turning the feature off.
• Explicit consent — for medicines, which are health information. See Medicines and health information.
• Your instructions — when you share an item, we show it to the person you chose and send the invitation you asked us to send.
• Legal obligation — retaining records of payments for as long as tax law requires.

Who else is involved

We use a small number of providers, each for one job:

• Google Firebase — sign-in and account identity, and a second copy of your vault so it can be restored on a new device.
• Google Gemini — reading the text from an image you scan or upload, as described above.
• Supabase — the database the details of what you track are stored in.
• Resend — sending reminder emails.
• Vercel — hosting and server logs.
• Stripe — payments. Stripe holds your card details; we hold only whether you are subscribed and until when.
• Google Calendar — only if you switch calendar sync on, and only the renewal events you ask it to create. See How we use Google user data.
• Google Analytics and Google Tag Manager — counting visits and which pages get read, as described below.
• Google AdSense — the advertising shown to free accounts.

On the free Personal plan the app shows advertising. Ad providers may set their own identifiers; they are never given the details of anything you track — least of all a medicine — and Premium removes advertising entirely.

We do not sell your personal information, and we do not share it for anyone else's marketing.

Cookies and measurement

Two things on this site are not needed to make it work, and you can switch either off at any time.

If you are in the UK, the EEA or Switzerland, nothing is stored until you have been asked. Google's consent message appears on your first visit, and until you answer it the tags load with storage switched off and record nothing that identifies you. Elsewhere, measurement is on from the first page you open and the controls below turn it off.

Measurement. Google Analytics, loaded through Google Tag Manager, counts visits and records which pages are read, roughly where in the world the visit came from, and which site sent you. It is how we know whether the renewal guides are useful. It sets its own cookies and does not receive anything about your documents.

Advertising. Google AdSense serves the ads shown to free accounts. It sets its own cookies and may use them to choose which ad to show. It is never given your document details, and it is not loaded for anyone on Premium once ads are switched off for that account.

Changing your mind. Refusing is one tap, in the same place and the same size as accepting, and it costs you no feature of the product. You can change your answer whenever you like: Cookie settings here, the same link in the footer of every page, or Settings → Security → Cookies and ads inside the app. Where Google asked you, that link reopens Google's own dialogue, so you are editing the answer it actually honours rather than a second copy of it. You can also clear these cookies in your browser, turn off ad personalisation for your Google account at myadcenter.google.com, or block them with a content blocker — none of which will break anything here.

Where your data is held

Our providers operate infrastructure in the United States and Europe, so your information may be transferred outside the UK and the EEA. Those transfers are covered by the standard contractual clauses or an equivalent safeguard offered by each provider.

How long we keep it

Everything you track stays in your vault until you delete it or close your account; medicines are also deleted if you withdraw your consent. Delete your account and the account record, its holders and everything in it are removed from our database. The record of when you gave or withdrew consent for health information is kept for as long as we might need to show it, and no longer than six years after your account closes. Payment records are kept for as long as tax law requires. Server logs are kept for a short period and then discarded.

Support access

Very occasionally, resolving a support request requires someone on our side to look at an account. Access to a person's documents by staff is restricted, requires a written reason, and is recorded in an audit log alongside who looked, when, and why. We do this only in response to a request from you or to investigate a fault, never to browse.

Security

Traffic is encrypted in transit. Every request for your data is authenticated against your account, and the copy of your vault held in your browser for offline use is scoped to your account and erased when you sign out. You can add a PIN or biometric lock to the app itself. No system is perfectly secure, but not storing document images means the most sensitive thing you could lose is not there to lose.

Your rights

You can ask us to give you a copy of your data, correct it, delete it, or restrict what we do with it. Most of this you can do yourself in the app — edit or delete anything you track at any time, and withdraw consent for medicines in Settings. For anything else, email hello@duetrack.co and we will respond within 30 days. If you are in the UK you may also complain to the Information Commissioner's Office; in the EU, to your national supervisory authority.

Children

DueTrack is not intended for children under 16, and we do not knowingly create accounts for them. An adult may of course track a child's passport, car seat or medicine within their own household vault — those entries belong to the adult's account.

Changes

If this policy changes in a way that affects you, we will say so in the app and update the date at the top. Continuing to use DueTrack after a change means you accept the updated policy.

Contact

hello@duetrack.co