Privacy
Effective: September 22, 2026
Who we are: Dutiful. Contact: alenayouu@gmail.com.
What Dutiful does
Dutiful reads photos of mailed letters and turns them into a short explanation, a deadline, and reminders. To do that it has to process the letter itself, though it does not keep the photo. This page says what we keep, where, for how long, and who can see it.
What we collect
Account. Your email address and a sign-in identifier when you sign in with Apple, Google, or email and password. Sign in with Apple may give us a relay address instead of your real email.
Letters you scan. The fields read from the photo: who sent it, the amount, the due date, what happens if it is ignored, the next step, the name it is addressed to, and the plain-language explanation for your family member. Any reminder dates and family names you add in the app. Not the photo. The photo stays on your phone; it passes through our own server to be read (see below) and is never stored there.
Feedback you give. A thumbs up or down on a letter, which field was wrong, and any note you type. Feedback you send from Settings.
This website. The Dutiful website does not ask for your email or any other detail about you. It sends anonymous page analytics to PostHog, which are not tied to a name or an email address. Emails given to the earlier beta sign-up form are still held in Formspark (our form service); they are never sold or shared, and writing to alenayouu@gmail.com removes yours.
Usage counts. How many letters were read and when, so free-tier limits work.
Crash reports. If the app crashes, a technical report (device model, iOS version, what the app was doing) goes to Sentry. It does not include your letters.
Product analytics. Which screens you reach and which steps you finish — opened the app, signed in, scanned a letter, the kind of notice it was, whether a read succeeded — go to PostHog, tied to your account id. They never include your letters, photos, sender names, amounts, or the words you type.
Subscription status. Not sold in this version. The RevenueCat SDK is present and records an anonymous app-user id so a later paid version can restore purchases.
We do not collect your contacts, location, or advertising identifiers, and we do not track you across other apps or websites.
How letters are read
The photo is sent from your phone to a server of ours, which passes it to Google's Gemini model on Vertex AI to read the text and fill the fields above. Our server keeps no copy: it holds the photo only for the seconds the reading takes. This runs under a business associate agreement with Google, and Google does not use your content to train its models or keep it after the letter is read. The photo is not sent from your phone to Google directly, and no AI keys live in the app.
Where data lives and for how long
- Data is stored on LingCode Cloud, a managed Postgres database and file store, encrypted in transit (TLS) and at rest.
- Letter photos are never stored on our servers. They stay on your phone. The extracted fields and explanations stay with the letter until you delete the letter or your account. Photos from letters read before September 22, 2026 were removed from our servers on that date.
- Access is enforced by row-level security: each signed-in account can read only its own rows.
- If you share a letter with a family member, a read-only web card is created at a link only you send. It shows the explanation, not the photo, and is deleted with the letter.
Delete your data
Settings → Delete my account removes your profile, every letter, its photo on this phone, share links, usage records, feedback, and the login itself. It cannot be undone. You can also delete a single letter from its page. Product analytics held by PostHog are not removed by this button; email alenayouu@gmail.com and we will delete them.
Notifications
Reminders are scheduled on your phone. You can turn notifications off in iOS Settings.
Children
Dutiful is for adults managing family paperwork and is not directed at children under 13.
Changes
If this policy changes we will update this page and the effective date.