Duezy

Legal

Privacy Policy

Effective date: 2026-08-15

Last updated: 2026-08-15

This policy has not been reviewed by an attorney. It is our plain description of what we collect, why, and what you can do about it. It is not legal advice to you.

1. Who we are, and which role we play

Duezy is operated by Drew Conrad, an individual. "Duezy" is the name of the service, not a company. You can reach us at tigercubs113@gmail.com or by mail at Drew Conrad (Duezy), 226 N 5th Ave SW, Rome, GA 30165-2851.

We handle two different kinds of data, and we play a different role in each.

Data about the treasurer and about our own service. This includes the account you sign in with, your group's subscription record, and our technical logs. For this data we are the data controller. We decide what to collect and why.

Data the treasurer enters about members and their parents. This is the roster, the balances, the ledger, and the parent email addresses. For this data your group is the data controller and Duezy is the processor. Your group decides who goes on the roster, what gets recorded about them, and why. We hold and process that information on your group's instructions, to run the service for your group, and for no other purpose. We do not decide what goes into your roster and we do not use it for anything of our own.

This split matters most in section 5, which is about children.

2. What we collect from treasurers

When you sign up as a group treasurer, we collect:

  • Your name and email address from your Google account, through Google's OAuth sign-in. We request only the basic profile and email scopes. We never receive your Google password.
  • Information about your group that you enter, including its name, type, location, and the contact details you add.
  • Ledger entries, payment descriptions, and other content you create in the application.
  • Your group's subscription record: a Stripe customer identifier, the plan you chose, your subscription status, and the relevant dates. You enter card details directly with Stripe through the Stripe Customer Portal. We never see or store your card number.
  • Your Stripe connected-account ID and the status of your Stripe Connect onboarding, once your group connects a Stripe account. We do not see or store your Stripe password or your bank-account numbers. That information stays with Stripe.
  • Your IP address and basic request metadata, for rate limiting and for diagnosing problems.

3. What we collect about members

Members do not have accounts on Duezy and never sign in. We collect only what a treasurer enters about each member:

  • The member's name.
  • An external member ID, if the treasurer adds one.
  • Group role, sub-group, and join date, if the treasurer adds them.
  • Ledger entries and the balance tied to that member.

We do not collect member contact information. No member email address, no member phone number, no member home address. The only adult contact tied to a member is the parent or guardian email a treasurer enters for billing.

Everything in this section is entered by your group's treasurer, and your group is the controller of it.

4. What we collect from parents and guardians

Parents and guardians do not create accounts. When a treasurer links a parent to a member, we collect:

  • The parent's email address, entered by the treasurer.
  • Records of the emails we send that parent, including balance statements, payment receipts, and event notices, and the pages the parent loads when they click a link in one. Two links in an event notice last the longest: the link to the event works for 30 days, and the unsubscribe link in that notice works until the end of the calendar month. Every other link we send a parent stops working 7 days after it is sent, including the link in a balance statement, the link in a payment receipt, and the unsubscribe link in a balance statement.
  • Records of payments the parent makes to your group through Stripe. The parent enters payment details directly with Stripe. We do not see or store card numbers, bank-account numbers, or other payment credentials. We receive the result of the payment, the amount, the date, and a Stripe transaction identifier.

5. Children's privacy and COPPA

Some groups track members who are under thirteen years old. We treat all member data as if it could describe a child.

Children do not interact with Duezy at all. Children do not sign in, do not receive our emails, do not click our links, and do not see any of our pages. We have no direct relationship with any member and we collect nothing from children directly. We do not knowingly collect personal information from a child. Every piece of information about a member reaches us because an adult treasurer typed it in on behalf of the group.

The group is responsible for having the right to enter that information. Because your group is the controller of roster data, your group decides which children go on the roster and what is recorded about them. Before a treasurer enters a member's name or details, the group needs whatever permission its own rules, its parent organization's rules, and the law require. We cannot obtain that permission on your group's behalf and we do not attempt to.

A parent or legal guardian can ask us to delete a member's record or to give them a copy of what we hold about that member. Because the group controls the roster, we verify the request through the group's treasurer, then act within thirty days.

If you are a parent or guardian with questions about how Duezy handles your child's data, email us at tigercubs113@gmail.com.

6. How we use the data

We use the data above to:

  • Run the service and keep your group's ledger.
  • Send treasurers messages about their account, security alerts, billing notices, and material changes to the terms or this policy.
  • Send parents and guardians balance statements and payment receipts.
  • Investigate errors, prevent abuse, and improve the service.
  • Comply with the law and respond to lawful requests.

We do not sell your data. We do not use it for advertising. We do not share it with data brokers.

7. Our email is transactional only

Every email Duezy sends is about the account or the service: balance statements, payment receipts, billing notices, security alerts, and policy changes. We do not send marketing email through the product, and we do not rent or sell any email address to anyone.

Because account and billing messages are part of the service, a treasurer cannot opt out of them and keep using Duezy. Parents and guardians can unsubscribe using the unsubscribe link carried in a balance statement or an event notice.

8. Who we share data with

We share data only with the service providers we need to run Duezy, and only for that purpose. Today those providers are:

  • Supabase, for database hosting and authentication.
  • Vercel, for application hosting and serverless functions.
  • Stripe, for payment processing through Stripe Connect and for our own subscription billing.
  • Resend, for transactional email delivery.
  • Upstash, for rate limiting through a Redis store.
  • Sentry, for error and crash tracking.
  • Google, as the identity provider for treasurer sign-in.

Each provider operates under its own privacy policy. Links are in section 15.

We may also share data if the law requires it, in response to a valid legal request, or if we need to protect people from harm. We will tell you about a legal request when we are allowed to.

We will never sell your data, and we will never share it with advertisers or data brokers.

9. Cookies and tracking

Duezy uses a session cookie set by Supabase Auth so you stay signed in. We also use a short-lived key in our rate-limit service to count requests. That is all.

We do not run analytics pixels, advertising networks, or third-party trackers. Sentry runs server-side and does not place a tracking cookie in your browser.

10. How long we keep data

We keep your group's data while your subscription is active.

When a subscription ends, whether you cancelled, your trial ended without a subscription, or a payment failed and was not fixed, your group's data enters a 30-day export window. You can sign in and export during that window. When it closes, we permanently delete your group's data. Deletion is final and we cannot recover it afterward.

Two things outlive that deletion, and neither is under our control:

  • Payment records held by Stripe stay with Stripe under Stripe's own retention rules, which include periods Stripe and tax authorities require.
  • Operational logs and database backups roll off on the schedules set by our hosting and database providers.

11. Getting a copy of your data

A treasurer can export the group's data from inside the app at any time while the subscription is active. After a subscription ends, that export stays available during the 30-day window in section 10.

If you cannot reach the in-app export, email us at tigercubs113@gmail.com and we will deliver one within thirty days.

12. Deleting data

A treasurer can ask us to delete their group's data, and a parent or guardian can ask us to delete a member's record. We act within thirty days. We may keep the limited records described in section 10, and we will not use them for any other purpose.

Deletion at the end of the export window happens automatically and does not need a request.

13. Security

We use TLS for data in transit. Supabase encrypts the database at rest. Each group's data is isolated through row-level security, so one group cannot read another group's data through the application.

No system is perfectly secure, and we do not claim Duezy cannot be breached. If we discover a breach affecting your data, we will tell you within the time the law requires and we will tell you what we know.

14. Your rights

Depending on where you live, you may have additional rights over your data.

If you are a California resident, you can ask what personal information we hold about you, ask us to delete it, and ask us not to sell it. We do not sell personal information.

If you are in the European Economic Area or the United Kingdom, you can ask us for a copy of your data, ask us to correct it or delete it, ask us to restrict how we use it, or object to how we use it. You can also complain to your local data-protection authority.

If your request concerns roster data, your group is the controller of that data, so we will work through your group's treasurer to verify and answer it. If your request concerns your own treasurer account, come straight to us.

To exercise any of these rights, email tigercubs113@gmail.com. We respond within thirty days.

15. Third-party policies

16. Changes to this policy

We may update this policy. When we do, we will post the new version here with a new effective date. For material changes, we will email treasurers or show an in-app banner before the change takes effect.

17. Contact

Drew Conrad (Duezy)
Email: tigercubs113@gmail.com
226 N 5th Ave SW
Rome, GA 30165-2851