Privacy policy

Updated Nov 6, 2026. Changes are announced here.

Covers duestub.com, the DueStub extension, the web app, and our emails. DueStub is made by Plume & Throttle.

What we collect

• Your email address.
• When you agreed, and to which wording.
• Whether you confirmed.
• A source tag from your link, like ?from=reddit.

Our host and Cloudflare Turnstile (the form's security check) see your IP address. We keep only a one-way hash of it, for 24 hours, to limit abuse. Supabase, Resend and Cloudflare keep short logs that can include your IP and email.

Why we use it

We use it only to keep the sign-up list you joined. You agreed by ticking the box and confirming. You can withdraw at any time.

Where it is kept

• Supabase holds the Pro list database.
• Resend sends our emails.
• Cloudflare hosts this site and runs Turnstile and Web Analytics.

What we don't do

• No ads.
• Your data is never sold.
• No cookies. Our visit counter (Cloudflare Web Analytics) doesn't track you across sites.

How long we keep it

Until you unsubscribe. Unconfirmed addresses are deleted after 7 days.

Reminder emails

If you sign in to the extension, we email you before a charge, and after a first or yearly charge, at 9:00 your time. For each email, Resend gets your email address and, per reminder, the service name, amount, charge date and a cancel link. Resend keeps message logs.

Your account also stores your time zone, whether reminder emails are on, which reminders went out (for 30 days after the charge) and which subscriptions you muted. Every reminder email has a link that turns them off.

The web app

Signed in at app.duestub.com, it syncs with your account and keeps a copy in that browser until you sign out. No analytics, no cookies. Getting an email code runs Cloudflare Turnstile, a security check, from duestub.com. Cloudflare sees your IP address.

The extension

• Signed out, everything stays in your browser. Nothing is sent.
• On a checkout page it reads visible price, plan and trial text and the page's currency tags. It never reads form fields or card numbers.
• Signed in, these sync to your account: name, price, cycle, dates, status, cancel link, note and cancel steps. Supabase stores them encrypted at rest, not end to end. The checkout page's address stays in your browser.
• “Continue with Google” shares only your email address with DueStub.
• Getting an email code runs Cloudflare Turnstile, a security check, from duestub.com. Cloudflare sees your IP address.
• Settings has Download my data and Delete account.

Forwarded receipts (Pro)

If you turn on the receipt inbox, DueStub gives you a private address. Receipts you forward to it pass through Cloudflare, which delivers the mail. We never store the email itself. We remove card digits, order numbers, names and street addresses from the text, then Anthropic (Claude) reads it to fill in the service, price, cycle, next charge and cancel link. Anthropic deletes it within 30 days and doesn't use it for training. Our copy of the cleaned text is deleted within 24 hours.

We keep what was read (the service, price, dates, cancel link and verified sender) for 30 days after you add or dismiss it, and your receipt address until you delete your account. Nothing is added to your wallet until you press Save.

Payments (Pro)

Dodo Payments handles checkout and your card details as merchant of record. DueStub never sees your card number.

We store the payment id, the Dodo customer id and a log of Dodo's payment, refund and dispute events with their amounts and currency. We use them to switch Pro on, handle refunds and keep records for tax. The event log holds no name or email. We keep these as long as tax rules require.

Backups

Once a week we save a copy of the database on our own computer, not in the cloud, and keep it for 8 weeks. Deleting your account removes you right away; old copies are gone within 8 weeks.

Your rights

• Every email has an unsubscribe link. It deletes your address.
• Email hello@duestub.com to see, correct or delete your data. We reply within 30 days.
• You can also complain to your data protection authority (in the Philippines, the National Privacy Commission).