Privacy Policy
dupla is a personal-finance app for couples. This policy explains what data we collect, what we use it for, and the control you have over it. The short version: your data is yours — we don't sell it, there are no ads, and we use limited product analytics to improve the app without sending financial content.
dupla is operated by CGIS LLC, 8 The Green, Suite A, Dover, DE 19901, USA.
What we collect
- Account: your email address and name, to create and identify your account. If you sign in with Google or Apple, we receive the email and name associated with that account.
- Financial data you enter: expenses and income entries (amount, currency, merchant, note, category, tags, date), budgets, goals, lists, recurring expenses and — if you choose to add it — your monthly income (used only to split expenses proportionally to income).
- Mercado Pago movements (optional): only if you connect your Mercado Pago account in Settings. With your authorization, dupla reads the movements of your Mercado Pago balance and the payments you make through Mercado Pago: date, amount, currency, and the description Mercado Pago gives them, which can include the name of a shop or of the person on the other side of a transfer. They wait in an inbox only you can see until you save each one as an expense or income, or ignore it. To produce the list, dupla asks Mercado Pago for reports of your account, and Mercado Pago may email you when one is ready. We never see your Mercado Pago password; the access Mercado Pago grants us is stored encrypted, used only to read, and deleted when you disconnect.
- Receipt photos: only if you choose to attach them to an expense. The app accesses your photos only when you pick one.
- Voice recordings (optional): only when you hold + or tap the microphone to add expenses by voice. The app uses the microphone only while you record. The recording is turned into text, the text into expense drafts you review before anything is saved, and the recording is deleted as soon as that is done: we don't keep the audio, and the text is used only to show you the drafts. Using voice input means agreeing to send the recording to DeepInfra (or Groq, when DeepInfra is unavailable) and its text to Anthropic (or DeepInfra, when Anthropic is unavailable) as described below; if you'd rather not, add expenses by hand.
- Preferences: language, currency, theme, and interface settings.
- Product analytics: screens visited and actions such as completing onboarding, saving an expense, or creating a list, associated with an account identifier and basic app/device information. Analytics does not include your name, email, amounts, merchants, notes, list contents, receipt photos, or invitation codes. We do not record your screen or use analytics for advertising.
- Push notifications: only if you turn them on. We store your device's notification identifier (a token issued by the system) linked to your account, so we can let you know when your partner adds a shared expense, records a payment, or a budget reaches its limit. You choose which notifications to receive, you can turn them off at any time, and the token is deleted when you sign out or delete your account. We never send notifications for advertising.
We do not collect your location, contacts, or data from other apps. We do not connect to your bank or ask for banking credentials: the only account dupla can read is Mercado Pago, and only if you connect it.
How sharing with your partner works
Visibility between you and your partner is always symmetric and consent-based:
- Your partner sees the expenses you mark as “Ours”, shared budgets and goals, your name, and — if you added it — your income.
- Your partner does not see your personal (“Mine”) expenses, your personal budgets, or anything you don't deliberately share.
What we use data for
To make the app work: syncing your data across your devices and with your partner, computing splits and balances, and authenticating you. We also use limited usage events to understand which features work well and where the app needs improvement. We don't use your data for advertising, don't sell or share it with third parties for commercial purposes, and don't train models on it.
Where data lives (providers)
We use infrastructure providers that process data on our behalf:
- Convex — database and sync (your expenses, budgets, and receipt photos live there).
- Clerk — authentication (email, Google/Apple sign-in).
- Expo — app update delivery. If you turn notifications on, it also delivers them: it receives your device token and the text of each notification to hand it to Apple or Google, never your identity or your financial records beyond what the notification says (which discreet mode limits).
- RevenueCat — subscriptions: receives the state of your purchase from the App Store or Google Play (product, renewal and expiry dates) together with an identifier for your account and device. It never receives your expenses or your card; the store processes the payment.
- Sentry — crash reporting: when the app crashes, it receives the error, the device model and the OS version. Never your identity, your email or your expenses, and it does not record how you use the app.
- PostHog — product analytics using the limited usage events described above. Financial content stays out of analytics.
- DeepInfra — voice entry only: turns each recording into text and, when Anthropic can't answer, proposes the expense drafts from that text. It receives the recording and a few words that help it recognize the names you use (your and your partner's first names, your category, payment method and tag names) and, in that second case, the same text and details Anthropic would; never your email or your account.
- Groq — voice entry only, as a backup when DeepInfra is unavailable: turns the recording into text. It receives the recording and the same few words, never your email or your account.
- Anthropic — voice entry only: reads the text of each recording and proposes the expense drafts. It receives that text, today's date, your currency, your and your partner's first names, and your category, payment method and tag names, never your email, your account or your saved expenses.
- Mercado Pago — only if you connect it: the source of the movements described above. We don't send your dupla data to Mercado Pago.
Data is always encrypted in transit (HTTPS/TLS).
Data deletion
You can delete your account and all your data directly in the app: Settings → Delete my account. Deletion is permanent and includes your expenses, budgets, goals, receipt photos, and any movements imported from Mercado Pago. Disconnecting Mercado Pago (Settings → Mercado Pago → Disconnect) deletes its access right away. You can also email hola@dupla.money and we'll do it for you. Step-by-step instructions and what is kept: Delete your account.
Analytics events are stored separately from your financial records and are not automatically erased by the in-app account deletion flow. Contact hola@dupla.money to request deletion of analytics linked to your account.
Children
dupla is not directed at children under 13, and we do not knowingly collect data from children.
Changes to this policy
If we change this policy, we'll update this page and the date above. For significant changes, we'll notify you in the app.
Contact
Questions? Email us at hola@dupla.money.