1. The short version

• Your deadlines and what you paste stay on your phone. DueTape has no accounts. We never receive your deadline list or your pasted group-chat messages unless you choose to attach a paste to feedback.
• Only two optional features send anything to our server: feedback (when you tap Send) and reminders (when you turn them on).
• No ads, no cross-site tracking, no selling of data. DueTape reads your pastes with simple rules on your phone. It does not use AI, and it makes no decisions about you.
• You can stop anytime. Turning reminders off deletes your reminder data from our server. Feedback is deleted automatically (pasted text after 30 days, everything after 180 days).

2. Who we are and how to reach us

DueTape is a free app made by an independent developer in the Philippines. For the Philippine Data Privacy Act of 2012 (Republic Act No. 10173, the “DPA”), the developer is the personal information controller: the one who decides how the small amount of data described here is used.

Privacy contact: hello@duetape.com. We do not publish a personal name. The developer is responsible for this policy and reads messages sent to this address.

3. What stays on your phone

When you use DueTape normally, everything below is stored only in your browser’s storage on your phone (IndexedDB or on-device SQLite):

• deadlines, courses, notes and settings;
• the group-chat messages you paste in, and the deadlines DueTape finds in them;
• your backup file, if you tap Export a backup (it is saved as a file on your phone; we never receive it).

The reader that turns a paste into a deadline runs on your phone, using fixed rules. It does not use AI. We cannot read, recover or restore this data. If you clear your browser data, uninstall the app, or tap Wipe all data, it is gone, so export a backup if you want to keep it.

4. What leaves your phone, and only if you choose

4.1 Feedback

When you open Send feedback and tap Send, we receive:

Your face rating (Hirap / Okay lang / Ayos!)

Needed to send.

Your note

Optional. Please don’t include anyone’s private details.

What you pasted (“Attach what I pasted”)

Optional, off by default. Your most recent paste, only if you switch this on. It may contain other people’s names, so please remove them first.

App version and phone type

Sent with feedback. Phone type is general only, such as “Android · Chrome”.

Date and time received

Added by our server.

We don’t collect a name, email, account or device ID with feedback, and we do not store your IP address. To stop spam, our server briefly uses a scrambled (hashed) form of your IP address in memory to limit how often feedback can be sent. That hashed value is never saved.

If you are offline when you tap Send, the feedback waits on your phone and is sent when you’re back online.

Why: to fix bugs and improve how DueTape reads deadlines. Legal basis: your consent, given by tapping Send (DPA s.12(a)). Attaching your paste is a separate choice. If a paste contains sensitive personal information, it is processed only with that specific consent (DPA s.13(a)), and we delete it after 30 days.

How long: pasted text is deleted 30 days after we receive it. The whole feedback entry is deleted 180 days after we receive it. Who can see it: only the developer, through a login-protected page.

4.2 Reminders

If you turn on Reminders, your browser asks permission to show notifications. If you allow it, we receive and store:

• A push subscription from your browser: a web address (endpoint) and encryption keys, so we can deliver a notification to this phone.
• For each upcoming deadline with a reminder: its title (which may include a course code), its due time label, and when to send the reminder.
• Your time zone, your reminder settings, and the dates the row was created and last updated.

We do not receive your full deadline list, notes or pastes. Reminders are sent through your browser maker’s push service: Google (Firebase Cloud Messaging), Apple (Safari) or Mozilla (Firefox). The reminder text is encrypted so the push service carries it but cannot read it. The push service does see the push address and can hold an undelivered message for up to 24 hours.

Legal basis: your consent, given by switching Reminders on and allowing notifications, and providing the service you asked for (DPA s.12(a) and (b)).

• Turn Reminders off and we delete everything about this phone from our server.
• A reminder that has already been sent is deleted 7 days after its send time.
• If a phone doesn’t check in for 60 days, we delete its subscription and reminders.
• If the push service says the subscription no longer works, we delete it.

4.3 Hosting

DueTape runs on Cloudflare. When your phone loads DueTape or talks to our server, Cloudflare’s network briefly processes technical information such as your IP address and browser type, to deliver the app and protect it from attacks. We do not use this to identify you, and we don’t keep request logs ourselves.

4.4 Web analytics

We use Cloudflare Web Analytics to count visits and page views. It uses no cookies, doesn’t track you across sites, and doesn’t collect your deadlines or messages.

5. What we never do

• No ads, ad networks or tracking pixels.
• No behaviour tracking across sites (Cloudflare Web Analytics counts visits only; see section 4.4).
• No selling, renting or trading of data.
• No AI processing of your pastes or feedback.
• No profiling or automated decisions about you.
• No marketing notifications. Reminders are only the ones you set.

6. Who else handles the data

Cloudflare, Inc. (USA)

Hosting provider (“personal information processor”) under Cloudflare’s Customer Data Processing Addendum. Stores feedback and reminder data and runs our server code.

Google, Apple or Mozilla

Push services. They carry encrypted reminder messages to your phone. Which one depends on your browser.

We would only share data with anyone else if the law requires it (for example, a valid order from a Philippine court or the National Privacy Commission).

7. Data stored outside the Philippines

Cloudflare and the push services run servers in many countries, so your feedback and reminder data may be stored or processed outside the Philippines. We remain responsible for it under DPA s.21, and we rely on Cloudflare’s data processing terms to protect it.

8. How we protect it

• We collect as little as possible: no accounts, no names, no emails, and no stored IP addresses.
• Data is encrypted in transit (HTTPS). Reminder messages are encrypted end-to-end to your browser.
• Only the developer can read feedback, through a page protected by Cloudflare Access login.
• Automatic deletion (30 days, 180 days, 7 days and 60 days, as above).
• Server secrets, such as the reminder signing key, are kept as encrypted secrets, never in code.

No system is perfectly secure. If a data breach happens that puts you at real risk of serious harm, we will notify the National Privacy Commission and affected users as the law requires (within 72 hours of learning of it). Because we don’t know who you are, we’d do this with a notice in the app.

9. Children and students under 18

DueTape is made for students, including senior high school students, so some users may be under 18.

Under 18? Best if a parent or guardian knows you use it.

• DueTape is not meant for children under 13. Please don’t use it if you’re under 13. If we learn that we have data from a child under 13, we will delete it.
• We ask you to confirm you are 13+, and we don't save your birthdate or age.
• If you’re under 18, use DueTape with a parent’s or guardian’s knowledge, and check with them before sending feedback with pasted messages.
• We keep “Attach what I pasted” off by default.
• Parents or guardians can reach us at hello@duetape.com.

There’s a simple version of this policy for younger users: Privacy, the simple version.

10. Other people’s information in your pastes

Group-chat messages can include other people’s names, messages and sometimes personal details. That text stays on your phone unless you attach it to feedback. Before switching on Attach what I pasted, please delete names and anything personal that isn’t needed to show the problem. We use pasted text only to fix the deadline reader, and we delete it after 30 days. If you believe your information was sent to us in someone else’s paste, email hello@duetape.com and we’ll delete it if we can find it.

11. Your rights

Under the DPA (ss.16–18) you have the right to be informed, to access the data we hold, to correct it, to object and withdraw consent, to have it erased or blocked, to data portability (Export a backup), to claim damages, and to file a complaint with the National Privacy Commission (privacy.gov.ph). We’d appreciate the chance to fix it first.

• Reminders: switch Reminders off. This deletes your data on our server at once.
• On-device data: use Wipe all data, or clear the site’s data in your browser.
• Feedback: because feedback is anonymous, we can’t tell which entry is yours. Use Send feedback in Settings with the date you sent it and some of the words you wrote, and we’ll find and delete it if we can.

We won’t ask for more information than we need to handle your request, and we never charge for it.

12. Where DueTape is used outside the Philippines

DueTape is made for users in the Philippines. If you use it from elsewhere, your local laws may give you extra rights, and you can contact us to use them. We are not aware of any law that makes us subject to the EU GDPR or US CCPA today. We’ll review this if that changes.

13. Changes to this policy

We’ll update this policy when DueTape changes, and show the new “Last updated” date at the top. For important changes, we’ll show a notice in the app before they take effect.

Coming later: we may add optional donations and a paid DueTape Plus tier with cloud sync. These are not live yet. Cloud sync would mean storing deadlines on a server, and payments involve a payment processor. We will update this policy, and ask for your consent where needed, before either feature launches. Nothing described here changes until then.

14. Contact

DueTape privacy: hello@duetape.com

National Privacy Commission: privacy.gov.ph

Previous name: Study Hub. This policy also covers data collected while the app was called Study Hub.