Privacy Policy

1. Who we are

Durvy ("we", "us", "our") operates the Durvy suite, including Receiptly, Invoicy, Timely, and Clienty (together, the "Services"). For privacy questions, contact us at privacy@durvy.app.

2. What data we collect

Account data

• Name and email address (provided when you sign up)
• Hashed password (if you sign up with email/password)
• OAuth identifiers (if you sign up with Google)

Content you create

• Receipt images, expense data, categories (Receiptly)
• Invoices, line items, client contact details, payment records (Invoicy)
• Time entries, project details, hourly rates (Timely)
• Client notes, contact logs, project milestones (Clienty)

Technical data

• IP address, browser type, device information (for security and debugging)
• Session cookies (to keep you signed in)
• Server logs (request paths, response codes, timestamps)
• Error reports (the page address, browser details and the error itself) sent to our error-monitoring service when something breaks

Messages you send us

• If you use the contact form: your name, email address and message

Advertising data (only if you accept cookies)

• If you accept cookies, Google's advertising tag runs on our sites. It sets Google advertising cookies in your browser and tells Google when you complete signup, so we can see which of our ads led to an account. See section 8.

3. How we use your data

• To provide and improve the Services
• To authenticate you and protect your account
• To process payments via our payment processor (Paddle)
• To send transactional emails (invoice deliveries, reminders, account notifications)
• To respond to support requests and contact-form messages
• To measure whether our own advertising works, if you have accepted cookies (see section 8)
• To comply with legal obligations

We do not sell your data. We do not use the content of your account (receipts, invoices, clients, time entries) for advertising, and we do not share it with advertisers. The only advertising-related data flow is the Google Ads tag described in section 8, and it runs only after you accept cookies.

4. Third-party services

We rely on the following processors to operate the Services:

• Turso - primary database (operated by ChiselStrike, Inc.)
• Vercel - application hosting and edge compute
• Cloudflare R2 - receipt image and PDF storage
• Resend - transactional email delivery, and delivery of contact-form messages to us
• Migadu - receives email you send to our addresses (for example hello@durvy.app)
• Sentry - error monitoring
• Paddle - payment processing and Merchant of Record
• Google Cloud Vision - OCR for receipt extraction (Receiptly only)
• Anthropic - AI parsing of OCR output (Receiptly only)
• Better Auth - self-hosted authentication library

Separately, Google (Google Ads) receives data from your browser if, and only if, you accept cookies. Google acts on its own account for its advertising services, so it is not a processor acting only on our instructions like those above. Its use of that data is governed by Google's own privacy policy.

Each processor has its own privacy policy. We share only the minimum data needed for them to provide their service.

5. Data retention

We retain your account and content for as long as your account is active. If you cancel your subscription, we keep your data accessible at the free tier so you don't lose anything. If you delete your account, we delete your data within 30 days, except for transactional records we're legally required to retain (e.g., invoices for tax purposes).

6. Your rights

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion (right to be forgotten)
• Export your data (CSV/PDF available from Settings in each app)
• Object to processing or withdraw consent
• Lodge a complaint with your local data protection authority

To exercise any of these, email privacy@durvy.app.

7. Contact form

If you write to us through the contact form on durvy.app, we collect the name, email address and message you type. The message is sent through Resend to our inbox at hello@durvy.app, and we use it only to reply to you. The form does not save your message to our database. A copy stays in our email inbox and in the sending service's logs until we delete it. Your IP address is used briefly to limit repeated submissions.

8. Cookies and advertising

Cookies that are always on

These are needed to run the Services and do not track you for advertising: a first-party session cookie that keeps you signed in, a language preference, a light or dark theme preference, a record of your cookie choice, and, if you arrive through a promotional link, the promo code from that link (kept for 7 days). Some of these are shared across durvy.app and our app subdomains (receiptly.durvy.app, invoicy.durvy.app, timely.durvy.app and clienty.durvy.app) so that you stay signed in and keep your preferences between them.

Google Ads (only after you accept)

We advertise our Services through Google Ads. If you accept cookies in our banner, we load Google's tag on durvy.app and on our app subdomains. The tag:

• sets Google advertising cookies in your browser;
• tells Google when you complete signup (when you reach the "check your email" page), so we can count how many ad clicks led to an account;
• adds an identifier to links between durvy.app and our app subdomains, so that a visit that began on one is recognised on the other.

Until you accept, the tag is not loaded and these cookies are not set. We do not send Google the content of your account. Our legal basis for this is your consent. If you do not accept, you can still use every part of the Services.

Withdrawing consent

You can withdraw consent at any time by deleting the cookies for durvy.app in your browser settings (this removes our consent cookie, so we will ask you again, and the Google advertising cookies), or by emailing privacy@durvy.app. You can also manage Google advertising through your Google account's ad settings. Withdrawing consent does not affect anything done before you withdrew.

9. Security

All data is transmitted over HTTPS. Passwords are hashed with industry-standard algorithms. Database access is restricted by per-user authorization on every query. We are not perfect - if you discover a security issue, please email security@durvy.app rather than disclosing publicly.

10. International transfers

Our infrastructure runs in the United States and European Union. By using the Services you consent to your data being processed in those jurisdictions. If you accept cookies, Google may also process advertising data in other countries where it operates.

11. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via email at least 30 days before they take effect.

Contact

Questions? privacy@durvy.app