Privacy Policy

Account information. When you create an account, we collect your name, email address, password (stored as a secure hash — never in plain text), and your university admission year.

Phone number. If you opt in to WhatsApp reminders, we collect your Pakistani mobile phone number in E.164 format (+92XXXXXXXXXX). Providing a phone number is optional.

Calendar data. When you connect your Moodle calendar, we collect your Moodle ICS export URL and the deadline title, due date, and course information contained in your calendar feed.

Payment information. When you submit a subscription request, we collect a screenshot of your payment receipt, a transaction ID, and your preferred payment method name. We do not collect or store credit card numbers, full bank account numbers, or other financial credentials.

Usage data. We automatically collect limited usage information including login timestamps, deadline interaction events (marking a deadline done or undone), and calendar sync timestamps.

We use the information we collect to:

• Create and manage your account
• Fetch and display your assignment deadlines on the dashboard
• Send deadline reminder emails to your registered email address
• Send deadline reminder messages to your WhatsApp number (only if you provide one and opt in)
• Process and review your subscription payment
• Respond to your support requests
• Detect and prevent fraudulent use of the Service
• Improve the Service

We rely on the following third-party services to operate StayDue. By using the Service, you agree to the applicable privacy practices of each service listed below.

• Active accounts: your data is retained for as long as your account remains active.
• Deleted accounts: all account data, deadlines, and subscription records are permanently deleted within 30 days of account deletion. You can delete your account at any time via Settings → Danger Zone → Delete Account.
• Payment screenshots: retained for up to 90 days after subscription expiry for accounting reconciliation, then permanently deleted.
• Backups: deleted data may persist in encrypted database backups for up to 30 additional days before being overwritten.

You may at any time:

• View and edit your account via Settings → Account
• Remove your phone number to stop WhatsApp messages via Settings → Notifications
• Delete your account and all associated data via Settings → Danger Zone → Delete Account
• Contact us for any other privacy-related request using the contact details below

We take reasonable technical and organisational measures to protect your data:

• Passwords are hashed using bcrypt before storage
• One-time verification codes are hashed with SHA-256 and expire within 15 minutes
• All communication is over HTTPS
• Payment screenshots are stored in private cloud storage and accessible only via short-lived, signed URLs
• Session tokens are managed via secure, HTTP-only cookies using NextAuth

No security system is impenetrable. If you become aware of a security concern, please contact us immediately.

StayDue is not intended for use by anyone under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by displaying a notice in the Service. Your continued use of the Service after changes take effect constitutes your acceptance of the updated policy. The “Last updated” date at the top of this page reflects when the policy was last revised.

For privacy-related questions, requests, or to exercise your rights, contact us at:

Email: contact@staydue.app