Privacy Policy

NxtDue reminds you when a subscription, policy, warranty or document is about to expire. This policy describes what the app collects, why, and what you can do about it. It covers the NxtDue mobile app, the website at nxtdue.com, and the API behind them at nxtdue-api.azurewebsites.net.

Who is responsible for your data

NxtDue is available worldwide. It is operated by Chandu Mahesh, a sole proprietor registered in India, at S/O Chengaiah, Surapu Agraharam Village, Kalluru Post, Doravari Satram Mandal, Nellore, Andhra Pradesh 524123. We are the data controller for the personal data described here — the Data Fiduciary, in the language of India's Digital Personal Data Protection Act, 2023, which applies to us wherever you are. Where the GDPR, UK GDPR, or a US state privacy law applies to you, we honour those rights too; see Your rights. Contact details are at the bottom of this page.

What we collect

Your account

An email address and a display name. The address is the account. You choose a password, which we store only as a slow one-way hash and can never read.

We send a one-time code to your email address to confirm it is yours before the account can be used, and again if you ask to reset your password. Verifying the address is not optional: it is the only way we can give an account back to you if the password is lost.

A mobile number is required when you create an account. We store it, and you may use it instead of your address as a username when signing in. We do not send anything to it by SMS, and we do not verify it. Once WhatsApp reminders are available, its only other use will be delivering them, and only if you turn them on.

What you put in the app

The reminders you create: what renews, when, how often, what it costs, and any note or category you attach. If you upload a document — a policy PDF, a warranty card, a photo of a receipt — we store the file itself.

Family sharing

If you share a reminder with someone, they can see that reminder and the documents attached to it. They cannot see anything else in your account. If you invite someone by email, we store that email address so we can send the invitation and so it can be accepted by the person it was addressed to.

Email receipts — not yet available

This feature is rolling out in a later release and does not yet appear in the app. Once it does, you will be able to connect a Gmail account so NxtDue can spot renewal receipts. This is off unless you connect it, and it is worth being precise about what it does:

• We ask Google for read-only access (gmail.readonly). NxtDue can never send, delete or modify mail.
• We look for renewal and receipt messages and extract what a reminder needs — a merchant, an amount, a date. We do not store the body of your email.
• What we find becomes a proposal, not a reminder. Nothing is added to your account until you tap to accept it. NxtDue never creates a reminder from your mail on its own.
• Your Google refresh token is encrypted before it is stored, is never logged, and is never sent to the app.
• You can disconnect at any time in Settings, which deletes the stored token. You can also revoke access from your Google account directly.
• NxtDue's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not transfer this data to others except as needed to provide the feature, do not use it for advertising, and do not allow humans to read it except with your explicit consent, for security purposes, to comply with law, or where it has been aggregated and anonymised.

WhatsApp reminders — not yet available

WhatsApp reminders are coming in a later release and cannot yet be turned on in the app. Once available, Premium subscribers will be able to ask for renewal reminders to arrive on WhatsApp as well as on their phone. It will be off unless you switch it on:

• We store the WhatsApp number you give us, and the fact that you want reminders sent there.
• To deliver a reminder we pass that number, and the reminder's title and date, to Meta, which operates the WhatsApp Business Platform. That is the whole of what leaves us — never a document, never a note, never your other reminders.
• Messages are one-way. NxtDue does not read replies, and there is no conversation on that number.
• Once a message is on WhatsApp it is governed by Meta's own terms and privacy policy, and by whatever your own WhatsApp account settings do with it.
• Turn it off in Settings and delivery stops immediately; the stored number is removed with the preference.

Your device

A push notification token, so a reminder can reach your phone. The app contains no crash-reporting, analytics or advertising SDKs.

Technical records

Our servers keep short-lived operational logs, including the IP address a sign-in request came from. This is how we rate-limit sign-in attempts and stop somebody working through a list of addresses. Email addresses and phone numbers are masked in our logs, and we do not log the contents of your reminders or documents.

Payments

If you subscribe to a paid plan, the purchase happens inside the Apple App Store or Google Play. We never receive or store your card number or payment details. The store tells us only that a valid subscription exists, and when it expires, so we can unlock the right features.

Why we collect it, and on what basis

What we do not do

• We do not sell your data, and we do not share it with advertisers.
• We do not use your data to train machine-learning models.
• We do not track you across other apps or websites.
• We do not read your email beyond looking for renewal receipts, and only if you connect it.
• We do not show advertising in the app, and there are no advertising SDKs in it.
• We do not build a profile of you for any purpose other than running the features you use.

Who else processes it

NxtDue runs on Microsoft Azure. Wherever in the world you use the app, your account data is stored in Azure's Central India region. Our email — your sign-in codes, your reminder emails and family invitations — is sent through Azure Communication Services, part of the same Microsoft Azure account. We use Expo and Apple's push service to deliver push notifications, and Apple and Google Play to process subscription payments. When the optional email connection and WhatsApp reminders described above become available, Google and Meta respectively will process the data those features need. We do not use an SMS provider. Each receives only what it needs to do that job, and none of them is permitted to use it for their own purposes.

Where your data goes

Because our servers are in India, using NxtDue from anywhere else means your data is transferred to and stored in India. If you are in the European Economic Area or the United Kingdom, India has not been the subject of an adequacy decision, so we rely on the Standard Contractual Clauses in our agreement with Microsoft, together with the encryption and access limits described under Security, to protect it. You can ask us for a copy of those safeguards at the address in Contact.

The providers listed above may in turn process data in other countries in the course of delivering a message. Where that happens it is limited to what the delivery requires — a push token, an email address and a code, or a WhatsApp number with a reminder's title and date — and never your documents or the rest of your account.

How long we keep it

• Reminders and documents: until you delete them, or delete your account.
• Sign-in and password-reset codes: minutes. They expire, are single-use, and are stored only as a keyed hash.
• WhatsApp number: until you turn WhatsApp reminders off, or delete your account.
• Operational logs: a short period, then discarded.
• After account deletion: recoverable for 30 days, then permanently deleted.

Deleting your account

You can delete your account from within the app, under Settings → Privacy & security → Delete account. When you do, you are signed out everywhere immediately, every active session is revoked, and your email address is released. Your data then remains recoverable for 30 days — so that an accidental tap is survivable — and is permanently deleted after that. You do not need to contact us, and you do not need to explain why.

If you no longer have the app installed, you can request the same thing from nxtdue.com/delete-account.

Security

Traffic between the app and our servers is encrypted with HTTPS. Your password is stored only as an Argon2id hash, and sign-in codes and session tokens only as keyed hashes, so none of them can be recovered from our database. Your session tokens are held in the device keychain. Documents are served through short-lived, single-purpose links rather than being public. Access to production data is limited to the operator and is used only to run and repair the Service.

No system is perfect. If a breach affects your personal data, we will notify you, and we will notify the Data Protection Board of India and any other supervisory authority that has jurisdiction over you, within the deadlines the applicable law sets.

Children

NxtDue is for adults. You must be 18 or older to create an account, and we do not knowingly collect personal data from anyone under 18. If you believe a child has created an account, write to us using the address in Contact below and we will delete it.

Your rights

You can, at any time and without giving a reason:

• Access and correct your data — everything is editable in the app.
• Export it, from Settings, in a portable format.
• Delete it, in whole or in part, from Settings or from the deletion page.
• Withdraw consent for email receipt detection, by disconnecting in Settings, and for WhatsApp reminders, by turning them off there.
• Nominate another person to exercise these rights on your behalf if you die or become incapacitated, as the DPDP Act provides — write to us to record a nomination.
• Never be discriminated against for exercising any of them — the price you pay and the features you get do not change.
• Object or restrict — ask us to stop or limit a particular use of your data, where the law applicable to you gives you that right.
• Complain — to us first, at the address in Contact below, and, if we do not resolve it, to your data protection regulator: the Data Protection Board of India, your EEA supervisory authority, the UK Information Commissioner's Office, or your state Attorney General, as applies to you.

If you would rather we did something for you than do it yourself, write to us and we will respond within 30 days.

Changes

If this policy changes materially, we will say so in the app before the change takes effect. The date at the top always reflects the current version.

Contact

Everything — privacy, data requests, grievances and support: nxtdue@gmail.com
Grievance Officer: Chandu Mahesh, at the same address
Postal address: S/O Chengaiah, Surapu Agraharam Village, Kalluru Post, Doravari Satram Mandal, Nellore, Andhra Pradesh 524123, India
Web: https://www.nxtdue.com