Privacy policy

Last updated 5 November 2026

This policy explains what personal data Doughie collects, why, and the choices you have. It applies to the Doughie app and doughieapp.com.

Who is responsible

Doughie is made by William Hermansson, a private individual in Stockholm, Sweden, who is the data controller for the personal data described here. For privacy questions and data requests, write to [email protected].

What Doughie collects

Your account

  • Name and email address
  • How you sign in: Apple, Google or email and password
  • Sign-in and verification codes, which are sent to your email address
  • Swish and Vipps numbers, if you choose to add them

What you add to groups

  • Group names, members, expenses, amounts, currencies, dates and who paid
  • People you add by name before they have an account
  • Edits and deletions, which are shown in the group’s activity

Your device

  • A notification token, if you allow notifications
  • Basic technical data, such as IP addresses in server logs, to keep Doughie secure and fix problems

Doughie does not ask for your bank login, card numbers or access to your bank account, and it never moves money.

Why the data is used

  • To run the app: create your account, show groups and balances, and send reminders. Legal basis: performing the agreement with you (the terms of use).
  • To keep Doughie secure, fix bugs and answer support questions. Legal basis: legitimate interest.
  • To send push notifications. You can turn them off at any time in your phone’s settings.

Doughie does not sell personal data, show ads or use your data for marketing.

Who can see your data

People in your groups

Members of a group see your name, photo, the expenses you’re part of, your balance and, if you’ve added them, your Swish and Vipps numbers.

Service providers

These companies process data on Doughie’s behalf, under data processing agreements:

  • Supabase: database and sign-in, hosted in the EU (Stockholm, Sweden)
  • Resend: sends sign-in and verification emails
  • Cloudflare: hosts doughieapp.com and forwards email sent to @doughieapp.com addresses
  • Expo: delivers push notifications
  • Apple and Google: if you sign in with them, and for app distribution

If data is transferred outside the EU/EEA, it is protected by the EU Commission’s standard contractual clauses or an equivalent safeguard.

How long data is kept

  • Account data is kept while you have an account.
  • When you delete your account, your personal data is deleted within 30 days. Shared expenses stay in their groups with your name replaced by “Deleted user”, so other members’ balances stay correct.

Your rights

Under the GDPR you can ask for a copy of your data, have it corrected or deleted, receive it in a portable format, and object to or restrict how it is used. Write to [email protected]. You can delete your account at any time, here’s how.

If you think your data is handled incorrectly, you can complain to the Swedish Authority for Privacy Protection (IMY) at imy.se.

Children

Doughie is not meant for children under 13 and does not knowingly collect their data.

Changes to this policy

If this policy changes in a way that matters, you’ll be told in the app before the change takes effect. The date at the top shows the latest version.