Duffly

Privacy policy for the Duffly app

Last updated: 25 October 2026. The German version prevails.

In short

• Duffly needs no account. Your trips, lists and notes are stored only on your device and are not sent to us. The app does not contact our servers.
• No ads, no analytics, crash-reporting or tracking services, no cookies in the app.
• Your trip data is excluded from the operating system's automatic backups. You export backup files yourself; the app does not encrypt them.
• Lifetime Pro is bought through Google Play or the App Store. On Android, Google's purchase library sends its own diagnostics to Google when the app connects to Google Play (section 6).
• Reminders are optional, scheduled locally on your device and show only a generic text.

1. Controller

Md Iearulislam
E-mail: hello@iearul.xyz
Postal address: see the legal notice (Impressum).

There is no data protection officer.

2. Data in the app (on your device only)

The app stores on your device:

• trips: title, optional destination label, dates, trip type, activities, expected weather, laundry and spares settings;
• travelers (labels only), bags (labels, weights, limits), categories, items (names, quantities, weights, notes, states such as “packed” or “to buy”), tasks before you leave and removed suggestions;
• your own templates;
• reminders: chosen date and time, time zone, resolved point in time and state;
• settings: appearance, weight unit and whether the introduction has been shown;
• the cached Pro status (section 6).

This data is not sent to us or anyone else, and we cannot access it.

The app needs no real names – travelers can be nicknames, for example. It does not ask for birth dates, passport numbers, your precise location or your e-mail address and uses no device or advertising identifiers. Notes and destinations are never logged and never shown on the lock screen.

Notes are free text. Please don't enter special categories of personal data (such as health data) there if you don't want to.

Deleting: Settings › Your data › Delete all data on this device removes all trips, templates, settings and the cached Pro status. You delete a single trip from the trip's menu. Uninstalling the app also deletes its data. Copies outside the app are not covered: exported backup files and text you shared. Delete them wherever you saved or sent them.

3. Automatic device backups

Trips, lists, templates, reminders and the cached Pro status are excluded from the operating system's automatic backups (Android: Google backup and device transfer; iPhone: iCloud Backup and computer backups). Only the settings (appearance, weight unit, introduction shown) may be included in such a backup; they contain no trip data. Google or Apple manage these backups under your account; we have no access.

Some device makers' transfer tools may behave differently. To move your lists to another device, use a backup file (section 4).

4. Backup files and sharing

Settings › Your data › Export backup saves a backup file (JSON) through your system's file dialog to a place you choose. The file contains your trip details and is not encrypted by the app. Where you keep it (for example in cloud storage) and who you give it to is your choice; that provider's terms apply. We never receive the file. Reminders are not part of backups.

When importing, you pick the file yourself. The app checks it on your device and adds trips and templates as copies. Export and import need no storage permission.

“Share as text” opens your system's share menu. Notes are included only if you turn that on. Whatever you share is then outside the app.

5. Reminders

You can turn on one reminder per trip. Only then does the app ask for permission to send notifications. The reminder is scheduled locally on your device, not through a server. Its text is generic (“Your packing checklist is waiting”) and shows neither the destination nor notes. Archiving or deleting the trip removes the reminder.

6. Buying Lifetime Pro

Google Play or the App Store process the purchase under your Google or Apple account. We never receive payment details such as card numbers. For the Pro screen, buying, restoring and checking your Pro status, the app asks your store's purchase interface whether Pro was bought. It keeps the result (status, time of the last check, order or transaction number, never a purchase token) on your device. This cache is excluded from backups; on a new device the app checks the purchase with the store again.

Android: whenever the app connects to Google Play, the Google Play purchase library collects its own diagnostics and uploads them from the app in the background to Google (server firebaselogging.googleapis.com): library and app version, package name, a numeric identifier, device model, manufacturer and build fingerprint, Android version, language, country, mobile network code, network type, time-zone offset and the store's response – no trip data. The app therefore connects to Google Play only when you open the Lifetime Pro screen, try a Pro feature, have already bought Pro (then at most once a day, to check the purchase status) or a purchase is still pending. If you never open the Pro screen or try a Pro feature, the app does not connect to Google Play. This processing is done by Google [OWNER: legal basis and description of Google's processing – have them reviewed]. On iPhone, purchases run through the system's App Store service; the app itself opens no connections.

For accounting, refunds and legal retention duties the stores give us order and sales information (for example order number, date, country, product, price). Legal basis: Art. 6(1)(b) and (c) GDPR. We keep it as long as tax and commercial law require (up to 10 years, § 147 AO).

The stores' own privacy policies apply to their processing: Google, Apple.

7. Support requests

If you write to us by e-mail or through the contact form, we process your e-mail address, your name if you give it and your message to answer it (Art. 6(1)(b) or (f) GDPR). We delete it once your request is settled, unless the law requires us to keep it. The app never attaches anything automatically. Please don't send a backup file or screenshots with personal data we don't need.

8. This website

The product pages use no cookies, no analytics and no embedded third-party services (no web fonts, maps or videos). The website is hosted by Hostinger International Ltd. (Cyprus). When you visit, the server processes technically necessary data (IP address, date and time, requested page, amount of data, browser and operating system) in server logs. Legal basis: Art. 6(1)(f) GDPR (secure operation). The app never calls this website itself; links open in your browser only when you tap them.

9. App permissions

• Android: the app asks for “notifications” (Android 13 and later) only when you turn on a reminder. The reminder library adds permissions so scheduled reminders survive a restart (such as “run at startup” and “prevent phone from sleeping”). The Google Play purchase library adds “internet”, “network state” and “billing”, used for purchases and the purchase library's diagnostics described in section 6. The app itself makes no other network requests.
• iPhone: the app asks for notification permission only when you turn on a reminder.
• The app does not ask for location, contacts, camera, calendar or storage access.

10. Children

Duffly is meant for adults planning trips, including for their family. It is not intended for children.

11. Your rights

You have the right of access, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR) and the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the one in your federal state. App data stays on your device, where you can view, export and delete it yourself. For purchase and support data, contact the address in section 1.

12. Changes

If the app changes so that other data is processed (for example a new service), we update this policy first.