DocMate keeps your documents, reads them so you can ask questions, and reminds you about deadlines it finds inside them.
That means we handle paperwork people do not hand around lightly — visas, medical bills, tenancy agreements, payslips. This policy says what happens to it. We have tried to write it so you can check it rather than take our word.
Your account — your email address, a password (stored only as a hash; we never see it), your display name if you set one, your language, and your subscription status. We need these to sign you in and give you what you paid for.
Your referral payout, if you request one — if a friend you invite subscribes, you earn a cash reward; to pay it out we ask for a payout method and destination, such as a PayPal email address. We use this only to send that payment, and only you can see it.
Your documents — the file itself, the text read out of it (including from photos and scans), a summary, and details pulled out such as document type, names, reference numbers, addresses and expiry dates. We need these to let you search your documents, ask them questions, and be reminded of deadlines.
These may include health information, immigration and identity documents, and financial records. We treat everything you upload as sensitive by default.
What you do in the app — your chats with a document and the answers, reminders, the groups you create or join, which documents you share into them, and messages in them. Plus a record of security-relevant events: joining a group, sharing or unsharing a document, and subscription changes. Those exist so misuse can be investigated.
What we never collect
Worth being specific, because for a document app this is the real question.
Stays on your phone
Leaves your phone
Each of these does one job for us and gets only what that job needs.
| Who | What they get | Where |
|---|---|---|
| Supabase — hosting and database | Everything: account, documents, files, chats, reminders | AWS, Oregon, USA |
| Anthropic — reading and answering | Document text and images, and your questions | USA |
| OpenAI — voice, summaries, search | Document text; voice recordings if you use voice | USA |
| RevenueCat — subscriptions | Subscription status and an anonymous account ID | USA |
| Apple / Google | Payment details you give them; OS crash diagnostics | Their own policies |
Two things about the AI providers, stated plainly.
They are never told whose document it is. Requests go through our own server, which strips identity before forwarding. They receive text and a question, and nothing that connects either to you, your name, or your email.
Neither uses this content to train their models — that is their standard commitment for business API access, which is how we use them. They may hold content briefly for abuse monitoring. We have also turned off request logging on our OpenAI account, so the text of your documents is not kept in their logs for us to review.
We do not sell your personal data and we do not share it for advertising.
Your documents are stored in the United States (AWS, Oregon).
If you are in the UK or EU, that is a transfer outside your region. It is covered by the Standard Contractual Clauses built into our agreements with each provider — Supabase, Anthropic and OpenAI all include them in the terms we operate under.
| What | How long |
|---|---|
| Documents you save | Until you delete them, or close your account |
| Documents you upload but never save | 7 days, then deleted automatically |
| Documents you delete | 30 days in Trash, then the record and the file are permanently deleted |
| Chats about a document | Deleted with the document |
| Group invite codes | Single use, and 24 hours maximum |
| Your account | Deleted when you ask — see below |
Deletion runs automatically on our servers on a schedule, not only when you happen to open the app.
One limit we would rather state than hide. If somebody downloaded a file while it was shared with them, we cannot reach into their device and remove it. Un-sharing prevents future access, not access already taken.
You can access your data, correct it, delete it, restrict or object to how we use it, and get a copy in a portable format. If you are in the UK or EU these are rights under GDPR; similar rights apply in California and elsewhere.
Our legal basis. For most of what we do it is performance of our contract with you — you asked us to read your documents and we cannot do it otherwise. For security records it is our legitimate interest in keeping the service safe. For health, immigration and other special category information, our basis is your explicit consent, given when you choose to upload such a document. You can withdraw it by deleting the document, and you never have to upload one to use DocMate.
Delete your account — Settings → Delete account. This removes your documents, files, chats, reminders and the account itself. It cannot be undone.
Get a copy of your data — email support@docmateai.app and we will send you a copy of your documents and account data within 30 days.
For anything else, email support@docmateai.app. We reply within 30 days. If you are unhappy with our answer you can complain to your data protection authority — in the UK, the Information Commissioner's Office.
No system is perfectly secure. If a breach affects your personal data we will tell the relevant regulator within 72 hours and you directly where the law requires it.
DocMate is not intended for under-16s and we do not knowingly collect their data. If you believe a child has given us personal data, email us and we will delete it.
If this policy changes we will update the date above and tell you in the app before anything significant takes effect.
Moynul Talukder · 224 W 35th St Ste 500 #2516, New York, NY 10001 · support@docmateai.app