Privacy Policy

Last updated: 17 October 2026

This policy covers the Duet website and waitlist, and the Duet app (web and phone), including the bank data you choose to share with it through Australia's Consumer Data Right (CDR). Section 9 explains how CDR data is handled. For what the app does to protect your data in practice, see app.duetmoney.com.au/security.

This Privacy Policy describes how Duet Money Pty Ltd (ABN 79 699 581 407) ("Duet", "we", "us" or "our") collects, uses, holds and discloses your personal information, and how we comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). We are committed to protecting your privacy and being open about how we handle your information.

1. What personal information we collect

Through this website and our waitlist, we collect:

Your email address, which you provide when you join the waitlist.
Limited technical information collected automatically when you visit the site, such as your IP address, browser type and pages visited, through our hosting provider's standard server logs.

When you use the Duet app, we collect:

Account details: your name, email address and password. Your password is stored only as a salted one-way hash; we cannot read it. You may also give your date of birth, which is used for superannuation projections.
Bank data you consent to share through the Consumer Data Right: the account names, types, balances and transactions of the accounts you choose, and the account-holder name your bank holds. The connection screen lists exactly what is requested, and Settings shows it again afterwards. We do not receive your bank login, and we do not store your account numbers (only a scrambled fingerprint that lets us recognise the same account twice).
Things you tell Duet: incomes, budgets, goals, bills, mortgage and property details, parental-leave and return-to-work plans, superannuation and HECS balances, and how you choose to split costs with your partner.
Your partner's details as they relate to you: the shared goals, budgets, bills and approvals you hold together, and the view of your partner's accounts that they have chosen to share with you (see section 3).
Technical and security information: the IP address and time of sign-ins and security changes (kept in an audit log), a push-notification token if you turn on notifications on your phone, and the device and log information needed to run and secure the service.
Billing status: whether you have a subscription or trial and when it renews. Card details are entered on and held by our payment provider, Stripe; Duet never sees them.
Support messages you send us from inside the app.

2. How we collect your information

We collect information directly from you when you join the waitlist, create a Duet account, enter details in the app, or write to support. We collect bank data from your bank, through our accredited CDR data provider, only after you have consented at your bank to share it, and only for the accounts and the period you chose. Some information about you comes from your partner, where they enter or share something in Duet that involves you. Technical information is collected automatically when you use the site or the app. We only collect personal information by lawful and fair means.

3. Why we collect and use your information

We collect and use your personal information to:

provide the Duet service to you and your partner: showing your accounts, transactions and net worth, tracking budgets, bills, goals and your mortgage, and working out who paid what;
send you the emails and notifications the service needs, such as verifying your email, resetting your password, reminding you before a bank consent expires, and telling you when your partner proposes a change that needs your approval;
keep your account secure, including recording sign-ins and security changes in an audit log;
bill you for a subscription, if you have one;
respond to your enquiries and support requests;
add waitlist members to early access and send updates about Duet; and
understand and improve how Duet is used.

How your partner sees your information. Duet is built for two people, so some sharing is the point. You choose, for each of your own bank accounts, what your partner sees: everything, the balance only, that the account exists, or nothing. Joint accounts are visible to both of you. Goals, budgets, bills and mortgages you mark as shared are visible to both partners, and changes to them need both of you to agree. These choices are enforced on our servers, not merely hidden in the app, and household figures such as spending by category are built only from the accounts you have chosen to share.

We rely on your consent to send waitlist communications, and on your bank consent to collect bank data. We will not use your information for any unrelated purpose without your consent. We do not sell your personal information, we show no advertising, and we do not infer life events from your spending.

4. Who we disclose your information to

We disclose personal information to service providers who help us operate Duet, each only to the extent needed for their role:

Our CDR data provider, an accredited data recipient under the Consumer Data Right, through which your bank shares data with Duet. Duet will operate as a CDR representative of that provider, which means the provider will collect the data from your bank on our behalf and hold the consent you give. We will name the provider here once our agreement with them is finalised.
Railway (Railway Corporation, United States), which hosts Duet's application servers and database in its Singapore region.
Vercel (Vercel Inc., United States), which delivers the Duet web app and this website through its global content network.
Brevo (Sendinblue SAS, France), which sends our emails and stores waitlist email addresses.
Stripe (Stripe, Inc., United States, and Stripe Payments Australia Pty Ltd), which processes subscription payments and holds your card details.
Expo (650 Industries, Inc., United States), which relays push notifications to the Duet phone app. Notification text passes through this service; we keep it short and it never includes your bank login or account numbers.

We may also disclose personal information where required or authorised by law. We do not otherwise disclose your information to third parties without your consent.

5. Overseas disclosure

Some of the providers above store or process personal information outside Australia. Specifically: Duet's application servers and database are hosted in Singapore (Railway); emails and waitlist addresses are processed in the European Union (Brevo); the web app and website are delivered from, and payments and push notifications are processed in, the United States (Vercel, Stripe, Expo). Our CDR data provider is an Australian-accredited data recipient; where it holds data is set out in its own CDR policy, which we will link here once our agreement is finalised. Before disclosing personal information overseas we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles, including choosing providers that maintain recognised data-protection standards.

6. Direct marketing and how to opt out

Our emails to you are a form of direct marketing, sent with your consent. Every email we send includes an unsubscribe link, and you can opt out at any time by using that link or by contacting us. Once you unsubscribe, we will stop sending you marketing emails. We handle marketing communications consistently with the Australian Privacy Principles and the Spam Act 2003 (Cth).

7. Cookies and analytics

This website does not use tracking or advertising cookies. The Duet app uses one strictly necessary cookie to keep you signed in, and your browser's local storage to remember who is signed in; neither is used for tracking. We do not currently use analytics. If we introduce analytics in the future, we will update this policy to explain what is collected and how you can opt out.

8. How we store and protect your information

We take reasonable steps to protect your personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. In the Duet app that includes: encryption of all traffic in transit (TLS), including between Duet and our CDR data provider; encryption of stored data at rest by our hosting provider; passwords stored only as salted one-way hashes; short-lived sign-in sessions, with every device signed out when a password is changed or reset; optional two-factor authentication with an authenticator app; a Face ID or fingerprint lock and screenshot blocking in the phone app; and an audit log of sign-ins and security changes. We do not store your bank login, your bank access tokens or your account numbers. Our providers maintain their own security measures.

Who at Duet can access it. Like any hosted service, the people who operate Duet can technically access the systems that hold your data. We limit this: every such system that offers two-factor authentication has it turned on, with an authenticator app (our CDR data provider's console offers none, so it has a unique generated password held in a password manager and is recorded as such in our access register); access is restricted to the people named in our internal access register, which we review at least quarterly; direct database access is logged separately from the app's own activity; and we do not look at an individual's transactions except to resolve a support request they have raised; each time, the database's own log records the session and the reason is written in our access register. There is no facility for Duet staff to sign in to the app as you.

How long we keep it. We keep your information for as long as you have a Duet account. You can download your data at any time from Settings → Export your data. If you delete your account (Settings → Delete account), you are signed out everywhere and our access to your bank data is withdrawn immediately; your personal data, including all bank data, is deleted after a seven-day window in which you can change your mind. Shared history that your partner also relies on (such as joint goals and who-paid-what records) stays visible to them with your name replaced by "Former partner". We keep billing records for as long as tax and accounting law require. If you only disconnect a bank, new data stops immediately and the history already in Duet remains until you delete your account.

9. Bank data and the Consumer Data Right

Duet reads bank data under Australia's Consumer Data Right (CDR), through an accredited data recipient for which Duet will operate as a CDR representative. This means:

You are in control of consent. You consent at your bank, for the accounts you choose, for a period you choose of up to 12 months. You can withdraw that consent at any time, from Settings → Bank connections in Duet or from your bank. Duet shows you, for each bank, what is being shared and when sharing ends, and reminds you before it ends.
Access is read-only. Duet can never move money, make payments or change anything at your bank.
We ask only for what Duet uses: account details, balances, transactions and the account-holder name. We do not request your address, phone number or other contact details from your bank.
Deletion. When you delete your Duet account, all bank data we hold is deleted as described in section 8, and our data provider deletes its copy in accordance with its CDR policy. You may also ask us at any time to delete bank data we hold, using the contact details below.
Your rights under the CDR sit alongside your rights under the Privacy Act. Complaints about CDR data can be made to us, to the OAIC, or to the Australian Competition and Consumer Commission (ACCC).

10. Accessing and correcting your information

You may ask us to access the personal information we hold about you, or to correct it if it is inaccurate, out of date or incomplete. To do so, contact us using the details below. We will respond within a reasonable period. There is normally no charge to make a request, though we may need to verify your identity first.

11. Complaints

If you have a concern or complaint about how we have handled your personal information, please contact us first using the details below, and we will aim to resolve it. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

12. Children

Duet is intended for adults. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, please contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. The current version will always be available on this page, with the "last updated" date shown above.

14. Contact us

For any privacy question, request or complaint, contact:

Duet Money Pty Ltd (ABN 79 699 581 407)
Email: hello@duetmoney.com.au
Postal address: 60 Brougham Street, Potts Point, NSW 2011, Australia