Privacy Policy

Duri is a private space for two people to answer questions and reveal them together. This policy describes the data the Duri service processes, why it is needed, and the choices available to you.

Who operates Duri

Duri is the service name. The legal business name, registered address, jurisdiction, and privacy contact should be added here before launch. For now, privacy requests can be sent to support@duri.app.

Data we process

• Account data: email, username, authentication identifier, and date of birth used for the 18+ age gate.
• Couple data: pairing and invitation records needed to connect two accounts.
• Answers: question responses and reveal status. Free-text answers are encrypted in the browser; multiple-choice answer data and operational metadata are also stored to operate matching and history.
• Optional features: push-subscription data when notifications are enabled, and revealed-answer context sent to the AI provider only when you request an AI feature.
• Billing data: plan, entitlement, and payment-provider identifiers. Duri does not store full card numbers.
• Technical data: security logs and essential session storage. Microsoft Clarity is loaded only after analytics consent.

Why we use it

• To provide sign-in, pairing, answering, reveals, notifications, billing, and support.
• To protect accounts, prevent abuse, troubleshoot failures, and comply with law.
• To improve the public website only when you opt into analytics.

We do not sell personal data, serve behavioural advertising, or use answer content to train our own models. Do not put information in Duri that you are not comfortable sharing with your paired partner.

Answer privacy and encryption

Free-text answers are encrypted on your device with keys intended to be held by you and your partner. Duri cannot normally read that ciphertext. Encryption does not cover every field: question identifiers, timestamps, reveal state, and some multiple-choice data may be available to operate the service. If both your passphrase and recovery code are lost, Duri cannot recover encrypted text.

Service providers

Duri uses Supabase for authentication and database infrastructure, Google when you choose Google sign-in, Razorpay for paid checkout, Microsoft Clarity for opted-in website analytics, and web-push infrastructure when you enable notifications. AI requests use an external AI provider and are made only after you request the feature. Each provider may process data under its own terms and privacy policy.

Retention and deletion

We keep account and couple records while needed to provide the service, and billing records for legally required accounting and dispute periods. You can delete your account from Settings or contact support. We delete active profile and answer records when deletion is completed, subject to backups, fraud prevention, and legal retention requirements.

Your choices and rights

You can access or correct profile data, delete your account, withdraw analytics consent, and ask questions about processing. Depending on your location, you may also have rights to access, erase, restrict, object, or receive a copy of personal data. Contact us first; you may also complain to your local data-protection authority.

Adults only

Duri is intended for people aged 18 and over. We do not knowingly collect data from children. Contact support if you believe a child has provided data.

Contact

Email support@duri.app for privacy requests. The operator should add a formal grievance or data-protection contact before launch if required by the laws that apply to the business.