Security

Your answers are encrypted on your device. Duri can't read them. Here is exactly what that means, in plain language.

What's encrypted

• Free-text answers — the things you type — are end-to-end encrypted. They're scrambled on your phone with a key only you and your partner hold, before they ever reach our servers.
• Not encrypted: multiple-choice selections, the time you answered, and which question you answered. We keep these readable so features like match rates and “what you two disagree on” can work without exposing what you wrote.

Your passphrase and recovery code

When you set up encryption you choose a Duri passphrase and get a one-time recovery code. The passphrase unlocks your answers on each new device. The recovery code is the only other way in.

There is no “reset passphrase” email. If we could reset it, we could read your answers — so we can't. Keep the recovery code somewhere safe.

What a data breach would expose

Someone who stole our entire database would get scrambled ciphertext for every free-text answer, plus the metadata above. They would not get the text of a single answer without also cracking an individual user's passphrase.

What Duri staff can see

The same as a breach: metadata, never free-text content. We cannot produce the text of your answers in response to a legal request, because we do not have it.

The limit of browser encryption

Duri runs in your browser, and the encryption code is delivered by us with each app update. That means you are trusting each update not to be tampered with — the same trust any web app requires. Encryption also can't protect an answer on a device that is already unlocked and in someone else's hands.

AI features

Duri's AI features never run silently over your answers. When you ask for one, your revealed answers are sent to our AI provider for that request only, and are never stored in readable form. Everything else stays encrypted.

Questions

See the Privacy Policy for the full picture, or email support@duri.app.