Privacy Policy

Duomate ("we", "our", "us") is operated by Rubber Duck LLC. This Privacy Policy describes what information we collect when you use the Duomate mobile app, how we use it, who we share it with, and the rights you have over it.

If you do not agree with this policy, please do not use the app. By creating an account, you confirm you have read and agree to this policy and our Terms of Service.

1. Information We Collect

Information you provide directly

• Account credentials: email address and password (passwords are hashed and never stored in plaintext). You may also sign in with Apple, in which case Apple provides us a unique identifier and (if you choose) your name and email.
• Profile information: display name, date of birth, gender, country, profile photos, and optional fields such as bio, interests, occupation, hometown, height, MBTI, zodiac sign, blood type, and pronouns.
• Language preferences: the languages you speak natively and the languages you are learning, along with your self-reported proficiency level.
• Messages and uploads: the text and voice messages you send to other users and AI conversation partners, plus any images or audio you upload to chats.

Information generated as you use the app

• Vocabulary and learning data: the words you encounter, write, or learn through conversations are tracked to power your personal vocabulary list, spaced-repetition reviews, and progress dashboards.
• Subscription state: whether you have an active premium subscription, your billing cycle dates, and your purchase platform (Apple). We do not see or store your credit card number — Apple handles billing.
• Usage analytics: anonymized events about which features you use (e.g. "started chat", "sent message", "viewed plans"). Used to improve the product, never sold.
• Diagnostic data: crash reports and error logs (via Sentry) so we can fix bugs. May include device model, OS version, and a stack trace.
• Push notification tokens: if you grant permission, a token from Apple Push Notification Service so we can deliver notifications.

Information we do NOT collect

• We do not collect your precise GPS location. Country is what you select on your profile; no location services API is used.
• We do not access your contacts.
• We do not collect your phone number.
• We do not scan your photo library — we only see images you explicitly upload.
• We do not sell your personal data to anyone, ever.

2. How We Use Your Information

We use the information above to:

• Provide the core service — matching, messaging, AI conversation partners, vocabulary tracking, and corrections.
• Enforce community guidelines and safety (automated and manual content moderation).
• Process subscription purchases and entitle you to premium features.
• Send transactional notifications (e.g. new match, new message), and product notifications you have not opted out of.
• Detect, diagnose, and fix bugs and abuse.
• Comply with legal obligations and respond to lawful requests.

3. AI and Third-Party Service Providers

To deliver the product, we share specific data with the following processors. We have contractual obligations with them around data handling and security.

• Supabase — database, authentication, and storage (US-hosted infrastructure).
• RevenueCat — subscription billing reconciliation.
• Apple — App Store transactions, Sign in with Apple, push notifications.
• Anthropic (Claude) — AI conversation partner replies. Message content and chat history from AI conversations are sent to Anthropic for processing. Anthropic does not retain content beyond the duration of processing per their API terms.
• OpenAI (GPT models, via OpenRouter) — grammar correction of your outgoing messages and AI reaction generation. The specific message being corrected is sent to OpenAI. OpenAI does not retain API content beyond processing.
• Google (Gemini, via OpenRouter) — translation, chat history summarization, and short-form scoring for vocabulary and dictionary features. Relevant text snippets are sent to Google. Google does not retain API content beyond processing.
• OpenRouter — API router / aggregator we use to reach OpenAI, Google, and other model providers. Requests transit OpenRouter but are not retained by them beyond processing.
• Microsoft Azure (Speech Services) — pronunciation assessment when you send voice messages. Audio is transmitted to Azure for analysis and not retained.
• spaCy / Cloud Run (Google Cloud) — text tokenization and grammar parsing for vocabulary tracking. Text is processed in-memory and not retained beyond the request.
• Sentry — crash and error reporting.
• Vercel — hosting for our website and short-link redirects.

We do not share your data with advertisers, brokers, or any third party for marketing purposes.

4. Your Rights (GDPR, CCPA, and Beyond)

Regardless of where you live, you have the following rights over your data:

• Access: request a copy of the personal data we hold about you.
• Correction: edit any inaccurate information directly in the app (Profile → Edit Profile) or by contacting us.
• Deletion: delete your account from Settings, which permanently removes your profile, messages, matches, vocabulary, and uploaded files within 30 days (backups are then purged on a rolling schedule).
• Portability: request a machine-readable export of your data.
• Object / restrict: ask us to limit or stop certain processing (e.g. analytics).
• Withdraw consent: for any feature that asked for explicit consent (such as AI conversation processing), withdraw it at any time.

EU / EEA / UK users (GDPR)

Our legal bases for processing your data are: (a) contract — to deliver the service you signed up for; (b) consent — for AI-feature processing and optional notifications; (c) legitimate interest — for security, abuse prevention, and basic analytics. You have the right to lodge a complaint with your local data protection authority.

California users (CCPA / CPRA)

In the past 12 months we collect the categories of personal information described in Section 1 above. We do not sell or share your personal information for cross-context behavioral advertising. You have the right to know, delete, correct, and not be discriminated against for exercising these rights.

5. Data Retention

We keep your data for as long as your account is active. When you delete your account, we delete your personal data from production systems within 30 days. Backups containing your data are retained for up to 90 days and then permanently destroyed on the standard backup rotation. Aggregated, fully anonymized data (counts, metrics) may be retained indefinitely.

If you have outstanding subscription receipts or open content moderation cases, we may retain limited records related to those matters for as long as required by Apple's policies or applicable law.

6. Security

Data in transit is protected with TLS. Data at rest is encrypted in our database and storage providers. Access to production systems is restricted to a small number of authorized administrators with audited credentials. We cannot guarantee absolute security — please use a strong, unique password.

7. Children

Duomate is not directed at children. You must be at least 18 years old to create an account. We verify age at signup; if we learn that a person under 18 has created an account, we will delete it.

8. International Data Transfers

Duomate is operated from the United States. If you use the app from outside the US, your data will be transferred to and processed in the US (and potentially other countries where our processors operate). Where required, we rely on standard contractual clauses or equivalent mechanisms to lawfully transfer EU/UK personal data.

9. Content Moderation

Messages, profiles, and uploaded images may be screened automatically for harmful content (nudity, severe slurs, threats, spam). Reports submitted by other users may be reviewed by our moderation team. Material in violation of our community guidelines may be removed and accounts may be suspended or banned.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be announced inside the app and via email. The "Last updated" date at the top of this page always reflects the current version.

11. Contact

For privacy questions, data requests, or to exercise any right under this policy, contact us at driftbuddy1995@gmail.com. We respond within 30 days.

Duomate is operated by Rubber Duck LLC.