Privacy Policy — DuoLector

    Short version: DuoLector is a private space for you and your partner. We collect only what is necessary to make the app work. We do not sell your data. We do not show ads. Your messages and diary entries are private to your couple.
  

1. Who We Are

DuoLector ("we", "us", "our") is an independent web application developed and operated by Matias Sosa ([email protected]). The app is accessible at duolector.com.

2. Information We Collect

We collect only what is necessary to provide the service:

Account information: Email address, display name, and profile emoji when you register.
Content you create: Chat messages, diary entries, drawings, letters, music uploads, and PDF files you upload.
Usage data: Reading progress, page logs (for reading challenge validation), and session activity.
Device data: Browser timezone (detected automatically), device type for layout optimization.
Photos: Images you choose to share in chat or diary entries.

We do not collect: location data, contacts, microphone/camera access, payment information, or any data from other apps on your device.

3. How We Use Your Information

To provide and synchronize app features between you and your partner.
To send push notifications when your partner sends a message or letter (only if you grant permission).
To track reading challenges and calculate your progress.
To maintain your account and allow you to log in.

We do not use your data for advertising, profiling, or sale to third parties.

4. Data Storage & Security

All data is stored on Supabase (servers located in São Paulo, Brazil). Supabase is SOC 2 Type II compliant. Data is encrypted in transit (HTTPS/TLS) and at rest. Row Level Security (RLS) ensures each couple can only access their own data.

Uploaded files (PDFs, photos, music) are stored in Supabase Storage with private bucket policies.

5. Data Sharing

We share data only in these limited circumstances:

With your partner: By design — chat, diary, drawings, and letters are shared with your connected partner.
Supabase: Our infrastructure provider, for hosting and database services only.
Google: If you sign in with Google OAuth, Google authenticates your identity. We receive only your email and display name.
Legal requirements: If required by law or to protect the safety of users.

We never sell, rent, or share your personal data with advertisers or third-party data brokers.

6. Data Retention

Your data is stored as long as your account is active. You can delete your account and all associated data at any time by contacting us at [email protected]. Deletion is permanent and irreversible within 30 days of request.

7. Children's Privacy COPPA

DuoLector is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us immediately and we will delete it.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

Access: Request a copy of your data.
Correction: Update inaccurate data in your profile settings.
Deletion: Request complete deletion of your account and data.
Portability: Request your data in a portable format.
Opt-out: Disable push notifications at any time in app Settings.

To exercise any of these rights, contact us at [email protected].

9. Cookies & Local Storage

DuoLector uses browser localStorage to cache your session, preferences, and playlist data for faster loading. We do not use third-party tracking cookies or advertising cookies. No cookie consent banner is needed because we do not use analytics or advertising cookies.

10. Push Notifications

Push notifications are optional and require explicit browser permission. You can disable them at any time in app Settings → Notifications. Notification data (subscription endpoint) is stored securely and only used to deliver notifications from your partner.

11. Third-Party Services

Supabase — Database and authentication: supabase.com/privacy
Google OAuth — Optional sign-in: policies.google.com/privacy
MyMemory API — Translation service (no personal data sent, only text strings): mymemory policy
Ko-fi — Optional donations: ko-fi.com/privacy

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of significant changes by posting the new policy at this URL with an updated date. Continued use of DuoLector after changes constitutes acceptance of the new policy.

13. Contact

For any privacy-related questions or requests:

Email: [email protected]
App: duolector.com