- Effective date
- Not set — pending approval
- Revision date
- Not set — pending approval
Data controller / responsible company
Review required: confirm the responsible legal entity, its registered details and its role in handling Duyonu personal data. No company identity or address is asserted in this draft.
Categories and sources of information processed
Approved product scope includes Account and Pairing information and relationship features addressed below. This is not a verified inventory of data collected by the deployed service.
Review required: map the actual fields to their sources (the user, authentication provider, paired partner or technical systems), purposes, required/optional status and recipients. Confirm which Mood, Daily Question, shared activity and calendar features are implemented. Do not add unrelated features or inferred data fields to this inventory.
Apple, Google and Firebase Authentication
Approved authentication design: Apple and Google through Firebase Authentication. Duyonu does not plan separate email/password registration or mandatory email or phone verification for its web deletion flow. This does not determine which information a provider may require or return.
Verified for these website pages: web authentication is not implemented. Review required: confirm the deployed provider settings, actual identity fields, token/session handling and provider disclosures. Website sign-in must not automatically create a Backend Account.
Account and Pairing information
Approved architecture: the authoritative Duyonu Backend uses ASP.NET Core and PostgreSQL. Firebase Authentication provides authentication; this does not make Firestore the application database or authorize browser access to PostgreSQL.
Review required: confirm deployed Account and Pairing fields, ownership checks, access rules and what each paired person can see. The Backend and mobile repositories were not inspected for this draft.
Private relationship and partner-shared information
Approved scope identifies eligible Mood history, Daily Question answers, results from implemented shared activities and Shared Calendar data. Their inclusion in a product decision does not confirm that every feature is deployed.
Review required: describe actual partner visibility, sharing triggers, permissions and the effects of Unpair or Account Deletion for each implemented category. Do not claim automatic sharing, exclusive partner access, recorded consent or specific security protections without implementation evidence and legal review.
Processing purposes and applicable legal grounds
Review required: list verified purposes for processing each data category and obtain legal review of the applicable legal grounds. This draft does not assert consent terms or other legal grounds.
Service providers and international transfers
Approved architecture identifies Firebase Authentication for Apple/Google sign-in and a separate ASP.NET Core/PostgreSQL Backend. This does not establish the deployed service providers, data locations or contractual safeguards.
Review required: verify active Firebase services, Backend/database hosting and website hosting, each provider's role, data received or logged, subprocessors where relevant, storage locations and retention settings. Obtain legal review of any international transfers and their applicable legal grounds. No vendor agreement, certification or transfer guarantee is asserted.
Retention and deletion
Review required: document retention periods or criteria by data category and system, including active records, any archive, logs, backups and billing-related records where applicable. Confirm how deletion propagates to each actual service.
The approved Unpair archive is a limited exception described below, not a general 30-day retention period for all relationship data. No other retention period, legal exception, deletion-completion deadline or recovery guarantee has been verified for this draft.
Unpair and the limited archive — up to 30 days
Approved product policy: after Unpair, the archive is limited to eligible Mood history, Daily Question answers and results from implemented shared activities, for up to 30 days. Other categories must not be assumed to be eligible.
Shared Calendar data must be deleted on Unpair and must never enter this archive. Unpair archival is separate from Account Deletion; it does not establish a deletion waiting period or an automatic restoration period.
Implementation review required: confirm eligibility rules, the archive clock's start, expiry handling and permitted access against the deployed Backend and mobile application. The approved limit is a requirement, not evidence of verified cleanup.
Account Deletion and authenticated devices
Approved requirements: Account Deletion must affect all authenticated devices, end active Pairing access, remove shared calendar data and delete associated personal data according to the approved lifecycle. It must not start an automatic 30-day restoration period.
Review required: verify ownership enforcement, the actual data scope, session invalidation, timing and failure handling. Do not infer instant completion or copy another product's recovery process.
Verified for this website: the Delete Account page provides information only. It cannot authenticate you, submit a deletion request or confirm deletion.
Premium subscriptions and store billing
Account Deletion and subscription management are separate matters. Do not assume that deleting a Duyonu account cancels an App Store or Google Play subscription; separate store management may be needed.
Review required: confirm whether Premium is available, the actual store billing flow, entitlement and transaction data received by Duyonu, recipients, retention and verified cancellation guidance. This draft makes no claim that subscriptions are live or that Duyonu never receives payment-related information.
Privacy rights and request procedures
Legal review required: establish applicable rights, jurisdictions, request channels, identity-verification procedures and response obligations. Any limits or fees need a verified basis; none is promised here.
Review required: confirm which request routes actually work before listing them. Do not invent app settings, working deletion controls, a DPO, privacy email address or response deadline.
Analytics, technical logs and cookies
No analytics instrumentation is present in the reviewed source of these website pages. This does not establish whether the deployed mobile app, Backend, providers or hosting collect analytics, crash reports or technical logs.
Review required: inventory actual SDKs, hosting logs, cookies, browser storage and identifiers by environment; confirm purposes, recipients, retention and any required choices. Do not claim that Firebase Analytics or Crashlytics is active, or that the service is cookie-free, without evidence.
Children and safety — applicability review
Review required: confirm Duyonu's intended audience, any approved minimum age, the age checks actually implemented and the handling of safety concerns or information relating to children where applicable.
No age threshold, moderation system, reporting channel, response deadline or child-safety compliance claim has been verified for this draft. Legal and product review must determine the required disclosures before publication.
Policy updates and version information
The effective date, revision date and policy version require approval. The current document is an unpublished draft; no date in the reference policy applies to Duyonu.
Review required: define how approved changes will be communicated and when they take effect. Do not assume that continued use is consent or promise email/in-app notifications that have not been verified.
Contact details
Verified privacy contact details have not yet been supplied. A confirmed contact channel and responsible company details must be added before publication.