Privacy Policy
In force from 3 November 2026 · Version 2026-11-03
ძირითადი ინფორმაცია ქართულად (key information in Georgian)
1. Who we are
DUDA is a matchmaking app that suggests compatible people and helps you decide who to meet.
- Controller: Duda Matchmaker LLC
- Registered address: Leo Kiacheli Street N15, Apartment N3, Mtatsminda District, Tbilisi, Georgia
- Company number: 404811502 (Georgian Public Registry)
- Privacy contact: privacy@dudamatchmaker.com
- Data protection officer: Diana Khortiuk, privacy@dudamatchmaker.com
- Privacy representative (Art. 27 GDPR and Art. 27 UK GDPR): Prighter Group (see below)
Representative
We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following regions:
- European Union (EU): Prighter EU Rep GmbH, Schellinggasse 3/10, 1010 Vienna, Austria
- United Kingdom (UK): Prighter Ltd, 20 Mortlake High Street, London SW14 8JN, United Kingdom
When you write to them, please add ID-15543778637 to the subject.
Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative, Prighter or make use of your data subject rights, please visit the following website: https://app.prighter.com/portal/15543778637
powered by
Prighter
We are a Georgian company, so the Law of Georgia on Personal Data Protection applies to everything we do with your data, and its supervisor is the State Audit Office of Georgia. If you live in the EU or the UK, the GDPR or the UK GDPR applies as well.
Our data protection officer is our founder, Diana Khortiuk. For any question about your data, write to privacy@dudamatchmaker.com.
DUDA is for adults. You must be 18 or over to use it, and we ask you to confirm this when you sign up.
2. The short version
- We collect what you tell us about yourself, what you answer in the questionnaire, and how you use the app.
- The app sends usage analytics (which screens and features are used, never what you write) to PostHog. You can turn them off in Settings → Privacy & data.
- Some of it is sensitive under data-protection law, and we use it only with your explicit consent. This covers your sexual orientation and sex life, health signals from fitness apps you connect, political or religious views in your questionnaire answers, your ethnicity if you add it, and a face scan if you verify your identity. See section 4.
- We do not sell your data.
- Some of our providers are in the United States, which Georgia does not list as protecting personal data adequately. By accepting this policy at sign-up you consent to those transfers. See section 7.
- Matching is automated. It suggests; it does not decide for you.
- Three things are decided automatically: identity verification; refusing an image our image-safety check flags, which suspends the account that uploaded it pending a person reviewing it within 24 hours; and hiding an account that several people have reported, pending a person reviewing it within 24 hours. You can ask a person to review any of them.
- You can download a copy of your data, and delete your account at any time, from Settings.
3. What we collect and why
Your account
We collect:
- your email address;
- your password, stored hashed, so we never see it;
- or, instead of a password, a Sign in with Apple or Google identifier (Facebook sign-in is not available yet);
- a phone number, if you give us one (we verify it separately);
- for security, the IP address and device details of security-relevant events;
- a coded fingerprint of the network you sign in from, so we can warn you about unfamiliar sign-ins.
Why: to create and secure your account and to detect fraud. Basis: our contract with you; our legitimate interest in preventing fraud and account takeover.
Your profile
Name, display name, date of birth, gender, who you are looking for, city and region, bio, occupation, education and employer if you add them, languages, height, interests, photos, your nationality and home or travel cities if you add them, your dealbreakers, and your favourite places and activities. Why: to build the profile others see and to find compatible matches. Basis: our contract with you.
Your questionnaire answers
Your answers and the personality profile we derive from them. Why: this is the core of how matching works. Basis: our contract with you, plus explicit consent for questions touching sensitive topics (see section 4).
How you use the app
Who you connect with, save, block or report; your messages; compatibility checks; invites you send or claim; and anything you type into the optional profile chat. If you block contacts from your phone, we store each phone number or email address only as a hash (a scrambled code), with an optional label you give it. Other people can see whether you are online and roughly when you were last active. Why: to run the features and keep people safe. Basis: our contract with you; our legitimate interest in safety.
Usage analytics in the app
We use a product-analytics service, PostHog, to understand how the app is used: which features people use, and where people stop while signing up. It works from counts and paths, not from what you write or answer.
What we collect. Which screen you are on, by screen type (for example “a person’s profile”, never whose); which sign-up and onboarding step you reach (the step’s name, never what you typed into it); how you signed up or logged in (email, phone, Google or Apple) and whether your verification code went to your email or your phone; which tab you open; and the actions you complete, such as checking in on Nearby, sending a message, a move or a hello, saving a profile, creating or answering a plan, sending or answering a sync request, inviting a contact, sharing your card, adding a photo, answering a question, opening a notification, blocking or reporting someone, contacting support, or verifying your identity: that you did it, never to whom, and never what it said. Some of these carry a kind or a rough number, for example a date or a group plan, a text or a GIF message, whether an identity check passed, how many photos you have, or, as a range, how many of your contacts are already on DUDA. We also collect when the app is installed, opened, updated or sent to the background; your matching mode (friends, dating or both); and details about the phone and the app: the make and model of the phone (the “device name” recorded is the model, such as “iPhone”, or on Android the hardware code name, never the name you gave your phone), the device type, the operating system and its version, the app’s name, version and build, your language and region setting, your time zone, the screen size, whether you are on Wi-Fi or mobile data, and whether the app runs on an emulator. On iPhone it also records whether the app came from TestFlight or another unofficial source; on Android it also records whether Bluetooth networking is in use, your mobile network operator’s name, the screen density and the phone’s standard browser identification string (user agent). Before you sign up these events carry a random ID the service gives your phone. Once you are signed in they carry a coded ID we derive from your account with a secret key. It is not your name, email, phone number or account number.
What we never send. Your messages, photos, bio or search text; your questionnaire answers or any sensitive answers (orientation, gender, ethnicity and the like); who you view, save, message or block; your location; your contacts; your name, email or phone number. We do not record your screen.
Why, and on what basis. To find out which features work and where sign-up loses people, so we can fix them. Basis: our legitimate interest. We do not ask first, so it is on by default, and you can turn it off at any time.
How to turn it off. Settings → Privacy & data → “Share usage analytics”. Your choice is saved on this device. When it is off, the analytics service is not started on that phone, so nothing is sent, not even when the app opens. If you switch it off while the app is open, sending stops and the analytics ID on the phone is reset. A fresh install without a restored backup starts with analytics on. Turning it off stops new collection; it does not delete what was already collected (see below).
Who processes it. PostHog, on its EU cloud in Frankfurt, under a data processing agreement. PostHog Inc. is a US company, so its staff outside the EU can reach the data for support, under Standard Contractual Clauses. The service sees your IP address when your phone connects; it does not keep it, and it does not work out your location from it.
How long. We can use these events for up to 1 year from when each one is recorded. That limit comes from our plan with PostHog: after it, the events can no longer be read or analysed, by us or anyone at PostHog working for us. PostHog does not promise to erase them at that point, and it does not let us set a shorter period. If we move to a plan with a longer period, we will update this policy first. To have your events deleted sooner, ask us (see below).
Deleting it. If you delete your account, we delete your profile in the analytics service. The events already recorded stay for as long as the service keeps them (see “How long”), under the coded ID. We still hold the key that links that ID to the account, so they are pseudonymised, not anonymous. If you ask us (privacy@dudamatchmaker.com), we delete the events linked to your account as well. Events a phone sent after you signed out, if you never signed in again on that phone, are not linked to you, so we cannot find them to delete them; the 1-year limit still applies to them.
Image-safety scanning
Every profile photo, chat image, plan cover and bug-report screenshot you upload is checked automatically by an image-safety system (Amazon Rekognition, running in our own Amazon Web Services account in Ireland) before anyone else can see it. For a video cover, it checks the first frame and one frame for every second of the video. It refuses sexually explicit and nude images: the labels it refuses are Explicit, Non-Explicit Nudity and Obstructed Intimate Parts. It describes the image, not you, and infers nothing about the person in it.
If it refuses an image, the image is not shown to anyone, the account that uploaded it is suspended until a person reviews it within 24 hours, and we email that account a statement of reasons. Amazon keeps nothing after the check. We log the refusal (the label, how confident the check was, and the account), and those log lines expire after 30 days. A refused profile photo or screenshot is never stored. A refused chat image or plan cover is kept as evidence, as you uploaded it. It is kept for 90 days after it is refused and then deleted, unless it is needed for a report to the authorities, an appeal or a legal claim, in which case it is kept until that ends.
Basis: our legitimate interest in the safety of the people who would otherwise see the image (Art. 6(1)(f) GDPR).
Automatic text check
Chat messages, and the profile text other people see (your display name, bio, pronouns, occupation, university, company and gender description), are checked automatically against a list of disallowed words before they are sent or saved. If one matches, it is refused and nothing is sent or saved. Nobody at DUDA reads them for this check.
Basis: our legitimate interest in the safety of the people who would otherwise read them (Art. 6(1)(f) GDPR).
Import from ChatGPT or Claude
If you paste text from ChatGPT or Claude into the profile import, we remove email addresses, phone numbers and similar identifiers from it and send it to OpenAI, which picks out topics for your profile. Basis: your consent, and your explicit consent where the text reveals sensitive data (section 4).
Notifications
If you allow notifications, we store your device’s push token and send notifications through Apple (iOS) or Google (Android). Message notifications show the sender’s name and the start of the message. Turn this off in Settings or in your phone’s settings. Basis: our contract with you.
Location, when you use Nearby or the map
When you use Nearby or the map, we store your device’s position rounded to about 110 metres, and the venue or neighbourhood you are at. Other people never see the stored position; they see a blurred one. A Nearby session lasts two hours unless you extend it, and it cannot run longer than six hours in total.
People who can see a plan see its venue, the activity, a rough time and its cover, if it has one. If you post a plan with your photo switched on, they also see your photo and your first name, until you switch the photo off. If you share a group plan’s link, any signed-in DUDA user who receives the link can see the plan, whatever audience you chose.
Basis: providing the Nearby feature you switched on (our contract with you). Showing your photo on a plan relies on your consent, which you can withdraw for each plan.
Plan covers, if you add one
If you host a plan, you can give it a cover: one photo, or a video of up to 15 seconds. Everyone who can see the plan sees its cover: in the list of upcoming plans, on the plan’s page, on its map pin when the plan is open to everyone, and in the preview of a shared link to it (which only signed-in DUDA users can open). The cover is shown even if you switch your photo off for that plan, so choose a picture of the place or the activity, not of yourself or anyone who has not agreed to appear in it.
Before anyone sees a cover, we check it with our image-safety system (above) and clean it: a photo’s hidden details, such as where it was taken and the camera used, are removed, and a video loses its sound and its hidden details. We keep only that cleaned copy and a small still image of it; the file you uploaded is deleted within minutes. We do not look for or recognise faces in covers.
You can change or remove a cover at any time. It is also deleted, within about ten minutes, once the plan has been cancelled, has expired or has taken place, and when you delete your account. Basis: providing the plan feature you chose to use (our contract with you).
Connected apps
Connected apps are not available yet. This section and the next describe how they will work when they are.
If you connect Spotify, Strava, Pinterest, Google Calendar or Instagram, we receive the signals you authorise. Examples are music genres, activity types, board titles, or the rhythm of your calendar. We use them to adjust your lifestyle compatibility; they never exclude anyone. If you connect YouTube, we receive the channels you subscribe to and the videos you have liked; we do not turn them into interests or use them in matching. Basis: your consent, and explicit consent where an app reveals health data.
YouTube and Google Calendar
DUDA uses YouTube API Services. If you connect YouTube, you also agree to the YouTube Terms of Service. Google’s own use of your data is covered by the Google Privacy Policy.
- What we read. From YouTube, with read-only access: the channels you subscribe to (their names and descriptions) and the videos you have liked (their titles and the channel that published each one). We cannot see your watch history or search history, and we never post, like, subscribe or change anything. From Google Calendar, with read-only access: when your events happen and how many people each one invites. We do not keep event titles, descriptions, locations or guest names.
- What we do with it. From YouTube, we store the authorised channel names, descriptions and liked-video titles. We do not turn them into interests, and we do not use them in matching. We do not show them to other users. From Google Calendar, we turn the timing and invite counts into a summary of the rhythm of your week, and use that only to adjust your lifestyle compatibility with other people. We do not show it to other users.
- What we keep. The names, titles and descriptions above, the Google Calendar weekly-rhythm summary, and the access tokens Google issues us, which we encrypt. We refresh YouTube data every day, and delete it if we have not been able to refresh it for 30 days. Otherwise we keep it until you disconnect the app or delete your account.
- Who else gets it. Only Amazon Web Services, which stores it for us. It is not sent to OpenAI or to any other provider in section 6. We do not sell it, use it for advertising, or give it to advertisers or data brokers, and we do not use it to train AI or machine-learning models. Nobody at DUDA reads it unless you ask us to, or unless we need to for security or to comply with the law.
- Stopping it. Disconnect the app in Settings → Connected apps and we delete the tokens and the data straight away. Disconnecting YouTube or Google Calendar also removes DUDA’s access in your Google account, and because both use the same Google permission, that disconnects both. You can also check or remove DUDA’s access yourself in Google’s security settings at myaccount.google.com/permissions; if you do that, we delete the data the next time we try to refresh it, within a day. If you delete your DUDA account, we also ask Google to revoke our access.
DUDA’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Contacts, if you use contact discovery
The app turns each phone number into a hash (a scrambled code) before sending it. We protect those codes with a secret key held on our servers, and compare them only against people who chose to be findable. We never store your contact list.
Hashes of phone numbers can in principle be reversed by guessing, which is why the key and the comparison stay on our servers.
Basis: your consent, for your own use of the feature. For your contacts’ numbers, which we use only for that comparison, our legitimate interest.
Identity verification, if you choose to verify
Verification is optional, but you need it before you can send a Move in Nearby (including a Move to join a Plan), accept or move back a Move you received, join a Plan, say hi to someone in Nearby, propose a date, or accept a date. Your “I’m here” pin shows your photo and first name only if you are verified. The scan runs in our own Amazon Web Services account in Ireland: a short live video confirms that a real person is present, and a still frame is compared with your main profile photo.
We keep only the result, never the images or any biometric template. We tell you the result in a notification, and the notification never says why a check did not pass. Basis: your explicit consent, given before the scan starts.
What you have to give us. To create an account you need an email address, a password and your name, and you must confirm you are 18 or over. Without these there is no account.
To be shown to other people you also need a display name, your date of birth, your gender, who you are interested in, an age range, your location (a city, or your device’s position), a handle, and at least two photos. Without these your profile is not complete and is not shown.
Everything else in your profile is optional. Verification is optional too, except for the actions listed under “Identity verification” above. None of this is required by law; it is what the service needs to work.
Information we get from others
- From Apple or Google: your name and email, if you sign in with them.
- From apps you connect: see above.
- From Firebase: confirmation that you control your phone number.
- From other users: reports about you, invites that name you, and their contact lists, if your verified number is in them.
If you join our waitlist
On this website you can join our waitlist. We collect your email address (people who joined earlier may have given a phone number instead), your city, your age and what you are here for (dating, meeting people, or either). If you choose to add them, we also collect your gender identity and who you are looking for, with your explicit consent for those two; both are optional, and you can join without them. When you give that consent we record when you gave it and the IP address you gave it from, as evidence of the consent, and delete both with your contact details.
To confirm the email address is yours, we send it a 6-digit code before adding you to the list. We keep only a scrambled form of the code, and it stops working after 10 minutes.
We use this to tell you when DUDA launches near you. We keep the contact details for 18 months, then delete them. Basis: your consent.
If you arrived through someone’s invite link, we also keep which invite it was, so that when you sign up in the app with the same email or phone number we can connect you with the person who invited you. We delete it as soon as it has been used, or otherwise together with your contact details. Basis: taking the step you asked for when you opened the invite.
To see where people stop on the way through the waitlist, the page sends step events to PostHog (EU cloud): which step was reached, whether a code was sent or accepted, which question was left empty, and which venue QR card the visit came from. It never sends your answers to the questions, and your IP address is removed before the events leave our servers.
If you don’t allow analytics (or don’t answer the banner), these events are anonymous: they carry no email, no codes and no invite links, and nothing is stored on your device. Basis: our legitimate interest in understanding which steps lose people.
If you allow analytics, PostHog keeps an id on your device so your visits count as one person, and once you confirm your email we link your visits to that email and your waitlist code, so we can follow how you joined and later how you arrived in the app. The link to your email and waitlist code is deleted after 18 months, or sooner if you ask. Step events without an email follow PostHog’s own retention for our project. You can change your mind at any time with “Cookie settings” at the bottom of the waitlist page; to have what was already collected deleted, write to privacy@dudamatchmaker.com. Basis: your consent.
Cookies and device storage on our website
The waitlist page uses no advertising or third-party tracking cookies. It stores only:
duda_waitlist(your browser’s local storage): your email, your waitlist code and how far you got, so a reload or a return visit picks up where you left off. Your answers to the questions are not kept there. It stays until you clear your browser’s site data, or until we find that your sign-up was deleted. Needed for the page to work.duda_analytics(local storage): your answer to the analytics banner, so we do not ask again. Needed to respect your choice.- PostHog’s
ph_…keys (local storage): the analytics id described above. Only if you allow analytics; choosing “Reject” later in “Cookie settings” removes them. - Cloudflare Turnstile may set its own short-lived data while it checks that you are not a bot. Needed for security.
Support, security and operations
Support tickets, bug reports you choose to send (with your email and device details), audit logs of security-relevant actions, system logs, and backups. Basis: our contract with you; our legitimate interest in security, investigating problems and keeping the service running.
4. Sensitive data
Some information is special-category data under Article 9 GDPR and gets stricter treatment:
| What | Where it comes from |
|---|---|
| Sexual orientation | who you say you are looking for, and your relationship-structure preference |
| Sex life | some questionnaire answers, and the optional profile chat |
| Health information | fitness and health apps you connect (Strava) |
| Political opinions, religious or philosophical beliefs | some questionnaire answers |
| Racial or ethnic origin | your own ethnicity if you add it (shown only to you), and the ethnicities you want to see |
| Biometric data | the face scan, if you verify your identity |
We use these only with your explicit consent. Apart from the face scan, you give it when you sign up: the sign-up box says “I’m OK with DUDA using who I’m looking for to match me”, and ticking it gives your explicit consent to us using everything in the table except biometric data, as section 9 of our Terms of Use says. We record that consent with your account, with the version of the Terms you accepted. If you created your account before 3 November 2026, this applies from 3 December 2026; until then, the app records each consent when it first comes up. There are two exceptions. Reports that mention sensitive matters are processed to keep people safe. And anything you choose to write in a bio, a message or a support ticket is processed as you wrote it. If text you import from ChatGPT or Claude reveals any of these, the same consent covers it, and the text is sent to OpenAI (section 6). For identity verification, you give consent separately, before the scan; our systems refuse to start a verification without it.
If you set an ethnicity preference, people whose stated ethnicity is outside it are not shown to you. Your own stated ethnicity is used the same way when other people set a preference.
You can withdraw any of these consents at any time in Settings → Privacy & data. Withdrawal stops future use and removes that data from matching; it does not undo processing that already lawfully happened. Withdrawing consent about who you are looking for means we can no longer match you with anyone. If you withdraw a consent and later choose to give that information again or reconnect that app, doing so gives your consent again.
5. Automated decisions
Matching: automated, but it does not decide for you
We rank and suggest people automatically. You choose who to connect with. The system surfaces candidates; it does not accept, reject or match on your behalf.
How it works:
- Your answers and profile are scored for compatibility across the questionnaire’s areas and for overall similarity.
- The results are then adjusted so the same few people are not shown to everyone.
- People outside your age range, distance, gender preferences or dealbreakers are never shown to you. The same applies to your ethnicity preference, if you set one.
- A language model (OpenAI) writes the short explanation of why you might match.
- The result decides who appears in your suggestions, and in what order.
Identity verification: a solely automated decision you can contest
The outcome is decided automatically. If the check declines you, you can ask a person to review it in the app. A refusal means you cannot do the things that need verification: send, accept or move back a Move, join a Plan, say hi in Nearby, or propose or accept a date.
You have the right to a human review. If the check refuses you, you can ask a person to look at it again from within the app; a member of our team can review the decision and verify you manually. You can also tell us why you think the decision was wrong. This right does not depend on anything else about your account.
Image-safety scanning: an automated refusal and suspension you can contest
If our image-safety check refuses an image you upload (section 3), the refusal and the suspension of your account happen automatically, before any person has looked. A person reviews the suspension within 24 hours, and we email you a statement of reasons. You can ask for a review through Support and tell us your side.
Safety suspensions
If three different people report your account within seven days, it is hidden from other people automatically, before any person has looked at the reports. You can still use the app (read, not send) while a person reviews the reports, within 24 hours. You can ask for that review through Support and tell us your side.
6. Who we share it with
We do not sell your data. We share it only with the providers below, for the purposes listed:
| Who | What for |
|---|---|
| Amazon Web Services | hosting, databases, file storage, the identity check itself, and the image-safety scanning of uploaded photos, images and plan-cover videos (Amazon Rekognition), both of which run inside our own AWS account |
| Cloudflare | serving and protecting our sites, including the identity-check page and the Turnstile bot check on the waitlist, which your browser loads from Cloudflare |
| OpenAI (US) | turning your profile and answers into a compatibility representation; writing match explanations and conversation starters from both people’s profiles; running the optional profile chat, including what you type in it; picking out topics from text you import from ChatGPT or Claude |
| PostHog (EU) | waitlist step events, anonymous unless you allow analytics; then also your email and waitlist code (never your answers, never your IP address); usage analytics in the app, as described in section 3, unless you switch it off; and error reports from our servers, with personal details removed before sending |
| Resend | account emails (verification, password reset, export links) and the waitlist confirmation code |
| Google (Firebase) and Apple | push notifications; phone verification; sign-in if you use it |
| Google Firebase Crashlytics | crash reports from the app, linked to your account ID |
| Meta | Facebook sign-in, if you use it (not available yet) |
| Mapbox | maps and place search. The app sends your approximate position and what you search for. When you use the map, Mapbox’s map software in the app also sends Mapbox usage data: an app-specific device identifier, the device model, the operating system, screen and text-size settings, and, while you allow location access, your device’s location. Mapbox uses it to improve its maps, under its own privacy policy. To turn this off, tap the ⓘ button on the map and choose the telemetry option |
| KLIPY | GIF search and display (not available yet). When it is, your device contacts KLIPY directly, so KLIPY sees its IP address |
| Apps you connect | exchanging the data you authorise |
| Notion | bug reports you choose to send, including your email and device details |
| Telegram | alerting our support staff that a ticket exists. The alert carries a short subject line and category, never your message |
| Prighter | our representative, if you contact us through them. The representative badge on this page is loaded from Prighter, so Prighter sees your IP address |
| Indian Type Foundry (Fontshare) | the Satoshi typeface on our web pages. Your browser downloads it from Fontshare’s servers, so Fontshare sees your IP address and browser details |
Other users see only what your profile and privacy settings expose. We also share information where the law requires it, or where it is necessary to investigate abuse or protect someone’s safety.
7. Where your data goes
Our servers are in the European Union: Frankfurt, and Ireland for the identity check. Georgian law treats this as a transfer abroad. The EU and EEA countries are on the State Audit Office’s list of countries that protect personal data adequately, so no further step is needed for them.
Some of our providers are in the United States: OpenAI, Mapbox, Google (Firebase and Crashlytics), Apple, Meta, Cloudflare, Resend and Notion. Others, such as Telegram, the Fontshare typeface service and KLIPY, may be in other countries that are not on that list. Section 6 says what each one receives.
Your consent to transfers outside the approved countries. The United States is not on the State Audit Office’s list. Its laws may not protect your data as well as Georgian or EU law does: public authorities there may be able to access it under their own laws, and you may find it harder to enforce your rights. Under Article 37 of the Law of Georgia on Personal Data Protection, we make these transfers on the basis of your written consent, which you give when you accept this policy at sign-up, after reading this warning. DUDA cannot run without these providers, so you withdraw this consent by deleting your account (section 9).
For users in the EU and the UK, we also rely on the safeguards the GDPR allows, such as Standard Contractual Clauses (and the UK’s equivalent) or an adequacy decision. Ask us and we will tell you which safeguard applies to any provider.
DUDA itself is established in Georgia, outside the EU/EEA, and your data is stored on servers in the European Union. Because we are outside the EU but offer this service to people inside it, the GDPR applies to us directly, and we have appointed a representative in the EU and the UK (see section 1).
Whether our own staff accessing data from Georgia also counts as a “transfer” that needs a separate safeguard is a question we are still settling. We will say so here plainly once it is answered. We would rather tell you what is unresolved than imply a certainty we do not have.
8. How long we keep it
| What | How long |
|---|---|
| Your account and profile | while your account exists |
| Messages | while your account exists, except threads with someone you unmatched or blocked, which are archived immediately and deleted after 365 days |
| Match suggestions | 30 days |
| Match records | 180 days for finished ones; ongoing connections kept while they last |
| Security audit logs | 7 years |
| Routine audit logs, notifications | 90 days |
| Networks you sign in from | 180 days after you last used them |
| Data from YouTube and Google Calendar | until you disconnect the app or delete your account; disconnecting deletes it immediately; YouTube data we cannot refresh for 30 days is deleted |
| A deleted account | deleted immediately; anything left is purged within a day. Encrypted backups and system logs roll over within 30 days. Your usage-analytics events stay under a coded ID until they reach the 1-year limit below, unless you ask us to delete them |
| Usage analytics from the app | can be used for up to 1 year from each event (PostHog’s limit on our plan, not a deletion); deleted sooner if you ask |
| Data-export files | deleted 7 days after we create them; the download link itself lasts 24 hours |
| Nearby history | 90 days |
| Onboarding and profile-chat transcripts | 12 months after you last used them |
| Finished invites | 30 days after they end |
| Reports about abuse | kept for safety investigations |
| Plan covers | until you change or remove the cover, the plan is cancelled, expires or takes place, or you delete your account; then deleted within about ten minutes. A cover upload refused for a reason other than image safety is deleted at once, and its record after 7 days |
| Refused chat images and plan covers, kept as evidence | kept for 90 days after it is refused and then deleted, unless it is needed for a report to the authorities, an appeal or a legal claim, in which case it is kept until that ends |
| Waitlist sign-ups | 18 months, then the contact details are deleted |
9. Your rights
- See your data. Download a copy of the data we hold about you from Settings; the link is valid for 24 hours. We leave out security codes, other people’s reports about you (to protect them), and some internal values. The download does not include the usage-analytics events PostHog holds; ask us and we will send them.
- Take it elsewhere. The download is a machine-readable file.
- Correct it. Edit your profile and answers directly in the app.
- Delete it. Delete your account from Settings. This is immediate and irreversible. Reports other people made about you are kept (see section 8).
- Withdraw consent. Withdraw sensitive-data consents in Settings → Privacy & data. To withdraw your consent to transfers to the United States, delete your account (section 7). Notifications, contacts and location are controlled in your phone’s settings and in the app.
- Ask us to block (restrict) processing. Contact us; we block within 3 working days.
- Ask for a human to review an automated decision. See section 5.
- Complain to a supervisory authority. In Georgia, complain to the State Audit Office (personal data protection, pdp.sao.ge). In the EU, complain to the data protection authority where you live or work. In the UK, complain to the Information Commissioner’s Office (ico.org.uk). You can also contact us through our representative (section 1).
We answer requests to see, correct, delete or block your data, or to withdraw consent, within 10 working days. In exceptional cases we may need up to 10 more working days, and we will tell you why.
Your right to object. Where we rely on our legitimate interests (section 3), you can object at any time on grounds relating to your situation. We will stop unless we have compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend legal claims. Email privacy@dudamatchmaker.com with “Objection” in the subject.
Being suspended does not take these rights away. If we suspend your account for breaking our rules, you can still export your data, delete your account, withdraw consent, contact support, and contest an automated verification decision.
10. Security
Our safeguards are:
- encryption in transit and at rest;
- passwords stored hashed;
- access to production data limited;
- security-relevant actions logged;
- re-authentication before dangerous account changes;
- secrets held in a managed secret store.
No system is perfectly secure, and we do not claim otherwise.
11. Children
DUDA is for adults only (18 or over). We do not knowingly collect data from anyone under 18. If you believe a minor is using DUDA, contact us and we will remove the account.
12. Changes
If we change this policy materially, we will tell you at least 30 days before the change takes effect, in the app and by email to the address on your account. Corrections, and changes required by law, may take effect sooner; we will still tell you. We keep every published version of this policy at this address, with its date. When you sign up we record which version you were shown.