DuoUp Privacy Policy
Last updated: 3 October 2026
1. Introduction and Data Controller
This Privacy Policy explains how your personal data is processed when you use the DuoUp mobile application (“DuoUp”, the “App”).
- Data Controller: DuoUp is operated by an individual developer (a natural person) residing in Türkiye; in this policy, “DuoUp” and “we” refer to this person. The controller's name appears as the “Seller” on the app's App Store page. If you request our name and postal address at the address below, we will provide them without delay.
- Contact: contact@duoup-app.com
2. Scope and Applicable Law
As DuoUp is offered in more than one country, this policy is based on the following regulations:
- KVKK — Law No. 6698 on the Protection of Personal Data (Türkiye)
- GDPR — European Union General Data Protection Regulation (EU users)
- CCPA/CPRA — California Consumer Privacy Act (U.S., California residents)
3. Personal Data We Collect
| Data category | Examples | Source |
|---|---|---|
| Identity and contact | Full name, email address | Directly from you |
| Authentication | Your password (stored only as a hashed value / bcrypt; we cannot see the plaintext), session tokens | Directly from you / automatically |
| Sign in with Google or Apple | If you choose this method: the unique identifier the provider assigns to your account, your email address (with Apple, the private relay address created by Apple if you prefer), your name; with Apple, also a token used to revoke the authorization when you delete your account | Google or Apple (with your consent) |
| Profile | Date of birth (the full date is stored; only your age is shown to others, the full date stays private), profile photo | Directly from you |
| Location | Your device location, and the exact geographic coordinates (latitude/longitude) together with a location label are stored persistently in the listings you create | From your device (with permission) |
| Activity | The sports/activities and skill levels you select | Directly from you |
| Usage content | Listings, applications, matches, in-match messages (content stored as plain text — see Section 7), ratings you give/receive (stars + predefined tags), friend connections | Directly from you |
| Device and notification | Push notification token, device platform (iOS/Android) | Automatically |
| Technical data | IP address, request/access logs, error and performance logs | Automatically |
DuoUp does not use an advertising ID, ad tracking, or marketing cookies/trackers. The push token is used solely to send notifications.
When you sign in with Google or Apple, we receive only the information listed above from these providers; we do not receive your Google or Apple password, your contacts or any other data in your account, and we do not act on your behalf in those accounts. If you already have a DuoUp account created with the same email address, the sign-in is linked to that account.
4. Purposes of Processing and Legal Bases
In accordance with GDPR Article 6 and KVKK Article 5, each processing activity relies on a legal basis:
| Purpose | Legal basis |
|---|---|
| Account creation, sign-in, authentication | Performance of a contract |
| Location-based event/match suggestions | Your explicit consent (location permission) |
| In-app messaging and notifications | Performance of a contract |
| Security, prevention of misuse, fraud prevention | Legitimate interest |
| Error tracking and measuring service quality | Legitimate interest |
| Fulfilling legal obligations | Legal obligation |
| Child safety and crime reports | Legal obligation; in countries where no such obligation exists, legitimate interest (protecting children and users) |
For processing based on explicit consent (e.g., location), you may withdraw your consent at any time; this does not affect the lawfulness of processing before withdrawal.
5. Who We Share Your Data With
Other users. Your name, profile photo, age (if you entered your date of birth), activities, the ratings you receive and your listings, including the listing's exact location on the map, are shown to other people using the app. Your messages are seen only by the person you are matched with.
Service providers (data processors). The providers below process your data only on our behalf and on our instructions; each is contractually bound to provide protection equivalent to that described in this policy:
| Provider | Data processed | Purpose |
|---|---|---|
| Hetzner (Germany) | All account and content data | Server and database |
| Cloudflare (R2, Email Routing) | Profile photos, database backups, emails you send us | Storage, email routing |
| Brevo (France) | Name, email address, content of the email sent | Verification codes, password reset and account emails |
| Expo (via Apple and Google notification services) | Notification token and notification content (the sender's name and the first 80 characters of the message); when checking for app updates, the device's operating system and a random identifier | Notification delivery, app updates |
| Sentry (United States) | Technical context at the time of an error | Error tracking |
Services that process data on their own behalf. Maps are displayed using Google Maps; while you use the map, Google processes your IP address and the location shown on the map on its own behalf. Emails you send us and report notifications (including a copy of the reported content) are also processed by Google (Gmail), which hosts our mailbox. This processing is subject to the Google Privacy Policy. Converting a location into a district and city name is done by your device's location service (Apple or Google). When you sign in with Google or Apple, these companies perform the authentication on their own behalf and know that you signed in to DuoUp; this processing is subject to the Google Privacy Policy and the Apple Privacy Policy.
Sharing for safety and legal reasons. We may also share your data: (a) in response to properly issued requests from competent authorities; (b) when reporting suspected child abuse, or a threat to a person's life or safety, to law enforcement and judicial authorities and to the National Center for Missing & Exploited Children (NCMEC) in the United States; (c) if DuoUp is transferred to a company (in which case we will inform you in advance).
We do not sell your data and do not share it for targeted advertising.
6. International Data Transfers
Our service providers' infrastructure is located outside Türkiye:
- Server and database (Hetzner) — Germany
- Cloudflare — R2 storage region: Eastern Europe; email routing: global infrastructure
- Brevo — France
- Sentry, Expo — United States
- Apple, Google — global infrastructure
Your personal data is therefore transferred outside Türkiye. We have concluded data processing agreements with our service providers; transfers outside the European Economic Area are based on the European Commission's standard contractual clauses or on the recipient's certification under the EU-U.S. Data Privacy Framework. You can request a copy of these safeguards at contact@duoup-app.com.
7. Confidentiality of Messages
Your in-match messages are stored in plain text on our servers and are not end-to-end encrypted. This means messages may be accessed when necessary for security, investigating misuse complaints, and legal obligations. Please treat messaging not as a private/confidential channel but as an application feature subject to moderation.
8. Retention Periods
- Account and profile data: When you delete your account, data is not deleted immediately; your account is kept in a “suspended” state for 30 days (during which you can restore it by signing in again). After 30 days, your personal data is irreversibly anonymized. The Google and Apple identifiers linked to your account are deleted at the same time; if you signed in with Apple, DuoUp's authorization with Apple is revoked.
- Content such as listings, messages, ratings: Tied to your account; when the account is anonymized, the personal link in this content is also removed.
- Technical/error logs: IP/access and error logs are kept for a limited period for security and the operation of the service.
9. Data Security
We take appropriate technical and organizational measures to protect your data: passwords are stored hashed irreversibly (bcrypt), communication is encrypted with TLS, session tokens are managed with a revocation mechanism, and sensitive fields are redacted in logs. Although no system is 100% secure, we maintain reasonable measures to protect your data.
10. Your Rights
KVKK (Türkiye) — Article 11
You have the right to learn whether your personal data is processed, to request information, to learn the purpose of processing, to know the third parties to whom it is transferred, to request correction/erasure, to request that these be notified to third parties, to object to results arising against you from automated analysis, and to claim compensation for damages.
GDPR (EU users)
You have the rights of access, rectification, erasure (“right to be forgotten”), restriction of processing, data portability, objection to processing, withdrawal of consent, and to lodge a complaint with a supervisory authority.
CCPA/CPRA (California residents)
You have the right to know what data is collected, to request deletion, to opt out of the “sale/sharing” of data (DuoUp does not sell data), and to non-discrimination for exercising these rights.
To exercise these rights, you can reach us at contact@duoup-app.com. We respond to your request within the statutory time frames.
11. Children's Privacy
DuoUp is intended only for individuals aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we determine that we have processed data belonging to someone under 18, we delete that data.
12. Changes
This policy may be updated from time to time. You will be informed within the app of significant changes. The current version is always published on this page.
13. Contact and Complaint Authorities
For questions and requests: contact@duoup-app.com
- Türkiye: You may file a complaint with the Personal Data Protection Authority (KVKK).
- EU: You may file a complaint with the data protection supervisory authority of your country of residence.