Encrypted content
Names, Letters, the Together List, Story and photos, the date your relationship began, gift messages, and mini game turns played at a distance are opaque to the backend.
Private by design
Protecting your Couple without the easy slogans.
Privacy at Duonook starts from a precise boundary: which content the service must not be able to read, and which technical information it needs to get that content to the right person.
At a glance
Three layers, one clear responsibility.
Necessary metadata
Couple membership, devices, event types and times, chosen gifts, hearts, unlocked packs and challenge status, object sizes, and push endpoints are needed for authorization and delivery.
User control
Authorized devices, local export, and account deletion make the data lifecycle visible.
End-to-end encryption
Each Couple corresponds to a cryptographic group, and every authorized device is a member of it. Sensitive content is encrypted before it leaves the device: the backend carries events and opaque copies, but does not have the keys to interpret them.
This covers names and nicknames, the Couple’s name, the date your relationship began, the text and photos of Letters, Together List items, Story milestones and photos, gift messages, and the turns of mini game challenges played at a distance, with their answers, guesses, bets, clues, drawings, scores, and results.
What the service still needs to know
End-to-end does not mean “no data on the server.” Duonook processes the information it needs in order to know which devices belong to a Couple, deliver an event, maintain the integrity of the catalog and hearts, keep track of mini game challenges, and send notifications.
This information includes anonymous identifiers and memberships, device identifiers, event types and times (for example, that a letter was sent or opened), selected avatars and moods, chosen gifts and reactions, heart transactions, unlocked mini game packs and, for each challenge at a distance, the pack, game type, cards dealt, which of you started it, its status and times, object sizes, and push endpoints. Private text, photos, and game answers stay separate from this operational layer.
A precise claim
Duonook does not promise that every byte is invisible to the service. It promises a verifiable technical boundary between the couple’s content and the data needed to run the product.
Authorized devices and recovery
Access to content depends on the devices that are part of the Couple. When your partner joins or a device is added, the server only forwards the request: it is the devices already in the Couple that admit the newcomer to the cryptographic group, automatically and with no manual steps. Keys are created on the devices and are never reconstructed in plain text by the server, which remains without access to the content. That is why invite links and the recovery key must be kept safe.
Each person has a personal key that protects their own encrypted vault. On a new phone, just open Duonook, choose “Recover my Couple,” and paste the key or scan its QR code. When you are done, a replacement key is created and the old one stops working.
By design, losing all your authorized devices and your key makes the content unrecoverable: this is a real consequence of encryption, not a support failure.
Minimal notifications and widgets
Notifications carry generic categories and links, not the text of letters or gift messages. Mini games only send two generic alerts, for a new challenge and for a result that is ready, with no answers or scores. Widgets, too, receive only a minimal view of the data and do not expose notes or arbitrary content beyond the encrypted boundary.
Export and deletion
In Settings, you can export a readable copy of the data stored on your device. You can also delete your account: the backend deletes your account, your devices, your sessions, and every Couple you are still a member of, along with the shared encrypted material, while the app destroys the local identity and keys.