duonook

Legal

Privacy, no asterisks.

Your most personal content is end-to-end encrypted. Here we explain, in concrete terms, which technical data Duonook still needs and how long it is kept.

Effective October 6, 2026

No advertising profiling, no selling of data, and no third-party analytics. The server stores shared content only in encrypted form and does not have the keys to read it.

1. Data controller and contact details

The data controller is Guido Cacace, VAT no. 13827430961, based at Via Alberelle 55, 20089 Rozzano (MI), Italy.

No data protection officer has been appointed because, at present, the conditions that would make one mandatory are not met. For any privacy matter, you can write directly to the data controller.

2. Scope and minimum age

This policy covers the Duonook app, its backend, and the public website. The basic app is intended for people aged 14 or older; if the user’s country sets a higher age threshold, that threshold applies. Anyone under the age of majority must have permission from a parent or guardian.

Duonook does not ask for your date of birth or an ID document: collecting this data would be disproportionate to the service. Age is confirmed during onboarding.

3. What data we process

Access and devices

Random account and device identifiers, platform, session tokens stored in hashed form, authorization status, public keys, and the technical data needed to connect two people in the same Couple. The app does not ask for an email address, password, phone number, contacts, or location. Your email address is processed only if you choose to write to us for support or about privacy.

Phone permissions

Duonook asks for three permissions, each only when it is needed: the camera, solely to scan the QR code of your recovery key; adding to your photo library, to save the image of your recovery key; and notifications. It does not use the microphone or Face ID. You can revoke any permission in your phone’s settings.

How the Couple works

Memberships, invites, event identifiers and sequence, timestamps, object sizes, and delivery and sync status. This metadata is used to authorize, order, and deliver encrypted packets without reading their contents.

So the server knows what kind of thing happens and when, but not the content: for example, it knows that a letter was sent or opened, or that an idea was added to the Together List, and when.

Operational choices and in-app economy

Identifiers of the selected avatar and mood, the gift chosen, gift opening status and reactions, Fortune Cookie and seal identifiers, heart balance and transactions, and unlocks, including mini game packs. The server sees these in plain text because it has to show them to your partner and keep track of balances; they do not include the private text the two of you enter.

Plus subscription

If you activate Duonook Plus, payment takes place between you and Apple: Duonook does not receive the name, email address, or payment details of your Apple ID. Our server stores only your Plus status and its expiration date, plus a technical log of subscription events received from RevenueCat (type, date, purchase environment, and pseudonymous account identifier), without any amounts.

Mini games

Mini games are played inside the Couple, with themed packs of cards curated by the Duonook team. A pack can be free, unlocked once for the whole Couple with hearts, or included with Duonook Plus. When you unlock a pack, the server records which pack, when, which of you unlocked it, and the hearts spent, as a heart transaction.

When you play in person, passing the same phone back and forth, nothing about the game is sent to the server. In a challenge at a distance, one of you plays, the other person receives the challenge and plays the same cards, and then you both see the results. For each challenge, the server stores the pack, the game type, the identifiers of the cards dealt (the cards are public catalog content), which of you started it, its status (open, completed, or cancelled) with the related times, and the identifiers of the two encrypted turns.

Answers, guesses, bets, clues, drawings, scores, and results are not part of this data: the turns travel end-to-end encrypted between your phones, like letters, and the server cannot read them. Challenges only trigger two generic notifications, one when a new challenge arrives and one when the result is ready, with no game content.

Notifications, security, and support

Encrypted push endpoint, notification preferences by category, technical delivery outcomes, server logs with IP address, user agent, date, requested path, and response code, plus a fingerprint of the IP address used to enforce anti-abuse limits. Support requests include whatever you choose to send us: do not attach recovery keys, letters, gift messages, or private photos.

Error reports

If the app runs into an error, it sends an anonymous report to our server: the error type and message, shortened and cleaned up, the places in the code and interface where it occurred, the screen without identifiers, the app version and build, the platform and operating system version, language, and time. The report is not linked to your account, Couple, or device, is not stored together with your IP address, and does not contain your content. Identical reports are grouped and counted. Like any request, it still passes through the technical logs and anti-abuse limits described above.

4. What stays end-to-end encrypted

Names and nicknames, the Couple’s name, the date your relationship began, the text and photos of Letters, Together List items, Story titles and notes, and gift photos and messages are encrypted on the device before they are sent. The same goes for the turns of mini game challenges played at a distance: answers, guesses, bets, clues, drawings, scores, and results. The backend stores and delivers opaque data and does not have the keys needed to read it.

Encryption protects the content, not the fact that an event happened: for example, the server can know that a packet was sent and when, but not what it contains. Duonook does not use the content of any Couple for advertising, model training, or automated content generation. The artificial intelligence tools in the editorial panel work only on catalog content prepared by the administrators.

Authorized devices are part of the Couple’s cryptographic group. Each person receives a personal recovery key; losing it along with all of your authorized devices can make the content unrecoverable, even for Duonook.

5. Purposes and legal bases

  • Performance of a contract: creating the anonymous account and the Couple, syncing encrypted content, and managing devices, the catalog, hearts, unlocks, mini games, the Plus subscription, and support requested by the user.
  • Consent: enabling optional features where the law requires a free choice, for example the operating system permission for notifications. Consent can be withdrawn without retroactive effect.
  • Legitimate interest: protecting accounts and infrastructure, preventing abuse and fraud, diagnosing errors, and defending rights, using minimized data and without commercial profiling.
  • Legal obligation: complying with tax and accounting rules and with valid requests from authorities.

No decisions with legal effects are made based solely on automated processing, and no advertising profiling takes place.

6. Service providers and recipients

Data is disclosed only to the extent necessary for the service:

  • IONOS SE: backend infrastructure, database, and backups. As verified at the time of this policy, the Duonook server is located on the IONOS network in Germany;
  • Server Plan S.r.l.: technical infrastructure and email for the duonook.com domain, in Italy;
  • Expo / 650 Industries, Inc.: push notification routing and technical build services. Notifications contain generic text, never names, letters, gift messages, photos, or game content;
  • RevenueCat, Inc.: managing Duonook Plus subscriptions on our behalf, as a processor within the meaning of Article 28 of the GDPR. It receives the pseudonymous identifier of the Duonook account, the purchase history and App Store receipts (product, purchase, renewal, and expiration dates, refunds, store country), and technical data from the requests made by its SDK, such as platform, operating system and app version, language, and IP address. It uses this data solely to verify purchases, prevent fraud, and tell us whether Plus is active, not for advertising or tracking. It is based in the United States, where it stores the data;
  • Apple and Google: app distribution, including the beta via TestFlight, and operating system notifications. Apple also handles payment for Plus subscriptions purchased on the App Store, as an independent controller and under its own privacy policy. If you use TestFlight, Apple may share with us crash reports, if you have agreed to send them, and the feedback you choose to send us;
  • Advisors or authorities, only when necessary for a legal obligation, for security, or to protect a right.

Duonook does not sell data, does not share user lists with advertisers, and does not make the content of any Couple public.

7. Transfers outside the European Economic Area

The main backend and its backups are hosted in Germany. Expo, Apple, or Google may use infrastructure outside the European Economic Area; in these cases, the transfer relies on the mechanisms set out in Chapter V of the GDPR, such as an adequacy decision and/or the standard contractual clauses adopted by the European Commission, as stated by each provider.

RevenueCat stores subscription data in the United States, on Amazon Web Services infrastructure, and uses its own sub-processors, listed in its data processing agreement. The transfer relies on the standard contractual clauses adopted by the European Commission (controller-to-processor module), which are included in that agreement.

8. Retention and deletion

  • Account, Couple, and encrypted content: until the account is deleted. Deleting your account removes it along with your devices and sessions, and with every Couple you are still a member of: that Couple’s shared encrypted content, server-side keys, and memberships disappear for both of you. Your partner keeps their own account and devices. Couples you had already left remain with the member who stayed; your encrypted vault and the mini game challenges you had started are removed from them.
  • Sign-in sessions: access tokens for 15 minutes and refresh tokens for 30 days; expired records are then deleted during technical maintenance.
  • Mini games: challenges at a distance follow the Couple’s shared data and are deleted with it when an account deletion closes the Couple. Pack unlocks are kept as accounting records, like gift purchases: if you delete your account, the record of which of you made them is removed.
  • Invites: each invite to a Couple is valid for 7 days; expired technical records are removed within 30 days.
  • Notifications: tokens until they are revoked or deleted, or until the device is reported as no longer registered; technical delivery records for up to 30 days.
  • Plus subscription: the Plus status and its expiration date are kept as long as the account exists and are deleted along with it; the log of events received from RevenueCat is kept for up to 24 months, for support, disputes, and fraud prevention. RevenueCat keeps subscription data on our behalf for as long as it is needed to manage the subscription; you can ask for it to be deleted by writing to the privacy contact. Apple keeps payment data in accordance with its own privacy policy.
  • Error reports: each group of reports is deleted 90 days after the last report in it is received.
  • Web and API logs: rotated automatically once a file reaches 10 MB, with at most 10 compressed archives kept. Data isolated because of a security incident may be kept for up to 180 days, or longer if needed for legal proceedings.
  • Support: up to 24 months after the request is closed, unless longer retention is needed for a legal defense or required by law.
  • Accounting and purchases: tax and accounting documents for 10 years from the last entry. Internal records essential to the integrity of wallets and unlocks may be kept without being attributed to any individual.
  • Backups: daily incremental and weekly full backups, rotated automatically with at most 4 full cycles. After a deletion, any remaining copies therefore drop out of the regular rotation in about 4 weeks; they are not restored to recover individual deleted accounts. Any manual copies made for maintenance are deleted within 30 days of the maintenance being completed.

In Settings, you can export the readable data stored on your device and start the deletion process. Read what happens, step by step.

9. Your rights and complaints

You can exercise your rights of access, rectification, erasure, restriction, portability, and objection in the cases set out in Articles 15–22 of the GDPR, or withdraw your consent. Write to privacy@duonook.com. We will normally reply within one month.

Because your account contains no email address or name, we may ask you to verify your request from an authorized device. We will never ask for your recovery key. The right of access does not enable Duonook to decrypt content for which it does not hold the key.

You can also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or with the competent supervisory authority in the place where you live or work.

10. This public website

The website does not use analytics, advertising pixels, profiling, or embedded third-party resources. It sets only one functional cookie, to remember your language, which lasts no more than 12 months. The server records the technical logs described above for operation and security.

11. Changes to this policy

The date at the top identifies the current version. If a change substantially affects how data is processed, Duonook will announce it in the app before it takes effect, where required. Previous versions can be requested from the privacy contact.