# Privacy Policy

**Draft. Not reviewed by a lawyer.** It is written to describe accurately what
the software currently does, so it is a truthful starting point — but it is not
legal advice and must be reviewed before Duru is offered to anyone but you.
See "Before you publish this" at the end for the specific points that need
professional input.

Last updated: 11 September 2026

## Who is responsible

Duru is run by **Silvan Jost**, an individual rather than a company, acting as
the data controller.

Contact: contact@getduru.com

Being one person rather than a company changes nothing about the obligations
below. It does mean there is no support department: the address above reaches
the person who wrote the software.

## What this covers

Duru turns material you upload into an ordered course, generates practice from
it, and lets you talk to an AI tutor. Doing that means storing what you upload
and sending some of it to AI providers. This page says exactly what is stored
and what leaves our servers.

## What we collect

**Because you created an account**

- Email address and display name.
- Password, stored only as a salted scrypt hash. We cannot read your password.
- If you sign in with Google, Apple or GitHub: the provider's user identifier,
  your email, name and avatar URL.
- Topics you pick as interests, and your chosen tutor voice.

**Because you uploaded material**

- The files themselves — PDFs and images are stored in full, as uploaded.
- Text you paste in.
- Everything extracted from them: vocabulary, grammar points, example
  sentences, lesson titles and descriptions.
- Every extraction run is kept, including the raw model output, so extraction
  quality can be audited and your edits are never silently overwritten.

**Because you practised**

- Every graded answer: the question, the expected answer, what you actually
  answered, and whether it was correct.
- Your spaced repetition schedule for each card.
- Which practice items you have already been shown.
- Test results and which lessons you have completed.

**Because you talked to the tutor**

- Transcripts of your side of the conversation are sent for review after a
  session so mistakes can be recorded.
- A short written summary of each conversation, and the topics covered, so the
  tutor can pick up where you left off.
- Your voice audio is streamed live to OpenAI during the conversation. We do
  not record or store the audio.

## What we send to AI providers

This is the part worth reading closely.

| Provider | What it receives | Why |
|---|---|---|
| **OpenRouter** (routes to OpenAI, Anthropic, Google and others) | Uploaded PDFs and images, pasted text, your practice answers, and your conversation transcripts | Extracting vocabulary and grammar, generating practice, grading answers, reviewing conversations |
| **OpenAI** | Your live microphone audio, and the tutor instructions built from your course | Real-time voice conversation |

Two consequences you should understand:

1. **Material you upload leaves our servers.** If you upload a copyrighted
   textbook, a copy of it is transmitted to a third-party AI provider for
   processing. Only upload material you have the right to use this way.
2. **Your voice is processed by OpenAI in real time.** We do not store the
   audio, but OpenAI receives it. Their handling is governed by their own
   policies, not this one.

These providers have their own retention and training policies. We do not
control them. Review OpenRouter's and OpenAI's terms if this matters to you.

## What we do not do

- We do not sell your data.
- We do not show advertising.
- We do not use a third-party analytics service. What usage we record stays in
  our own database (see **Usage analytics** below).
- We do not use your material to train our own models.
- We do not share your data with anyone other than the AI providers listed
  above and the infrastructure needed to run the service.

## Who can see your material

- **Your own courses** are private to you by default.
- **If you share a course**, anyone with the share link can import it and will
  appear to you as a member of that course. Sharing is your decision, and the
  link can be revoked at any time.
- **Course owners see membership and sync activity** — name, email, when you
  joined and how often you synced. They do **not** see your answers, your
  mistakes, your review schedule or your tutor conversations.

## Retention

Data is kept until you delete it or close your account.

- Deleting a lesson deletes its material, extractions, generated practice and
  associated review history.
- Deleting a course deletes everything in it.
- Uploaded files are deleted with the lesson that owns them.

## Your rights

Depending on where you live, you may have the right to access, correct, export
or delete your personal data, and to object to processing. Write to
contact@getduru.com and we will act on it.

You can already, without contacting anyone: download everything we hold about
you as a single file (Account → Download my data), delete your account and
everything in it, edit or delete any extracted item, delete a lesson or a
course, change or clear your interests, and revoke a share link.

## Security

Passwords are hashed with scrypt and a per-user salt. Sessions use signed
tokens. The API key for AI providers is held server-side and never reaches your
browser or phone — even the live voice connection is brokered so the browser
only receives a short-lived session, never the key.

Course material and learning data are stored unencrypted at rest in the
application database. Do not upload anything you would not want an operator of
this service to be able to read.

## Children

Duru is not designed for children and is not directed at anyone under 16. No
age verification exists today. If school or minor use is ever offered, this
policy needs rewriting first, and a data-protection review before any pilot.

## Usage analytics

We record how the apps are used, in our own database, so we can tell which
parts help and which are ignored.

**What is recorded:** an event name from a fixed list in the source
(`analyticsEvents` in `packages/shared/src/index.ts`), a handful of small
properties chosen at each call site -- a count, a grade, which of three
onboarding choices was taken -- the platform (web or mobile), a random
identifier stored on your own device, and your account id when you are signed
in.

**What is not:** your IP address, your device or browser, the page you came
from, and nothing you have typed, said or uploaded. No third party receives
any of it; there is no analytics service, no advertising network and no
cross-site identifier. Nothing is shared with anyone.

**How long:** events are deleted after 180 days. Deleting your account removes
your account id from them; the anonymous rows that remain cannot be traced back
to you.

## Before you publish this

The following need professional review, because getting them wrong carries real
liability:

1. **Copyright of uploaded material.** The product's core loop transmits
   user-uploaded material — often copyrighted textbooks — to third-party AI
   providers. The terms need to place that responsibility clearly, and a
   takedown process needs to exist before any public sharing.
2. **Voice data.** Some jurisdictions treat voice as biometric data with
   consent requirements that this page does not currently satisfy.
3. **Your legal basis** for processing under GDPR/UK GDPR, and whether you need
   a Data Processing Agreement with each AI provider.
4. **The postal address** in "Who is responsible" is still blank, and is
   legally required — an email address alone does not satisfy it. For a sole
   trader that is normally the business address, which may be a home address
   unless a domicile service is used.
5. **An EU representative under GDPR Article 27.** A controller established
   outside the EEA that offers services to people in the EU generally has to
   designate one in writing, and name them here. There is an exemption for
   occasional low-risk processing, which regular voice and study data probably
   does not fall under. The same question applies separately for the UK.
6. **International transfers** — the AI providers process data in the US.
7. **Minors**, before any school pilot.