Privacy Policy
Last updated: 27 October 2026
Who is responsible
Duru is run by Silvan Jost, an individual rather than a company, acting as the data controller.
Contact: [email protected]
Being one person rather than a company changes nothing about the obligations below. It does mean there is no support department: the address above reaches the person who wrote the software.
What this covers
Duru turns material you upload into an ordered course, generates practice from it, and lets you talk to an AI tutor. Doing that means storing what you upload and sending some of it to AI providers. This page says exactly what is stored, what leaves our servers, and for how long.
What we collect
Because you created an account
- Email address and display name, and whether the address has been confirmed by clicking the link we send when an account is created.
- Password, stored only as a salted scrypt hash. We cannot read your password.
- If you sign in with Google, Apple or Microsoft: the provider's user identifier, your email, name and avatar URL. Which of these sign-in options is offered can vary; today it is Google.
- Topics you pick as interests, and your chosen tutor voice.
- Your plan, and when it renews.
- Whether you asked for the newsletter, the date and time you asked, and where you asked from (the sign-up flow, or your account settings). We keep that record for as long as you are subscribed, and it is what we would show if anyone ever asked us to prove you agreed.
Because you uploaded material
- The files themselves — PDFs and images are stored in full, as uploaded, for as long as a lesson refers to them.
- Text you paste in.
- Everything extracted from them: vocabulary, grammar points, example sentences, lesson titles and descriptions.
- Every extraction run is kept, including the raw model output, so extraction quality can be audited and your edits are never silently overwritten.
- For a long document that is split into several lessons: the import plan (the file name, which pages became which lesson, and whether each part succeeded), so a stopped import can be resumed without paying for the same pages twice.
- A cache of model answers, keyed by a hash of the request rather than by your account, so an identical request is not sent to a provider twice. Entries are removed 120 days after they were last used.
Because you practised
- Every graded answer: the question, the expected answer, what you actually answered, and whether it was correct.
- Your spaced repetition schedule for each card.
- Which practice items you have already been shown.
- Test and placement results, and which lessons you have completed.
Because you talked to the tutor
- Your voice audio is streamed live to Google during the conversation. We do not record or store the audio, and neither our server nor the app keeps a recording.
- The tutor is given your study record for the course — the vocabulary and grammar in it, what you have practised, what you got wrong — and nothing about who you are: no name, no email, no account details.
- Corrections the tutor makes during the call are recorded as mistakes, the same way a wrong written answer is.
- Where the voice provider returns a transcript of what you said, your side of the conversation is sent to OpenRouter once, after the session, so remaining mistakes can be recorded. The transcript itself is not kept.
- For each session: when it happened, which lesson, how many turns, a short written summary, and the topics covered, so the tutor can pick up where you left off.
- If you ask the tutor to save a word or a pattern, it is written into your course like any other item, marked as coming from the tutor, and you can edit or delete it.
Because you paid for a plan
- Payments are handled by Stripe. We send Stripe your email address, display name and account id so the subscription can be matched to your account. Your card details go to Stripe directly and never reach us.
- We keep Stripe's identifiers for your customer record and subscription, your plan, its renewal date, and whether it is set to cancel.
- How much of your allowance you have used — documents imported, minutes spoken — as a count per day. These counts are deleted after 32 days.
Because you wrote to us
- The contact form stores your name, email address, role, organisation and message.
- In-app feedback stores your name, email, plan, platform, the screen you were on, the app version and your message.
Both are kept as correspondence until dealt with, and are not part of what account deletion removes. Write to us if you want a message deleted.
Because you tried the voice demo on the landing page
No account is involved. Your audio goes to Google for the duration of the demo, as above. Your IP address is held in the server's memory for 24 hours to limit how many demos one visitor can start; it is not written to the database.
What we send to AI providers
This is the part worth reading closely.
| Provider | What it receives | Why |
|---|---|---|
| OpenRouter (routes to OpenAI, Anthropic, Google and Mistral) | Uploaded PDFs and images, pasted text, your practice answers, and your tutor transcripts where available | Extracting vocabulary and grammar, reading scanned pages, generating practice, grading answers, reviewing conversations |
| Google (Gemini) | Your live microphone audio, and the tutor instructions built from your course | Real-time voice conversation |
Two consequences you should understand:
- Material you upload leaves our servers. If you upload a copyrighted textbook, a copy of it is transmitted to a third-party AI provider for processing. Only upload material you have the right to use this way.
- Your voice is processed by Google in real time. We do not store the audio, but Google receives it. Their handling is governed by their own policies, not this one.
These providers have their own retention and training policies. We do not control them. Review OpenRouter's and Google's terms if this matters to you. Both process data in the United States.
Other services that see some of your data
None of these receive your study material.
- Stripe (payments): email, name, account id, and the payment details you enter on Stripe's own pages. United States, with its own privacy policy.
- Resend (email): your email address and the content of the emails we send you — password resets and account messages. United States.
- Hetzner (hosting): the server and database live in a Hetzner data centre in Germany.
- Cloudflare (DNS and network proxy): every request to getduru.com passes through Cloudflare, which sees your IP address and the request as any network operator would.
- Google Fonts (web app only): your browser loads fonts from Google's servers, which see your IP address in the process.
- Expo (mobile app only): the app checks Expo's update servers for a newer version of itself, sending the platform and app version. No account information is included.
What we do not do
- We do not sell your data.
- We do not show advertising.
- We do not use a third-party analytics service. What usage we record stays in our own database (see Usage analytics below).
- We do not use your material to train our own models.
- We do not share your data with anyone other than the providers and services listed on this page.
Who can see your material
- Your own courses are private. There is currently no way to publish a course to other learners; the public catalogue in the app is empty by design, and this page will change before that changes.
- Sharing a course with someone else is switched off. It will come back with a way to report material that should not have been shared. While it is off, no link you hold lets anyone else take a copy.
- Course owners see membership and sync activity — name, email, when you joined and how often you synced. They do not see your answers, your mistakes, your review schedule or your tutor conversations.
- Sample courses are built from openly licensed sentences (see the terms) and contain nothing of yours.
- The operator can read the database. Course material and learning data are stored unencrypted at rest, so do not upload anything you would not want the person running this service to be able to read. There is an admin view of accounts that shows who signed up, on what plan, and when they were last active; it shows nothing about what anyone studied. We look at a particular course, its practice and your answers only to find and fix problems — for example when an import or an exercise has gone wrong — and not otherwise.
The newsletter
The newsletter is optional, off unless you switch it on, and never a condition of using Duru. We only send it to an address that has been confirmed, which means the link in the account-creation email has been clicked.
It goes out at most once a month. Every message carries a link that removes you from the list without signing in, and the same switch sits in your account settings. Unsubscribing changes nothing else about your account.
We do not sell, rent or share the list, we do not track whether you opened a message or clicked a link in it, and we do not use it to build a profile of you. If you want the list itself deleted rather than just your place on it, deleting your account does that.
Retention
Data is kept until you delete it or close your account, with these exceptions:
| What | How long |
|---|---|
| Usage analytics events | 180 days |
| Allowance counts (imports, voice minutes) | 32 days |
| Cached model answers | 120 days after last use |
| Newsletter consent record | Until you unsubscribe or close your account |
| Recovery copies of deleted rows | 30 days |
| Database backups | Hourly, kept 14 days |
| Server access logs (IP address, URL, time) | Rotated by size; typically a few weeks |
Deleting a lesson deletes its material, extractions, generated practice and associated review history. Deleting a course deletes everything in it. Uploaded files are deleted with the lesson that owns them.
When a course is deleted, a copy of the deleted rows is kept for 30 days so an accidental deletion can be undone by writing to us. Deleted data can also remain in backups for up to 14 days. After those periods it is gone.
Deleting your account
Account → Delete account removes, immediately: your account, every course you own and all of its material, your practice history and review schedules, your tutor memory and session log, your memberships in shared courses, your place on the newsletter list and the consent record behind it, and any reviews you left. Your account id is removed from analytics events.
It does not remove: contact or feedback messages you sent us; Stripe's own records of past payments, which Stripe must keep for tax purposes; backups and recovery copies within the periods above; and cached model answers, which are not linked to any account.
If you have a paid plan, cancel it before deleting your account. Deleting the account does not itself cancel the subscription at Stripe. Use Account → Manage subscription, or write to us and we will cancel it.
Your rights
Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to processing, and to complain to a data protection authority. Write to [email protected] and we will act on it.
You can already do all of this yourself, without contacting anyone, from Account → https://getduru.com/app/account and from the course itself:
- Download everything we hold about you as a single file.
- Delete a single word or grammar pattern, or edit either.
- Delete a lesson, which takes its material, its generated practice and its review history with it.
- Delete a course, which takes everything in it.
- Delete your account, which takes everything you own.
- Change or clear your interests, and cancel a subscription.
Nothing there requires a request, and none of it except the last removes your account.
Why we are allowed to process this
For readers in the EU, UK and Switzerland: we process your account, material and learning data because that is the service you asked for (performance of a contract). We process usage analytics, allowance counts, rate-limiting data and access logs on the basis of our legitimate interest in running, improving and protecting the service. Your microphone is used only when you start a conversation, which is your consent, and stops when you end it. The newsletter is sent on the basis of your consent, which you can withdraw at any time from any message or from your account settings; withdrawing it does not affect anything we did before you withdrew it.
The AI providers and Stripe process data in the United States. We rely on their standard contractual clauses for that transfer.
Security
Passwords are hashed with scrypt and a per-user salt. Sessions use signed tokens. The API keys for AI providers are held server-side and never reach your browser or phone — even the live voice connection is brokered so the client only receives a session, never the key.
IP addresses are used, in memory, to limit repeated sign-in attempts, contact form submissions and voice demos, and appear in the server's access logs.
Children
Duru is not designed for children and is not directed at anyone under 16. No age verification exists today. If school or minor use is ever offered, this policy needs rewriting first, and a data-protection review before any pilot.
Usage analytics
We record how the apps are used, in our own database, so we can tell which parts help and which are ignored.
What is recorded: an event name from a fixed list in the source (analyticsEvents in packages/shared/src/index.ts), a handful of small properties chosen at each call site -- a count, a grade, which of three onboarding choices was taken -- the platform (web or mobile), a random identifier stored on your own device, and your account id when you are signed in.
What is not: your IP address, your device or browser, the page you came from, and nothing you have typed, said or uploaded. No third party receives any of it; there is no analytics service, no advertising network and no cross-site identifier.
How long: events are deleted after 180 days. Deleting your account removes your account id from them; the anonymous rows that remain cannot be traced back to you.
Changes
When this page changes in a way that matters, we will say so in the app before it takes effect. The date at the top is the date of the last change.