Last updated: 15 September 2026
Duru is run by Silvan Jost, an individual rather than a company, acting as the data controller.
Contact: [email protected]
Being one person rather than a company changes nothing about the obligations below. It does mean there is no support department: the address above reaches the person who wrote the software.
Duru turns material you upload into an ordered course, generates practice from it, and lets you talk to an AI tutor. Doing that means storing what you upload and sending some of it to AI providers. This page says exactly what is stored, what leaves our servers, and for how long.
Because you created an account
Because you uploaded material
Because you practised
Because you talked to the tutor
Because you paid for a plan
Because you wrote to us
Both are kept as correspondence until dealt with, and are not part of what account deletion removes. Write to us if you want a message deleted.
Because you tried the voice demo on the landing page
No account is involved. Your audio goes to Google for the duration of the demo, as above. Your IP address is held in the server's memory for 24 hours to limit how many demos one visitor can start; it is not written to the database.
This is the part worth reading closely.
| Provider | What it receives | Why |
|---|---|---|
| OpenRouter (routes to OpenAI, Anthropic, Google and Mistral) | Uploaded PDFs and images, pasted text, your practice answers, and your tutor transcripts where available | Extracting vocabulary and grammar, reading scanned pages, generating practice, grading answers, reviewing conversations |
| Google (Gemini) | Your live microphone audio, and the tutor instructions built from your course | Real-time voice conversation |
Two consequences you should understand:
These providers have their own retention and training policies. We do not control them. Review OpenRouter's and Google's terms if this matters to you. Both process data in the United States.
None of these receive your study material.
The newsletter is optional, off unless you switch it on, and never a condition of using Duru. We only send it to an address that has been confirmed, which means the link in the account-creation email has been clicked.
It goes out at most once a month. Every message carries a link that removes you from the list without signing in, and the same switch sits in your account settings. Unsubscribing changes nothing else about your account.
We do not sell, rent or share the list, we do not track whether you opened a message or clicked a link in it, and we do not use it to build a profile of you. If you want the list itself deleted rather than just your place on it, deleting your account does that.
Data is kept until you delete it or close your account, with these exceptions:
| What | How long |
|---|---|
| Usage analytics events | 180 days |
| Allowance counts (imports, voice minutes) | 32 days |
| Cached model answers | 120 days after last use |
| Newsletter consent record | Until you unsubscribe or close your account |
| Recovery copies of deleted rows | 30 days |
| Database backups | Hourly, kept 14 days |
| Server access logs (IP address, URL, time) | Rotated by size; typically a few weeks |
Deleting a lesson deletes its material, extractions, generated practice and associated review history. Deleting a course deletes everything in it. Uploaded files are deleted with the lesson that owns them.
When a course is deleted, a copy of the deleted rows is kept for 30 days so an accidental deletion can be undone by writing to us. Deleted data can also remain in backups for up to 14 days. After those periods it is gone.
Account → Delete account removes, immediately: your account, every course you own and all of its material, your practice history and review schedules, your tutor memory and session log, your memberships in shared courses, your place on the newsletter list and the consent record behind it, and any reviews you left. Your account id is removed from analytics events.
It does not remove: contact or feedback messages you sent us; Stripe's own records of past payments, which Stripe must keep for tax purposes; backups and recovery copies within the periods above; and cached model answers, which are not linked to any account.
If you have a paid plan, cancel it before deleting your account. Deleting the account does not itself cancel the subscription at Stripe. Use Account → Manage subscription, or write to us and we will cancel it.
Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to processing, and to complain to a data protection authority. Write to [email protected] and we will act on it.
You can already do all of this yourself, without contacting anyone, from Account → https://getduru.com/app/account and from the course itself:
Nothing there requires a request, and none of it except the last removes your account.
For readers in the EU, UK and Switzerland: we process your account, material and learning data because that is the service you asked for (performance of a contract). We process usage analytics, allowance counts, rate-limiting data and access logs on the basis of our legitimate interest in running, improving and protecting the service. Your microphone is used only when you start a conversation, which is your consent, and stops when you end it. The newsletter is sent on the basis of your consent, which you can withdraw at any time from any message or from your account settings; withdrawing it does not affect anything we did before you withdrew it.
The AI providers and Stripe process data in the United States. We rely on their standard contractual clauses for that transfer.
Passwords are hashed with scrypt and a per-user salt. Sessions use signed tokens. The API keys for AI providers are held server-side and never reach your browser or phone — even the live voice connection is brokered so the client only receives a session, never the key.
IP addresses are used, in memory, to limit repeated sign-in attempts, contact form submissions and voice demos, and appear in the server's access logs.
Duru is not designed for children and is not directed at anyone under 16. No age verification exists today. If school or minor use is ever offered, this policy needs rewriting first, and a data-protection review before any pilot.
We record how the apps are used, in our own database, so we can tell which parts help and which are ignored.
What is recorded: an event name from a fixed list in the source (analyticsEvents in packages/shared/src/index.ts), a handful of small properties chosen at each call site -- a count, a grade, which of three onboarding choices was taken -- the platform (web or mobile), a random identifier stored on your own device, and your account id when you are signed in.
What is not: your IP address, your device or browser, the page you came from, and nothing you have typed, said or uploaded. No third party receives any of it; there is no analytics service, no advertising network and no cross-site identifier.
How long: events are deleted after 180 days. Deleting your account removes your account id from them; the anonymous rows that remain cannot be traced back to you.
When this page changes in a way that matters, we will say so in the app before it takes effect. The date at the top is the date of the last change.