Privacy

Duo Apps is an independent publication and is the data controller for anything described here. There is no public mailbox; anything to do with this page goes through the form on the contact page, which reaches the team that handles privacy requests and nobody else.

• Server and CDN logs. Our host and content delivery network record the usual request data — IP address, time, the page requested, browser user agent, and referring page. This happens for every website; it is what makes delivery, rate limiting, and abuse protection possible. We use it for security and troubleshooting, not to build a profile of you.
• Reports you send us. The form on the contact page stores your message, the email address you give, the page the report came from, your browser’s user agent, and a one-way hash of your IP address — the hash lets us spot a flood of submissions and cannot be turned back into an address. We use it to deal with the report and to keep a record of corrections and takedowns. It is never used to market anything to you, and it goes no further than the team handling it. Reports are deleted once they have been handled and reviewed, and in any case within 12 months.
• Analytics. None at present. If we add analytics, it will be a privacy-preserving, cookieless product, and this page will be updated before it goes live.

We do not collect special category data, we do not sell or share personal data with data brokers, and we do not run profiling or automated decision-making.

The site sets no cookies and uses no browser storage for tracking. The report form has no captcha service behind it — the check is a sum your own browser sets and marks, so nothing about you is sent to a third party. You will not see a consent banner because there is nothing to consent to. If that ever changes, we will ask first, and refusing will be as easy as agreeing.

• Hosting and delivery. Pages are served from Railway (application hosting) through Bunny.net (content delivery). Both process request data on our behalf as described above.
• Fonts and assets. Fonts are built into the site and served from our own domain. Your browser does not call out to a font or script provider while reading a page.
• Links out. When you follow a link to the App Store, a developer’s site, or any other destination, you are on their property and their privacy policy applies. Where a link is an affiliate link, the affiliate network may record the click in order to attribute it.

Where UK or EU data protection law applies, we rely on legitimate interests — running a website securely and answering correspondence. Logs are kept only as long as our providers’ standard retention allows; email is kept while it is useful and then deleted.

You can ask us for a copy of what we hold about you, ask us to correct or delete it, or object to our processing it. Send the request through the contact page and we will respond within one month. If you are unhappy with the response, you can complain to your national data protection regulator — in the UK, the Information Commissioner’s Office at ico.org.uk.

The site is intended for a general audience and is not directed at children under 13. We do not knowingly collect personal data from them.

If this policy changes, the date at the top of the page changes with it. Any change that affects what we collect will be made before the collection starts, not after.