This Privacy Policy explains how Duodisly is operated by Individual Entrepreneur “Krail”, registered in the Republic of Kazakhstan (“Duodisly”, “we”, “us”, or “our”), and how we collect, use, disclose, retain, and protect information when you use the Duodisly website, web application, and related mobile applications and services (collectively, the “Service”).
1. Who controls your information
The controller and operator of the Service is:
Individual Entrepreneur “Krail”
2A Algabasskaya Street, Almaty, Republic of Kazakhstan
Privacy requests: privacy@duodisly.com
General support: support@duodisly.com
2. Product and account model
Duodisly is a shared accountability and task-management service for adults, couples, and families. Ordinary adult accounts are available only to people aged 18 or older.
An adult family administrator may create a parent-managed child profile. A child profile is not an independent adult account. It has no email, social sign-in, phone number, date of birth, school, address, or precise geolocation field. A child accesses the family space only through credentials created and managed by an adult administrator.
3. Information we collect
Depending on the features you use, we may process the following categories.
3.1 Adult account and authentication information
- name or display name;
- email address;
- optional adult profile image;
- user and account identifiers;
- authentication provider and related authentication metadata;
- language, time zone, notification, and account preferences;
- age, Terms, and Privacy acceptance timestamps and document versions.
Authentication may be provided through email/password, Google Sign-In, Apple Sign-In when available, or other methods shown in the Service.
3.2 Parent-managed child profile information
- name or nickname chosen by the family administrator or child;
- generated child login name;
- securely hashed password and credential status;
- built-in avatar, icon, emoji, or color;
- family group membership;
- parental authorization timestamp, authorizing adult identifier, and consent notice version;
- task, progress, reward, chat, notification, report, and evidence activity described below.
We ask families not to use a child’s full legal name or add unnecessary identifying details.
3.3 Group and user-generated content
- couple or family group name, type, membership, roles, invitations, and settings;
- tasks, task proposals, deadlines, status, completion, approval, rejection, and progress;
- rewards, points, streaks, and related activity;
- task chat messages, comments, notes, and reactions;
- task evidence, including photos uploaded to show that a task was completed;
- reports, report reasons, optional report details, blocks, group-leaving, and other safety actions.
Content is intended to be visible only to authorized members of the relevant private group, except that reports are private safety records available only to authorized Duodisly personnel or systems.
Task evidence may accidentally reveal people, rooms, documents, screens, addresses, or other personal information. Users should upload only what is necessary and should avoid including third parties, identification documents, financial information, health information, intimate content, or precise location details.
3.4 Subscription and transaction information
Android subscriptions use Google Play Billing and RevenueCat. RevenueCat processes the adult App User ID, product/entitlement IDs, purchase/subscription status, transaction references and technical app/device information. Its SDK may create an anonymous app ID after billing logout. RevenueCat maintains country from purchase information or the last-seen IP-derived country; it does not retain that IP as a customer attribute. This processing is separate from optional analytics consent. Children cannot purchase or initialize RevenueCat with a child identity.
- plan and entitlement;
- subscription owner and group identifier;
- trial, active, canceled, expired, refunded, or chargeback status;
- purchase platform and transaction reference;
- subscription period and renewal dates;
- limited billing, tax, fraud, and support information supplied by the purchase platform.
We do not receive full payment-card details from app stores or authorized payment providers.
3.5 Device, usage, analytics, and diagnostic information
- device, browser, operating system, app version, locale, and approximate time zone;
- IP address and request metadata processed in hosting, security, and server logs;
- pages or screens viewed and safe product events;
- performance, crash, error, stack, and diagnostic information;
- push notification subscription tokens and delivery status.
In Android, optional Firebase Analytics and Crashlytics reporting starts only after a signed-in adult allows analytics and diagnostics. It remains disabled for child profiles and unknown users. Adults can withdraw this choice in privacy settings. Analytics processes selected usage events, device/app information, an app-instance ID and approximate country or region. Crashlytics processes crash/error reports, technical device information and installation IDs; reports are retained for 90 days before removal begins. We do not set an account name or account ID as the native analytics/crash user identifier. Task/chat text, credentials and evidence links are filtered out. Advertising IDs and personalized advertising are not enabled. Microsoft Clarity runs only in supported web sessions with the applicable analytics choice, never in the native Android app.
Essential operations continue when optional analytics is off: authentication, security and service logs process account IDs, IP addresses and request metadata. Separately enabled Firebase Cloud Messaging notifications use installation IDs and registration tokens. Child notifications concern family-service events, not marketing. Photos, comments and private family relationships are processed to provide the requested task and reward features.
3.6 Support and communications
When you contact us, we may process your email address, message, attachments, request history, and information needed to answer or investigate the request.
4. How and why we use information
We use information to:
- create and secure adult accounts and parent-managed child profiles;
- authenticate users and maintain sessions;
- provide groups, tasks, proposals, confirmations, chat, progress, rewards, notifications, and evidence features;
- display private group content to authorized group members;
- provide subscription access and customer support;
- detect, investigate, and respond to misuse, security incidents, child-safety concerns, illegal content, and technical failures;
- improve reliability, accessibility, localization, and product performance;
- communicate service, security, legal, and account notices;
- comply with law, enforce our Terms, and establish, exercise, or defend legal claims.
Where applicable, our legal bases may include performance of a contract, steps requested before entering a contract, consent, authorization by a parent or legal guardian, compliance with legal obligations, and our legitimate interests in operating, securing, and improving the Service. Where processing is based on consent, consent may be withdrawn, subject to lawful retention and processing already completed.
5. How we disclose information
We do not sell personal information and do not use child-profile information for targeted advertising.
We may disclose information:
- to authorized members of the same private couple or family group as required by the selected features;
- to hosting, database, storage, authentication, analytics, logging, email, notification, customer-support, subscription-management, fraud-prevention, and payment service providers acting for us;
- to Google/Firebase services and selected sign-in providers when those services are used;
- to app stores and authorized purchase platforms when a subscription is purchased or managed;
- to professional advisers, auditors, insurers, or contractors subject to appropriate confidentiality duties;
- to authorities, courts, or other parties where required by law or reasonably necessary to protect rights, safety, children, users, the public, or the Service;
- in connection with a lawful restructuring, financing, sale, or transfer of the business, subject to appropriate notice and safeguards.
Reports are not shown to ordinary group members, family administrators, or the reported person merely because they belong to the group.
Providers include Google Cloud hosting, databases and private storage; Firebase Authentication, Cloud Messaging and optional Crashlytics; optional Google Analytics; and RevenueCat subscription administration. RevenueCat webhooks also reach Duodisly-controlled production and preview endpoints. Google Play maintains its own purchase records. Service-provider transfers and expected sharing with invited family/partners are described here even when the Play Data safety form excludes them from third-party sharing.
6. Children and parent-managed profiles
Children cannot create independent Duodisly accounts. Only an authenticated adult family administrator may create a child profile and child credentials. The adult represents that they are the child’s parent or legal guardian, or otherwise have legal authority to create and manage the profile, and authorizes the processing necessary for family tasks, rewards, progress, chat, evidence, notifications, and safety.
Where applicable law requires additional parental verification, age assurance, or consent formalities, we may request additional steps, restrict the feature, or decline to create or continue the child profile until those requirements are met.
A parent or legal guardian may review, correct, reset access to, or delete a child profile through family settings or by contacting privacy@duodisly.com. A child may ask the adult who manages the family group for help or may report a safety concern inside the Service.
More details are provided in our Children & Family Privacy Notice.
7. Cookies and local storage
We use necessary cookies, local storage, and similar technologies for authentication, security, language, preferences, and core operation. Optional public-site analytics is controlled through our consent interface. See the Cookie and Local Storage Policy.
Optional website analytics and Android analytics/diagnostics are controlled in the relevant privacy-choice interface. Child and unknown Android sessions have optional telemetry disabled. Disabling analytics does not disable authentication, subscription verification, security logs or separately enabled service notifications.
8. International processing
We operate from Kazakhstan and use service providers that may process information in Kazakhstan, the European Economic Area, the United States, and other countries. Laws in those countries may differ from those where you live. Where required, we use consent, contractual commitments, provider safeguards, or other lawful mechanisms for international transfers.
9. Retention
We use the following general retention periods, unless a longer or shorter period is required by law, an active dispute, safety investigation, fraud prevention, or technical necessity:
- active account, group, and user content: while the account or group remains active, until deleted, or as needed to provide the Service;
- Ordinary cloud request/operational logs: 30 days. Other technical/diagnostic records: up to 90 days unless a specific security incident or legal duty justifies longer. Mandatory Google Cloud audit logs: 400 days.
- reports and safety records: up to 24 months, and longer only for an active safety matter, dispute, investigation, or legal obligation;
- support, privacy, and safety communications: up to 24 months;
- Deleted storage objects have 7 days of soft-delete protection. Cloud SQL keeps 14 automated backups (a count, not a guaranteed 14-day expiry) and 7 days of point-in-time recovery logs. Completed deletion requests must be reapplied before restored data returns to service. These restricted recovery/security copies are not active profiles or marketing data.
- minimal deletion audit records: up to 24 months, and longer where needed for a dispute, investigation, or law;
- subscription, tax, fraud, refund, and transaction records: for the period required by the purchase platform, accounting rules, tax law, fraud prevention, or other applicable law.
Optional Google Analytics: event data 2 months, user data 14 months, renewed by new activity. Aggregated reports may remain longer without identifying individuals. Crashlytics: 90 days before its removal process begins. RevenueCat customer data is kept for subscription administration until erasure is requested or an applicable billing, fraud, accounting or legal duty justifies continued retention. We handle necessary provider erasure instructions and document justified exceptions. Provider-controlled deletion and backup cycles can finish later than active-system removal. Safety/support/deletion records have the stated limited retention and a monthly expiry review.
We may retain de-identified or aggregated information that no longer identifies a person.
10. Account and child-profile deletion
An adult may initiate account deletion in the Service through Profile → Account → Delete Account. A request may also be sent to support@duodisly.com.
An adult family administrator may delete a child profile in family settings. A child profile cannot delete the adult account or family group by itself.
Deletion removes active profile details, credentials/authentication access, sessions, push registrations, owned avatar and proof images, message/result text and identifying copies. Shared task/reward history needed by remaining members may retain pseudonymous references with identifying profile details removed; it is not necessarily anonymous. Only limited records for documented security, safety, disputes, billing or legal purposes remain for the stated periods. Storage/Auth cleanup is asynchronous; failures are retried and reviewed. Necessary requests to subscription and other providers are handled separately; logout or consent reset is not remote erasure. Deletion does not cancel an app-store subscription: use Google Play or the original purchase platform.
11. Security
We use reasonable administrative, technical, and organizational safeguards, including access controls, role restrictions, credential hashing, transport security, input and file restrictions, logging redaction, and group-based access rules. No system can guarantee absolute security. Please report suspected security or privacy issues to privacy@duodisly.com or safety@duodisly.com.
12. Your rights and choices
Depending on applicable law, you may have rights to request access, correction, deletion, restriction, objection, portability, withdrawal of consent, or information about processing. You may also complain to a competent data-protection or consumer authority.
To make a request, email privacy@duodisly.com. We may need to verify your identity and authority. A parent or legal guardian making a request for a child profile may also need to verify their relationship or authority.
You can also:
- edit profile information in the Service;
- manage group membership and content according to your role;
- change notification preferences;
- reject optional analytics cookies;
- delete content where the interface allows;
- delete an adult account or parent-managed child profile as described above.
13. Automated decision-making
Duodisly does not use personal information to make solely automated decisions that produce legal or similarly significant effects. Automated security, rate-limit, spam, and fraud signals may restrict an action temporarily and may be reviewed.
14. Changes to this Policy
We may update this Policy as the Service, providers, laws, or practices change. We will update the date above and provide additional notice where required. Material changes may require adult users to accept a new version.
15. Contact
Privacy: privacy@duodisly.com
Support: support@duodisly.com
Safety: safety@duodisly.com
Individual Entrepreneur “Krail”
2A Algabasskaya Street, Almaty, Republic of Kazakhstan
