This policy applies to the Duet website, dashboard, API and iPhone Shortcut (together, “Duet”). Duet is operated by its owner (“we”, “us”). Questions go to maazz.dev@gmail.com.
What we collect
- Account details: your email address and name. If you sign in with Google, also your profile picture. If you use a password, we store only a salted scrypt hash of it, never the password itself.
- What you save: each link, plus anything you or the Shortcut send with it: shared text, the “From” name you type, notes, tags, priority and reminder times.
- Details about each link: the page title, description, preview image, creator and an AI-written summary, gathered from the public page.
- Access tokens: tokens for the Shortcut and API, stored as SHA-256 hashes, with when they were created and last used.
- Subscription: your plan, its status and renewal date, and the customer and subscription IDs from our payment provider.
- Preferences: timezone, reminder and digest settings, and your theme choice (stored in your browser only).
- Technical data: our hosting provider records standard request logs such as IP address, browser type and time of request, for security and debugging.
We don't use advertising, sell personal data, or track you across other websites.
How we use it
- To run your account and show your saves only to you.
- To read, label and summarise the links you save.
- To send the reminders and digests you turn on.
- To keep Duet secure: preventing abuse, rate-limiting and investigating problems.
- To answer you when you contact us.
AI processing
To write summaries, Duet sends the link, its public page details (title, description, page text or README), any text you shared with it and the “From” name to Google's Gemini API. We send only what's needed for that one link, not your whole library. Summaries can be wrong; you can edit or refresh them at any time.
Service providers
We share data only with providers that run parts of Duet for us:
| Provider | Purpose |
|---|---|
| Vercel | Hosting the website and API (functions in Singapore) |
| Supabase | Database storing your account and saves (Singapore) |
| Gemini API for summaries; Google sign-in if you choose it; site icons shown next to links | |
| Resend | Sending reminder and digest emails, if you turn email on |
| Lemon Squeezy | Processing subscriptions and payments (we never see or store your card details) |
To fetch details, Duet requests the public page you saved (and services such as GitHub or YouTube for public metadata). Those sites see a request from our servers, not from you. We may also disclose information if the law requires it.
Retention
We keep your saves until you delete them or your account. Deleted items are removed from the live database right away; backups held by our database provider roll off within their normal backup window. Request logs are kept by our hosting provider for a limited period.
Your rights
You can view, edit and delete your saves in the dashboard at any time. You can also ask us to export everything we hold about you, correct it, or delete your account entirely. Email maazz.dev@gmail.com from your account email and we'll respond within 30 days. Depending on where you live, you may also have the right to complain to a data protection authority.
Security
Connections are encrypted with HTTPS, passwords and tokens are stored only as hashes, and every database query is scoped to your account. See our Security page for details. No system is perfectly secure, but we work to protect your data and will tell you promptly if a breach affects you.
Children
Duet isn't meant for children under 13, and we don't knowingly collect their data. If you believe a child has created an account, contact us and we'll remove it.
Changes
If we change this policy in a meaningful way, we'll update the date above and let account holders know before the change takes effect.
Contact
Email maazz.dev@gmail.com.