Privacy Policy

Duple is an AI companion application that lets you create a personalised AI companion, chat with them in real time, and receive AI-generated images. The Services are operated by Duple ("we", "us", "our", "Duple").

For the purposes of the EU General Data Protection Regulation (GDPR), we act as the data controller of your personal data. Our contact details are listed in Section 14.

We collect the following categories of information:

How We Collect Information

We collect information directly from you when you enter onboarding details, send a message, upload or select media, record audio, choose companion settings, contact support, or otherwise use an app feature. We collect account and purchase information from Apple, Google, and Supabase when you sign in or make a purchase. We automatically create service records such as timestamps, message counts, generated-media records, technical request data, safety events, and companion memories as you use Duple. We collect city-level location only after you grant the device location permission.

Information We Do Not Collect

We do not continuously track your location or sell your personal data. We do not collect financial payment card details — payments are processed by the Apple App Store or Google Play.

We use your information for the following purposes:

Service Delivery

To provide chat, AI image generation, user image attachments, profile photos, voice chat or transcription features, and all core app features. To authenticate you, manage your session, and remember your AI companion's attributes.

Personalisation & Memory

We use your age to personalise the adult age options shown when you create a companion. This lets you choose a relative age dynamic, such as around your age or a little older, without entering an exact companion age. For younger users, we show fixed adult age groups instead. If you are older than 40, the around-your-age option uses the highest supported companion age of 40. Every newly created Duple is a fictional adult aged 21 to 40.

Your chat messages are processed by AI to extract facts, emotional moments, and preferences (stored as companion memories). These are converted into semantic embeddings (numerical vector representations) and stored in our database. When you chat, relevant memories are retrieved and used to make your companion feel contextually aware and consistent over time. You can reset or delete these memories at any time (see Section 7).

AI Image & Content Generation

Your chat messages, companion attributes, and context are sent to our AI image generation system to produce personalised images for your companion. These requests are processed via OpenAI image models, fal.ai, and related AI routing providers on our behalf. Generated images are stored on Bunny CDN under account or avatar-scoped paths and linked to your account.

User Images & Vision Processing

When you choose to send an image in chat, take a photo, select an image from your photo library, or set a profile picture, the image may be uploaded to Bunny CDN and linked to your account. Chat image attachments may be analysed by a vision model to create a compact visual description for your companion and to support moderation. For those attachments, we may store the image URL, thumbnail URL, mime type, dimensions, file size, vision processing status and model, compact chat context, structured visual output, moderation source, and moderation reason. We instruct the model not to identify people or infer sensitive traits from the image.

Safety & Moderation

We use automated content moderation to scan inputs and outputs for policy violations. Safety event logs are used internally to detect abuse patterns and protect the platform. These logs are not disclosed to other users.

Billing & Subscriptions

We process Apple App Store or Google Play purchase and entitlement data to manage your subscription tier, allocate recurring Dokens, verify purchases, and handle renewals, cancellations, billing issues, refunds, or revocations. This may include product IDs, transaction or order identifiers, purchase tokens, app-account token values where Apple provides them, purchase, expiry, renewal, refund, and revocation information, and store notification metadata.

Service Improvement

Aggregated and de-identified usage data (e.g. session counts, error rates) may be used to improve the quality and reliability of our Services. We do not use your personal conversation content to train AI models without your explicit consent.

Legal Compliance

To comply with applicable laws, enforce our Terms, and respond to lawful requests from public authorities.

Duple relies on the following third-party services to operate. Before first-run sign-in and before Duple sends any personal data for an AI feature, the app names the AI recipients, lists the categories of data that may be sent, and requires you to turn on an unticked permission control. If you do not give permission, Duple does not send an AI request and account creation cannot continue because AI processing is essential to the service. The recipients and data categories disclosed in the app are described below.

We share your personal data only in the following circumstances:

Service Providers (Processors)

We share data with the third-party service providers listed in Section 4, who act as data processors under our instructions. They may only use your data to provide, secure, or support the contracted service, not for their own advertising or unrelated purposes. We require them to provide the same or equal protection described in this Privacy Policy.

Legal Requirements

We may disclose your information if required to do so by law, court order, or governmental authority, or when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.

Business Transfers

If Duple is involved in a merger, acquisition, or sale of all or a portion of its assets, your personal data may be transferred as part of that transaction. We will provide notice before your data is transferred and becomes subject to a different privacy policy.

No Sale of Data

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

We retain your data for as long as your account is active or as needed to provide Services:

Active Accounts

Chat messages, companion memories, generated media, uploaded media, and account data are retained while your account is active. You may reset or delete specific data at any time from within the app.

Account Deletion

When you delete your account (via Settings → Delete Account in the app, or by submitting a request to us), deletion of your Duple account and associated active app records begins immediately. This includes the authenticated account and account-linked messages, companions, memories, generated-media records, uploaded-image records, and billing state, subject to information we must retain for legal compliance (for example, tax or store dispute handling). Account deletion removes active app records and media links but does not currently guarantee simultaneous deletion of the underlying files from CDN, backup, or disaster-recovery storage. Those files may persist until separate operational cleanup or overwrite, and we do not use those copies to provide the deleted account. You may contact us to request follow-up on account-linked media deletion.

User Images & Generated Media

Images you upload and media generated for your companions are retained while your account or the relevant companion/chat remains active so the app can display them, reuse them as profile pictures, preserve conversation context, or support outfit and avatar identity features. These media files may be stored under account or avatar-scoped CDN paths. Deleting your account or companion, or clearing a companion's chat where supported, removes the related app records and media links subject to the exceptions above. The underlying media files are not guaranteed to be deleted synchronously and may persist in CDN or backup systems until separate operational cleanup or overwrite as described above.

Safety & Moderation Logs

Safety event logs may be retained after account deletion only for as long as necessary for safety, security, abuse prevention, legal compliance, or dispute handling.

Anonymised Data

Anonymised or aggregated data that cannot identify you may be retained indefinitely for analytics and service improvement.

You have the following rights regarding your personal data. To exercise any of these rights, contact us at keith@duple.chat.

• Access. Request a copy of the personal data we hold about you.
• Rectification. Request correction of inaccurate or incomplete personal data.
• Erasure ("Right to be Forgotten"). Request deletion of your personal data. You can also delete your account directly in the app.
• Data Portability. Request a machine-readable export of your personal data.
• Restriction. Request that we restrict processing of your personal data in certain circumstances.
• Objection. Object to processing based on legitimate interests, including profiling.
• Withdraw Consent. Where processing is based on consent, you may withdraw it at any time by deleting your account in the app or contacting us. Withdrawal does not affect prior lawful processing. Because third-party AI processing is essential to Duple, withdrawal ends future AI processing and may require you to stop using or delete the account.
• Reset Companion Memory. You can reset your AI companion's memory (chat history, facts, episodic memories) directly within the app at any time.
• Lodge a Complaint. EU/UK users have the right to lodge a complaint with their local data protection authority.

Duple is intended solely for users aged 16 years or older. We do not knowingly collect personal information from individuals under 16.

Duple uses date-of-birth validation and an affirmative confirmation during account setup to check the 16+ requirement. We may use additional age-assurance measures where required by law. All AI-generated companions are fictional adults aged 21 to 40. If we become aware that a user under 16 has provided us with personal data, we will take steps to delete such information promptly. If you are a parent or guardian and believe your child has used Duple, please contact us at keith@duple.chat.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction:

• All data in transit is encrypted using TLS/HTTPS.
• Database access is controlled via Row Level Security (RLS) — each user can only access their own data.
• Authentication uses Supabase Auth with JWT tokens and Apple Sign-In.
• Generated and uploaded media are stored under account-linked paths and access is mediated by app account controls and backend ownership checks.
• Service-role database access is strictly restricted to our backend infrastructure.
• We employ automated content safety screening on all chat inputs and outputs.

While we strive to protect your data, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

Your information may be transferred to and processed in countries other than the country in which you reside, including the United States and other countries where our service providers operate (including Supabase, OpenAI, fal.ai, OpenRouter, DeepSeek, Google Gemini, and Perplexity through OpenRouter where configured).

Where required by applicable law, we use an appropriate transfer mechanism for transfers of personal data outside the EEA, United Kingdom, or Switzerland. You may contact us for further information about the safeguards applicable to your data.

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, the following additional provisions apply under the General Data Protection Regulation (GDPR) and equivalent laws.

Legal Bases for Processing

We process your personal data under the following legal bases:

• Contract Performance (Art. 6(1)(b)): Processing necessary to deliver the Services you signed up for — account creation, age eligibility checks, chat, AI processing of messages, images and voice needed for requested features, image generation, account management, and billing.
• Legitimate Interests (Art. 6(1)(f)): Safety screening, fraud prevention, service improvement using aggregated data, and enforcing our Terms.
• Legal Obligation (Art. 6(1)(c)): Retaining transaction data as required by applicable tax or financial regulations.
• Consent (Art. 6(1)(a)): Where you have explicitly given us consent, including permission to share the disclosed personal-data categories with the named third-party AI providers, location permission, camera or microphone access, photo library selection, or optional features that require consent. You may withdraw consent as described in Section 7.

Your GDPR Rights

In addition to the rights listed in Section 7, GDPR provides you the right to not be subject to solely automated decision-making (including profiling) that produces legal or similarly significant effects. Duple's companion relationship progression is automated, but it does not produce legal effects on you.

Supervisory Authority

You have the right to lodge a complaint with your local supervisory authority. A directory of EU data protection authorities is available at edpb.europa.eu. UK users may contact the Information Commissioner's Office (ICO).

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with additional rights:

• Right to Know: You have the right to know what personal information we collect, use, disclose, and sell (we do not sell your data).
• Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions.
• Right to Correct: You have the right to request correction of inaccurate personal information.
• Right to Opt-Out of Sale / Sharing: We do not sell or share your personal information for cross-context behavioural advertising.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise your CCPA rights, contact us at keith@duple.chat. We will respond within 45 days as required by law.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by updating the "Last updated" date at the top of this page and, where required by law or where the changes are significant, by sending an in-app notification or email.

Your continued use of Duple after the effective date of the revised policy constitutes your acceptance of the changes. We encourage you to review this policy periodically.

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or have any other privacy-related concerns, please contact us:

We aim to respond to all privacy requests within 30 days. For EU/EEA users, we will respond within 1 month as required by GDPR (Art. 12(3)).