Privacy Policy

SENTHILKUMAR BALAGANESH, Block B 106, SIS Safaa, Survey No. 41/2A, GST Road, Opp. Akshaya Apartments, Kanchipuram, Tamil Nadu 631604, Indi (“Duoraa”, “we”) is responsible for your personal data (the “data fiduciary” / “controller”). Privacy questions or requests: balaganeshsenthil5@gmail.com.

• Account: your name, @handle, email, password (stored only as a one-way hash), profile picture if you add one, and whether you signed in with Google (we receive your Google name, email and picture — never your Google password).
• Friends and rooms: who you're friends with, the rooms you create or join, what's playing (film, YouTube link or streaming title), the playback position and play/pause/seek events, so both screens stay in sync and you can continue later.
• Chat: messages are end-to-end encrypted on your device. We store only encrypted text we can't read, plus reactions, typing and “seen” signals needed for the chat to work.
• Calls: audio and video go directly between you and your partner, encrypted. If a direct connection isn't possible, they pass through our relay (TURN) server still encrypted — we can't see or hear them, and we don't record calls.
• Uploads: films and subtitles you upload, encrypted with a key unique to each film. Our systems decrypt a film only to convert it for streaming and to stream it to you and your room partner.
• Payments: your plan, payment status, renewal dates, the payment provider's customer and subscription IDs, the price region and your billing country. Card and UPI details go straight to Razorpay or Stripe — we never receive them.
• Technical and security data: IP address, browser and device type, sign-in sessions, when you were last active, and a security log of important account events (sign-ins, password changes, payments) to protect your account and prevent abuse. Error reports, if enabled, are scrubbed of cookies, message text and request bodies.
• Support: what you write to us and your email address.

• To provide Duoraa — accounts, friends, rooms, sync, calls, chat, uploads and your plan (necessary to perform our contract with you).
• To keep Duoraa secure and prevent fraud and abuse, and to fix problems (our legitimate interest).
• To send essential emails — verifying your email, password resets, receipts and important changes. We don't send marketing emails unless you opt in.
• To meet legal obligations (for example, tax records for payments).

• We don't sell or rent your personal data.
• We don't show ads or use your films, chats or calls for advertising or AI training.
• We can't read your chat messages and we don't record calls.

We share data only with service providers who process it for us under contract, and only what they need:

• Hosting, database and storage providers (our servers and an encrypted film store / content delivery network).
• Razorpay and Stripe — payments.
• Our email delivery provider — account and receipt emails.
• Google — only if you choose “Sign in with Google”.
• Error monitoring — technical error reports, scrubbed of personal content.

When you watch YouTube or use a streaming service through Companion, those services receive data under their own privacy policies — you're using their player with your own account. We may also disclose data if the law requires it or to protect people's safety.

Some providers may process data outside India. When they do, we use providers with appropriate safeguards and as permitted by law.

We use only cookies needed for Duoraa to work — no advertising or tracking cookies:

• duora_at / duora_rt — keep you signed in (secure, not readable by scripts).
• duora_csrf — protects your account from forged requests.
• duora_country — shows prices for your region.
• Your browser also stores your theme choice and, on each device, the private key that decrypts your chats (it never leaves that device).

• Account, friends, rooms and chat: while your account exists.
• Uploaded films: until you delete them or your account.
• Security logs: up to 365 days.
• Payment records: as long as tax and accounting law requires.
• When you delete your account, we delete your data and films right away; backups roll off within 30 days.

You can, at any time:

• See and download your data — Settings → Export my data.
• Correct your name, handle and picture in Settings.
• Delete your account and everything in it — Settings → Delete account.
• Withdraw consent, object, or ask us anything about your data — write to balaganeshsenthil5@gmail.com. We reply within 30 days.

Depending on where you live (for example under India's Digital Personal Data Protection Act 2023 or the EU/UK GDPR) you may also complain to your data protection authority — we'd appreciate the chance to help first.

We use encryption in transit (HTTPS) and at rest, end-to-end encryption for chat, short-lived sign-in tokens, rate limits and audit logging. No system is perfectly secure; if a breach affects you, we'll tell you and the authorities as the law requires.

Duoraa is for people aged 18 and over. We don't knowingly collect data from children; if you think a child has an account, tell us and we'll remove it.

Grievance Officer: SENTHILKUMAR BALAGANESH, balaganeshsenthil5@gmail.com — balaganeshsenthil5@gmail.com, Block B 106, SIS Safaa, Survey No. 41/2A, GST Road, Opp. Akshaya Apartments, Kanchipuram, Tamil Nadu 631604, Indi. We acknowledge complaints within 24 hours and resolve them within 15 days.

If we change this policy in an important way we'll email you or show a notice before it applies.