Privacy Policy

Last updated: August 2026

1. Introduction and Data Controller

Welcome to DUGRIZZ ("the App", "the Service", "we", "us"). We are committed to protecting your privacy in accordance with the Israeli Privacy Protection Law, 5741-1981, including Amendment 13 (effective August 2025), and the EU General Data Protection Regulation (GDPR) where applicable.

DUGRIZZ is an AI dating coach that analyzes conversation screenshots and provides feedback, scores, and suggested responses. The service operates on a pseudonymous device identifier — no user account, email, or password is required.

2. Information We Collect

Below is a complete description of all data types we collect, the purpose of collection, and the legal basis for each:

2.1 Device Identifier

We generate a unique pseudonymous identifier (UUID) for your device. If you never sign in we do not know who you are, but this ID is still personal data because the data linked to it relates to you. It is not, by itself, linked to your name, email, or any other personally identifiable information. It is used solely to save your progress within the app.

2.2 Screenshots and Conversation Text

When you upload a screenshot for analysis, the image is sent to our AI provider, Google Gemini, for processing and analysis. We do not store your conversation images. Google does not use API data to train its models, but retains it for up to 7 days for abuse monitoring before deleting it, and may process it in any country where it maintains facilities. Note: the AI's output — a text transcript of the conversation — IS stored in your history until you delete it.

Recommendation: We encourage you to blur or redact names and faces of third parties before uploading screenshots, to protect their privacy. If you appear in a conversation uploaded by someone else — see our page for non-users.

2.3 Analysis Results

Analysis results (scores, feedback, suggested responses, assessments) are stored in our database and linked to your device ID so you can access your history.

2.4 Contact Names and Platforms

When you save a contact in the app, we store the display name you chose and the platform (e.g., Tinder, Bumble, WhatsApp). These are used to organize your analyses by contact.

2.5 Structured Memories

The app stores up to 10 structured memories per contact — insights the AI derives from analyses (such as recurring conversation topics, communication style, shared interests). This data is used to personalize analyses and suggested responses.

2.6 User Tendencies Profile

The app builds a personal tendencies profile that includes your communication style, strengths, weaknesses, and recurring patterns. This profile is based on your conversation analyses and is used to improve personalized coaching.

2.7 Coaching Conversations (Coach Q&A)

When you use the coaching feature, your questions and responses are stored in our database and linked to your device ID. This data is used to improve your coaching experience and track your progress. Coaching conversation content is not shared with third parties except our AI provider (Google Gemini) for the purpose of generating responses.

2.8 ELO Score and Activity Statistics

We store your ELO score, chess-style rank, usage statistics (number of analyses, average scores, usage streak) — all linked to device ID only.

2.9 Push Notification Token

If you grant notification permissions, we store your device's push token to send you notifications when an analysis is ready or coaching reminders.

2.10 Subscription Status

If you purchase a PRO subscription, purchase data is processed through the Apple App Store and RevenueCat (a subscription management provider). We store your subscription status (active/inactive) and a purchase identifier (your device ID) linked to the subscription. We do not have access to your payment details, credit card information, or other financial data — all of this is handled directly by Apple.

2.11 Display Name (Optional)

You may choose a display name for the leaderboard. This is entirely optional and does not need to be your real name.

2.12 Sign in with Apple (Optional)

You may link your Apple account to the app in order to recover your data on a new device. If you choose to sign in with Apple, we store:

• Apple User ID: A unique identifier provided by Apple (does not expose your Apple account)
• Email address: Only if shared by Apple (you can choose to hide it via Apple)
• Full name: Only if provided by Apple

This data is linked to your device ID and is used solely for account recovery on a new device. It is not used for advertising, marketing, or any other purpose. Sign in with Apple is entirely optional — the app works fully without it.

2.13 Analytics and Usage Data

We collect anonymous usage analytics to improve the app experience. This includes: app events (screens viewed, features used, buttons tapped), device information (device model, operating system version, screen size, timezone), and app version.

This data is collected via PostHog, a third-party analytics provider, and is linked to your anonymous device ID. This data is NOT used for advertising or cross-app tracking. To measure our own ads we use the Meta SDK. On iOS we ask your App Tracking Transparency permission first; on Android this uses the advertising ID, declared in our Google Play Data Safety form. This is our only cross-app processing. There are no ads inside the app.

2.14 Arena — Public Sharing

When you share content in the Arena, your anonymized conversation analyses become visible to other users of the App. This content includes the analysis, scores, and suggested responses — but not the original screenshot. You may delete posts you have shared in the Arena at any time.

2.15 Aggregate Statistics We Publish

We may publish aggregate figures about use of the service — for example how many conversations have been analyzed in total, which platform is most common, or which response tone is chosen most often — in marketing, research or editorial content, on our site and elsewhere.

Any such publication consists of numbers only. It will never include conversation content, quotes, screenshots, names, device identifiers, or any other detail that could be linked to you or to a third party appearing in your conversation. The figures are computed across all users and cannot be decomposed back to an individual.

The production of these statistics (computation across our database) is based on legitimate interest (Art. 6(1)(f) GDPR). The output itself — anonymous aggregate figures — is not "personal data" under either the Israeli Privacy Protection Law or the GDPR, and is therefore not removed on account deletion — but it equally contains nothing that identifies you.

3. Purpose of Collection and Legal Basis

In accordance with the Israeli Privacy Protection Law (Amendment 13) and the GDPR, we process your information on the following legal bases:

Purpose	Legal Basis
Analyzing dating conversations and displaying results	Performance of contract (Art. 6(1)(b) GDPR)
Storing history, contacts, and structured memories	Performance of contract (Art. 6(1)(b) GDPR)
Building user tendencies profile for personalized coaching	Performance of contract (Art. 6(1)(b) GDPR)
Subscription management and ELO ranking	Performance of contract (Art. 6(1)(b) GDPR)
Sending push notifications	Consent (Art. 6(1)(a) GDPR)
Sign in with Apple and account recovery	Consent (Art. 6(1)(a) GDPR)
Sharing content in the Arena	Consent (Art. 6(1)(a) GDPR)
Improving our AI engine — statistical analysis of analyzed conversations (after removal of identifying details) to learn which response styles succeed and improve recommendation quality for all users	Legitimate interest (Art. 6(1)(f) GDPR)
Anonymous usage analytics for service improvement	Legitimate interest (Art. 6(1)(f) GDPR)
Service security and fraud prevention	Legitimate interest (Art. 6(1)(f) GDPR)

Provision of data is voluntary: You are under no legal obligation to provide us with any information. Providing data (uploading screenshots or text for analysis) is entirely at your own choice and consent. The only consequence of not providing it is that we cannot perform the analysis.

4. Information We Do NOT Collect

5. AI Data Processing

Screenshots and conversation text are sent to our AI provider, Google Gemini (paid API), for processing and analysis. Per Google's API terms:

• Data sent through the API is not used to train Google's AI models
• Google retains the data for up to 7 days for abuse monitoring, then deletes it. Processing may occur in any country where Google maintains facilities.
• Google maintains strict data security practices for API services

For more details, see Google's Privacy Policy and the Gemini API Terms of Service.

Internal Use for Engine Improvement

Beyond processing to provide the service, we also use submitted conversation content to improve our coaching engine: statistical analysis of conversation patterns (which message styles receive positive responses and which don't), calibration of our quality-control systems, and refinement of our recommendation rules. This processing is performed on data after an identifying-details removal process (names, phone numbers and other identifiers are automatically filtered), and the resulting insights are statistical and aggregated. Short exchange snippets that have passed identifying-details screening may be used as internal style examples within our AI system. Such content is never published, never sold, and never shared with third parties.

You may object to this processing or request deletion of your data at any time via admin@dugrizz.app or by deleting your account in the app.

6. Third-Party Services and Data Processors

We use the following data processors:

• Google (Gemini API): Processing of screenshots and conversation text for AI analysis. Data is sent to Google servers for processing only and is not permanently stored. See Google's Privacy Policy.
• Supabase: Secure database storage (servers in the EU — Frankfurt, Germany) for device identifiers, analysis results, contacts, structured memories, ELO scores, and user data. Data is encrypted at rest (AES-256) and in transit (TLS). See Supabase's Privacy Policy.
• RevenueCat: Subscription and in-app purchase management. Processes anonymous purchase data through the App Store. See RevenueCat's Privacy Policy.
• PostHog: Anonymous usage analytics including app events, screen views, and device metadata. PostHog does not use advertising identifiers (IDFA) and does not track users across apps. See PostHog's Privacy Policy.
• Apple Push Notification Service (APNs): Notification delivery service for sending push notifications to devices.
• Apple / Google Play: App stores that handle downloads and payments.

Each data processor operates under its own privacy policy and data processing agreements with us.

7. Data Storage and Server Location

Our primary database is located in the European Union (Frankfurt, Germany) and is managed by Supabase. All data is:

• Encrypted at rest (AES-256 encryption)
• Encrypted in transit (TLS/HTTPS)
• Protected by restricted access permissions (Row Level Security)
• Automatically backed up

Screenshots are sent to Google servers for AI processing and may be processed on servers in the United States. Data is sent over an encrypted channel and is not retained after processing.

8. Data Retention and Deletion

8.1 Retention Periods

• Screenshots: Never stored by us. The text transcript derived from them is kept in your history (see below). Google's API copies are deleted within 7 days.
• Analysis results (including the conversation transcript), contacts, and structured memories: Retained until account deletion or 24 months, whichever comes first.
• User tendencies profile: Retained until account deletion by the user.
• Coaching conversations: Retained until account deletion by the user.
• ELO scores and statistics: Retained until account deletion by the user.
• Arena posts: Text only (the Arena stores no screenshots); retained until you delete them or delete your account.
• Token usage logs: Retained for 2 years for billing and quota tracking purposes.
• Subscription data: Retained while the subscription is active and for 12 months after cancellation.
• Analytics data: Retained for 24 months and then deleted or anonymized in aggregate.

8.2 Data Deletion

You may request deletion of all your data in two ways:

• In-app: Settings screen → Delete Account (immediate deletion)
• Via email: Contact admin@dugrizz.app

In-app deletion runs immediately against the live database; an email request is handled within 30 days. Removed: analysis results and transcripts, contacts, memories, tendencies profile, ELO, coaching conversations, and Arena posts. What survives: a minimal device row (quota anti-abuse), content-blanked billing records, and copies in encrypted backups until they age out (up to 7 days). Deletion is irreversible. Note: deleting your account or the app does NOT cancel an App Store / Google Play subscription — cancel in your store settings.

9. Data Subject Rights

Under the Israeli Privacy Protection Law, 5741-1981 (including Amendment 13), and the GDPR, you have the following rights:

• Right of Access: Request access to the information stored about you and receive a copy
• Right to Rectification: Request correction of inaccurate or incomplete information
• Right to Erasure: Request deletion of your information ("right to be forgotten")
• Right to Restriction: Restrict processing of your information in certain circumstances
• Right to Data Portability: Receive your data in a structured, commonly used, machine-readable format
• Right to Object: Object to the processing of your information, including processing for analytics
• Right to Withdraw Consent: Withdraw consent previously given (e.g., push notifications) at any time
• Right to Opt Out of Direct Mailing: Demand that your data not be used for personalized approaches (such as marketing notifications or tailored reminders) — by disabling notifications in your device settings or by contacting us by email

To exercise your rights, contact us at admin@dugrizz.app. We will process your request within 30 days, in accordance with applicable law.

If you are unsatisfied with our handling of your request, you have the right to lodge a complaint with:

• In Israel: The Privacy Protection Authority (Registrar of Databases) — gov.il
• In the EU: Your local Data Protection Authority (DPA)

10. Data Breach Notification

In the event of a data breach affecting your personal data, we are committed to:

• Reporting a severe security incident to the Israeli Privacy Protection Authority immediately, as the Data Security Regulations require; notifying affected users without undue delay where the breach is likely to result in a high risk to them; and, where GDPR applies, notifying the supervisory authority within 72 hours
• Reporting to the Israeli Privacy Protection Authority and any other competent authority as required by law
• Taking immediate steps to mitigate the damage and prevent further breaches
• Providing information about the nature of the breach, the types of data affected, the number of affected data subjects, and the steps taken

11. Automated Decision-Making

The App uses artificial intelligence (AI) for automated analysis of dating conversations, including scoring, pattern detection, and response suggestions. This analysis is fully automated.

Important: The AI analysis does not make decisions that have legal effects or similarly significant effects on users. Scores and recommendations are advisory tools only and do not substitute for independent judgment. The automated decision-making has no impact on your legal rights.

12. International Data Transfers

Our primary database is located in the European Union (Frankfurt, Germany). Screenshots are sent to Google for AI processing and may be processed on servers in the United States.

Data transfers outside the EU are conducted in accordance with GDPR requirements, including:

• Standard Contractual Clauses (SCCs) with service providers
• Encryption in transit (TLS/HTTPS)
• Minimizing the data transferred outside the EU

13. Cookies and Tracking

Website: The dugrizz.app website is a static site and does not use cookies or any tracking technologies.

App: The App uses an anonymous device identifier only for identification and saving your progress. We do not use cookies, advertising identifiers (IDFA), or cross-app tracking technologies.

14. Children's Privacy

DUGRIZZ is intended for users aged 18 and older only. We do not knowingly collect information from children under 18. If we become aware that we have collected information from a user under 18, we will delete that information immediately.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated date, and where appropriate we will provide notice within the app. Continued use of the app after an update constitutes acceptance of the revised policy.

16. Contact Us

For questions about this Privacy Policy, data deletion requests, or to exercise your data subject rights: