Privacy Policy

Last updated: April 2026

1. Introduction and Data Controller

Welcome to DUGRIZZ ("the App", "the Service", "we", "us"). We are committed to protecting your privacy in accordance with the Israeli Privacy Protection Law, 5741-1981, including Amendment 13 (effective August 2025), and the EU General Data Protection Regulation (GDPR) where applicable.

DUGRIZZ is an AI dating coach that analyzes conversation screenshots and provides feedback, scores, and suggested responses. The service operates on an anonymous basis — no user account, email, or password is required.

2. Information We Collect

Below is a complete description of all data types we collect, the purpose of collection, and the legal basis for each:

2.1 Device Identifier

We generate a unique anonymous identifier (UUID) for your device. This ID is not linked to your name, email, or any other personally identifiable information. It is used solely to save your progress within the app.

2.2 Screenshots and Conversation Text

When you upload a screenshot for analysis, the image is sent to third-party AI providers such as Google Gemini, OpenAI, and xAI (Grok) for processing and analysis. We do not permanently store your conversation images. They are processed in real time and are not retained by Google per their API terms (API data is not used for model training).

Recommendation: We encourage you to blur or redact names and faces of third parties before uploading screenshots, to protect their privacy.

2.3 Analysis Results

Analysis results (scores, feedback, suggested responses, assessments) are stored in our database and linked to your device ID so you can access your history.

2.4 Contact Names and Platforms

When you save a contact in the app, we store the display name you chose and the platform (e.g., Tinder, Bumble, WhatsApp). These are used to organize your analyses by contact.

2.5 Structured Memories

The app stores up to 10 structured memories per contact — insights the AI derives from analyses (such as recurring conversation topics, communication style, shared interests). This data is used to personalize analyses and suggested responses.

2.6 User Tendencies Profile

The app builds a personal tendencies profile that includes your communication style, strengths, weaknesses, and recurring patterns. This profile is based on your conversation analyses and is used to improve personalized coaching.

2.7 Coaching Conversations (Coach Q&A)

When you use the coaching feature, your questions and responses are stored in our database and linked to your device ID. This data is used to improve your coaching experience and track your progress. Coaching conversation content is not shared with third parties except AI providers (Google Gemini, OpenAI, xAI) for the purpose of generating responses.

2.8 ELO Score and Activity Statistics

We store your ELO score, chess-style rank, usage statistics (number of analyses, average scores, usage streak) — all linked to device ID only.

2.9 Push Notification Token

If you grant notification permissions, we store your device's push token to send you notifications when an analysis is ready or coaching reminders.

2.10 Subscription Status

If you purchase a PRO subscription, purchase data is processed through the Apple App Store and RevenueCat (a subscription management provider). We store your subscription status (active/inactive) and an anonymous purchase identifier linked to your device ID. We do not have access to your payment details, credit card information, or other financial data — all of this is handled directly by Apple.

2.11 Display Name (Optional)

You may choose a display name for the leaderboard. This is entirely optional and does not need to be your real name.

2.12 Sign in with Apple (Optional)

You may link your Apple account to the app in order to recover your data on a new device. If you choose to sign in with Apple, we store:

• Apple User ID: A unique identifier provided by Apple (does not expose your Apple account)
• Email address: Only if shared by Apple (you can choose to hide it via Apple)
• Full name: Only if provided by Apple

This data is linked to your device ID and is used solely for account recovery on a new device. It is not used for advertising, marketing, or any other purpose. Sign in with Apple is entirely optional — the app works fully without it.

2.13 Analytics and Usage Data

We collect anonymous usage analytics to improve the app experience. This includes: app events (screens viewed, features used, buttons tapped), device information (device model, operating system version, screen size, timezone), and app version.

This data is collected via PostHog, a third-party analytics provider, and is linked to your anonymous device ID. This data is NOT used for advertising or cross-app tracking. We do not use advertising identifiers (IDFA) and do not track you across other apps.

2.14 Arena — Public Sharing

When you share content in the Arena, your anonymized conversation analyses become visible to other users of the App. This content includes the analysis, scores, and suggested responses — but not the original screenshot. You may delete posts you have shared in the Arena at any time.

3. Purpose of Collection and Legal Basis

In accordance with the Israeli Privacy Protection Law (Amendment 13) and the GDPR, we process your information on the following legal bases:

Purpose	Legal Basis
Analyzing dating conversations and displaying results	Performance of contract (Art. 6(1)(b) GDPR)
Storing history, contacts, and structured memories	Performance of contract (Art. 6(1)(b) GDPR)
Building user tendencies profile for personalized coaching	Performance of contract (Art. 6(1)(b) GDPR)
Subscription management and ELO ranking	Performance of contract (Art. 6(1)(b) GDPR)
Sending push notifications	Consent (Art. 6(1)(a) GDPR)
Sign in with Apple and account recovery	Consent (Art. 6(1)(a) GDPR)
Sharing content in the Arena	Consent (Art. 6(1)(a) GDPR)
Anonymous usage analytics for service improvement	Legitimate interest (Art. 6(1)(f) GDPR)
Service security and fraud prevention	Legitimate interest (Art. 6(1)(f) GDPR)

4. Information We Do NOT Collect

5. AI Data Processing

Screenshots and conversation text are sent to third-party AI providers — Google Gemini, OpenAI, and xAI (Grok) — for processing and analysis. Per Google's API terms:

• Data sent through the API is not used to train Google's AI models
• Data is processed in real time and is not permanently stored by Google
• Google maintains strict data security practices for API services

For more details, see Google's Privacy Policy and the Gemini API Terms of Service.

6. Third-Party Services and Data Processors

We use the following data processors:

• Google (Gemini API): Processing of screenshots and conversation text for AI analysis. Data is sent to Google servers for processing only and is not permanently stored. See Google's Privacy Policy.
• Supabase: Secure database storage (servers in the EU — Frankfurt, Germany) for device identifiers, analysis results, contacts, structured memories, ELO scores, and user data. Data is encrypted at rest (AES-256) and in transit (TLS). See Supabase's Privacy Policy.
• RevenueCat: Subscription and in-app purchase management. Processes anonymous purchase data through the App Store. See RevenueCat's Privacy Policy.
• PostHog: Anonymous usage analytics including app events, screen views, and device metadata. PostHog does not use advertising identifiers (IDFA) and does not track users across apps. See PostHog's Privacy Policy.
• Apple Push Notification Service (APNs): Notification delivery service for sending push notifications to devices.
• Apple / Google Play: App stores that handle downloads and payments.

Each data processor operates under its own privacy policy and data processing agreements with us.

7. Data Storage and Server Location

Our primary database is located in the European Union (Frankfurt, Germany) and is managed by Supabase. All data is:

• Encrypted at rest (AES-256 encryption)
• Encrypted in transit (TLS/HTTPS)
• Protected by restricted access permissions (Row Level Security)
• Automatically backed up

Screenshots are sent to Google servers for AI processing and may be processed on servers in the United States. Data is sent over an encrypted channel and is not retained after processing.

8. Data Retention and Deletion

8.1 Retention Periods

• Screenshots: Deleted immediately after processing. Not permanently stored.
• Analysis results, contacts, and structured memories: Retained until account deletion by the user.
• User tendencies profile: Retained until account deletion by the user.
• Coaching conversations: Retained until account deletion by the user.
• ELO scores and statistics: Retained until account deletion by the user.
• Arena posts: Retained until deleted by the user or until account deletion.
• Token usage logs: Retained for 2 years for billing and quota tracking purposes.
• Subscription data: Retained while the subscription is active and for 12 months after cancellation.
• Analytics data: Retained for 24 months and then deleted or anonymized in aggregate.

8.2 Data Deletion

You may request deletion of all your data in two ways:

• In-app: Settings screen → Delete Account (immediate deletion)
• Via email: Contact support@dugrizz.app

We will process your request within 30 days. Account deletion will remove all data linked to your device ID, including: analysis results, contacts, structured memories, tendencies profile, ELO scores, coaching conversations, and Arena posts. Data deletion is irreversible.

9. Data Subject Rights

Under the Israeli Privacy Protection Law, 5741-1981 (including Amendment 13), and the GDPR, you have the following rights:

• Right of Access: Request access to the information stored about you and receive a copy
• Right to Rectification: Request correction of inaccurate or incomplete information
• Right to Erasure: Request deletion of your information ("right to be forgotten")
• Right to Restriction: Restrict processing of your information in certain circumstances
• Right to Data Portability: Receive your data in a structured, commonly used, machine-readable format
• Right to Object: Object to the processing of your information, including processing for analytics
• Right to Withdraw Consent: Withdraw consent previously given (e.g., push notifications) at any time

To exercise your rights, contact us at support@dugrizz.app. We will process your request within 30 days, in accordance with applicable law.

If you are unsatisfied with our handling of your request, you have the right to lodge a complaint with:

• In Israel: The Privacy Protection Authority (Registrar of Databases) — gov.il
• In the EU: Your local Data Protection Authority (DPA)

10. Data Breach Notification

In the event of a data breach affecting your personal data, we are committed to:

• Notifying affected users within 72 hours of becoming aware of the breach, in accordance with Israeli Privacy Protection Law (Amendment 13) and GDPR requirements
• Reporting to the Israeli Privacy Protection Authority and any other competent authority as required by law
• Taking immediate steps to mitigate the damage and prevent further breaches
• Providing information about the nature of the breach, the types of data affected, the number of affected data subjects, and the steps taken

11. Automated Decision-Making

The App uses artificial intelligence (AI) for automated analysis of dating conversations, including scoring, pattern detection, and response suggestions. This analysis is fully automated.

Important: The AI analysis does not make decisions that have legal effects or similarly significant effects on users. Scores and recommendations are advisory tools only and do not substitute for independent judgment. The automated decision-making has no impact on your legal rights.

12. International Data Transfers

Our primary database is located in the European Union (Frankfurt, Germany). Screenshots are sent to Google for AI processing and may be processed on servers in the United States.

Data transfers outside the EU are conducted in accordance with GDPR requirements, including:

• Standard Contractual Clauses (SCCs) with service providers
• Encryption in transit (TLS/HTTPS)
• Minimizing the data transferred outside the EU

13. Cookies and Tracking

Website: The dugrizz.app website is a static site and does not use cookies or any tracking technologies.

App: The App uses an anonymous device identifier only for identification and saving your progress. We do not use cookies, advertising identifiers (IDFA), or cross-app tracking technologies.

14. Children's Privacy

DUGRIZZ is intended for users aged 18 and older only. We do not knowingly collect information from children under 18. If we become aware that we have collected information from a user under 18, we will delete that information immediately.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated date, and where appropriate we will provide notice within the app. Continued use of the app after an update constitutes acceptance of the revised policy.

16. Contact Us

For questions about this Privacy Policy, data deletion requests, or to exercise your data subject rights: