Privacy Policy
At DuoNiche, your privacy matters. This policy explains what data we collect, how we use it, how long we keep it, and your rights.
Last updated: 03-07-2026
1. Data We Collect
We may collect and process the following data:
- Account identifiers: internal user ID, public support handle, Telegram ID, Apple ID, Google ID, email address, guest installation identifier, and similar login identifiers.
- Profile data: name, username, avatar URL, language preferences, onboarding answers, and app settings.
- Learning activity: exercises, answers, attempts, session statistics, streaks, progress reports, selected topics, and similar app usage data.
- Feedback: feedback reason, related exercise, optional user comment, and timestamps.
- Payment and subscription data: subscription status, plan, billing period, payment provider, provider transaction identifiers, and payment history needed for billing, refunds, fraud prevention, accounting, and support.
- Support communications: messages you send to support and metadata needed to resolve your request.
- Technical and security data: logs needed to operate the service, prevent abuse, investigate incidents, and protect users.
- Product analytics data: internal user ID, app platform and version, device or browser information, language settings, subscription status, screen views, and event metadata about authentication, onboarding, learning sessions, exercise outcomes, paywalls, and checkout results. We apply data minimization principles to our product analytics. We do not transmit direct identifiers (such as email or Telegram ID) or free-form user-generated content (such as exercise answers) to our analytics provider.
- Session replay data: a visual reconstruction of interactions. When session replay features are utilized to diagnose usability issues, input values are strictly masked, and designated sensitive interface areas (like payment screens) are excluded from capture.
We do not intentionally collect special categories of personal data, such as health, biometric, political, religious, or precise location data.
Children's Privacy: Our service is not intended for children under the age of 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal data from children. If we discover that we have inadvertently collected such data, we will delete it promptly.
2. Purpose of Data Use
We use your data to:
- provide and personalize language learning features;
- authenticate your account;
- save progress, preferences, and learning history;
- generate progress reports;
- process subscriptions and manage access;
- provide customer support;
- detect abuse, fraud, technical errors, and security incidents;
- understand how features and user journeys are used, measure onboarding, learning, and subscription funnels, diagnose usability problems, and improve the service and user experience;
- comply with legal, accounting, tax, and regulatory obligations.
3. Legal Bases
Where GDPR applies, we process personal data based on one or more of the following legal bases:
- performance of a contract, to provide DuoNiche features and paid access;
- legitimate interests, including service security, support, abuse prevention, product quality, understanding feature usage, diagnosing usability problems, and improving business operations, where those interests are not overridden by your rights and interests;
- legal obligations, including accounting, tax, and compliance requirements;
- consent, where required by law, including for non-essential device storage or session replay where applicable.
4. Data Storage
Data is stored securely in the European Union where possible. Some service providers may process data outside the EU. Where required, we use appropriate safeguards such as Standard Contractual Clauses or equivalent protections.
Product analytics and session replay data are hosted securely within the European Union. Service providers and their subprocessors may provide support or other limited processing from outside the European Economic Area under applicable contractual and transfer safeguards.
Inactive accounts may be deleted or anonymized after 12 months.
5. Payments and Subscriptions
Depending on the platform, payments may be processed by Telegram, Polar.sh, Apple App Store, Google Play, or another payment provider shown at checkout.
We do not store full payment card details. Payment providers may process your payment details under their own terms and privacy policies.
Deleting your DuoNiche account does not automatically cancel an active subscription managed by Apple App Store, Google Play, Telegram, Polar.sh, or another payment provider. You must cancel active subscriptions through the platform or payment provider where the subscription was started.
6. Account Deletion and Data Retention
You may request deletion of your DuoNiche account in the app or by contacting [email protected].
When you request account deletion, we disable the account, revoke active sessions, remove external login identifiers, and delete or anonymize profile data and app data that is no longer needed. If identified analytics data exists, we also submit deletion or irreversible anonymization requests to product analytics providers for data linked to your internal user ID.
For support, security, fraud prevention, legal claims, billing, accounting, tax, and regulatory compliance, we may retain limited records after account deletion.
Retention categories:
| Data category | What happens after deletion request | Retention period |
|---|---|---|
| External login identifiers | Telegram ID, Apple ID, Google ID, email, guest installation identifier, username, name, avatar, and profile data are deleted or anonymized. | Immediately or within 30 days |
| Learning activity | Exercise attempts, session data, progress reports, preferences, onboarding data, and app settings are deleted or anonymized. | Immediately or within 30 days |
| Feedback | Free-text feedback comments are deleted. Feedback reason, exercise reference, internal user ID, and public support handle may be retained for product quality, abuse investigation, and support history. | Up to 5 years after deletion, unless a longer period is required for an open dispute, incident, or legal obligation |
| Account deletion record | Internal user ID, public support handle, deletion status, and deletion timestamps are retained so we can prove and support deletion requests. | Up to 5 years after deletion |
| Support communications | Support messages may be retained to resolve requests, investigate abuse, and defend legal claims. | Up to 24 months after ticket closure, or up to 5 years if related to a dispute or incident |
| Security and fraud logs | Logs needed to protect the service, investigate abuse, prevent fraud, and maintain system integrity may be retained. | Up to 24 months, or longer if required for an active investigation |
| Billing, accounting, tax, refund, and dispute records | Transaction records, invoice-related data, subscription events, provider transaction IDs, and accounting records may be retained where required by law or needed for refunds, chargebacks, fraud prevention, or audits. | Up to 10 years, or longer if required by law or an active dispute |
| Identified product analytics and session recordings | Analytics profiles, events, and session recordings linked to the internal user ID are deleted or irreversibly anonymized. Aggregated data that no longer identifies a user may be retained. | Immediately or within 30 days |
| Aggregated or anonymized analytics | Data that no longer identifies a user may be retained for product analytics and service improvement. | Indefinitely |
| Backups | Deleted data may remain in encrypted backups until backups expire. If a backup is restored, deletion requests are re-applied where technically possible. | Up to 90 days, unless a longer disaster-recovery period applies |
After account deletion, you will no longer be able to sign in with the deleted account. If you contact support, we may use your public support handle to locate the deletion record and retained support history.
7. Your Rights
Where applicable, you may request:
- access to your personal data;
- correction of inaccurate data;
- deletion of your data;
- restriction or objection to processing;
- data portability;
- withdrawal of consent where processing is based on consent.
To exercise your rights, contact [email protected].
We may refuse or limit a deletion request where retention is required for legal obligations, security, fraud prevention, billing, accounting, dispute resolution, or the establishment, exercise, or defense of legal claims.
9. Service Providers and International Transfers
We use service providers to operate DuoNiche, including hosting, authentication, payment, error monitoring, communications, customer support, and analytics providers. They may process personal data only for the contracted services and under appropriate data-protection terms.
We use artificial intelligence features to power our language learning tools. We do not use your personal data or free-form inputs to train our own foundational AI models. Where we use third-party AI providers (such as LLM APIs), data is processed solely to provide the feature to you and is not used by those providers to train their public models.
For product analytics and optional session replay, we use PostHog Cloud EU. Information about PostHog's privacy and security practices, data processing terms, and subprocessors is available through PostHog's public website and Trust Center.
Where personal data is transferred outside the European Economic Area, we use an applicable transfer mechanism and safeguards, such as an adequacy decision or Standard Contractual Clauses.
10. Data Security
Communications are encrypted. We apply technical and organizational measures to protect personal data against unauthorized access, loss, misuse, or alteration.
11. Policy Acceptance
By accessing or using DuoNiche, you acknowledge that you have read and understood this Privacy Policy. This acknowledgement does not replace consent where consent is required by law.
12. Contact
Company Name: PANDORA-13 Ltd.
Company Number (EIK): 202409460
Registered Address: Bulgaria, Burgas 8000, Burgas Municipality, 78 Makedonia St., floor 5, apt. 7
The services under DuoNiche are provided by PANDORA-13 Ltd.
Email: [email protected]