Last updated: June 13, 2026. Legal version: 1.0
Duyve ("we", "us", "our") is operated by Viktor, a private individual based in Belgium. If you have any questions about this policy, please contact us at hello@duyve.app.
1. Who We Are
Duyve is a personal dispatch platform that allows individuals to create and send private updates by email to selected groups of people they personally know or who intentionally joined a club.
Data controller:
Viktor
hello@duyve.app
Belgium
2. What Data We Collect and Why
2.1 Account data
When you register, we collect your email address and sender profile/display name. Authentication credentials are processed by Supabase Auth. Passwords are hashed and are never readable by us. If you use Google login, Google provides the information needed to sign you in.
2.2 Contact data
When you manually add someone to a club, we store their name, email address, club memberships, and your consent confirmation, including timestamp and IP address. When someone joins a club through an invite link or QR code, we store their email address, club membership, signup timestamp, and IP address. This is used to deliver dispatches to the people you choose and to document how recipients were added.
2.3 Content data
When you create a dispatch, we store the text, layout, subject, selected clubs, sent status, and related send logs. Send logs can include recipient email addresses, recipient count, provider message identifiers, timestamps, and send errors so we can deliver the dispatch, prevent duplicate sends, troubleshoot delivery, and investigate abuse.
2.4 Photo uploads
Photos you upload while creating a dispatch are stored in Duyve storage and embedded in sent email using public image URLs. Email clients usually need public image URLs to display images. The URLs are hard to guess because they include generated file names and account/dispatch paths, but anyone who receives or is forwarded the email may be able to load or share those image URLs. Do not upload images that need end-to-end secrecy.
2.5 Technical data
When you use Duyve, we automatically process IP addresses for rate limiting, abuse prevention, invite joins, manual contact consent records, and legal consent records. We may also store user agent information with legal consent records. Basic session data is used to keep account holders logged in.
We use Vercel Analytics for aggregate website usage statistics such as page views, referrer, and device type. Duyve does not add advertising pixels or tracking cookies for this analytics setup.
3. What Data We Do Not Collect
We do not collect or use cookies for tracking or advertising purposes, data from third-party advertising networks, behavioral analytics or heatmaps, or social media tracking pixels.
We use only functional cookies that are strictly necessary to keep you logged in. We do not use these cookies for tracking or advertising.
Duyve currently does not use localStorage, sessionStorage, advertising cookies, social media tracking pixels, heatmaps, or third-party marketing tags.
4. How Long We Keep Your Data
| Data type | Retention period |
|---|---|
| Account and sender profile data | Until you delete your account |
| Recipient/contact and club membership data | Until you delete the contact, club membership, or your account |
| Dispatch text, layout, and sent history | Kept until you delete the dispatch or delete your account |
| Uploaded image files and public image URLs | Kept until the related dispatch/image is deleted or you delete your account |
| Send logs | Kept as long as needed to document delivery attempts, troubleshoot abuse, and meet legal obligations |
| Legal consent logs | Kept as long as needed to document acceptance of legal terms |
| Unsubscribe/suppression records | Retained in minimal form as needed to prevent future unwanted emails |
| IP addresses and user agents | Kept only as long as needed for rate limiting, abuse prevention, consent records, security logs, or legal compliance |
You can delete your account in Settings. When you delete your account, your personal data, contacts, clubs, dispatches, and uploaded photos are deleted from active systems. Minimal unsubscribe and suppression records may be retained where needed to respect unsubscribe requests and prevent future unwanted emails or abuse. You can still contact hello@duyve.app for help with deletion or privacy requests.
5. Who We Share Your Data With
We do not sell your data. We do not share your data with advertisers. We work with a small number of third-party service providers to operate Duyve. They process data for the purposes listed below.
| Service | Purpose | Location |
|---|---|---|
| Supabase | Authentication, database, and file storage | EU (Frankfurt, Germany) |
| Resend | Email delivery | EU/US |
| Vercel | Application hosting and cookie-free aggregate analytics | EU/US |
| Upstash | Rate limiting | EU |
| Google OAuth | Optional account sign-in when you choose Google login | EU/US |
The owner should keep data processing agreements and transfer terms with these providers under review. Recipient email addresses and message content are shared with Resend only as needed to deliver the dispatches a sender initiates.
Some providers may process data outside the EEA. Where that happens, Duyve relies on the provider's applicable transfer safeguards, such as standard contractual clauses or equivalent mechanisms.
6. Email Communications
Duyve sends emails in two situations: dispatches you send and transactional emails.
When you choose to send a dispatch to your clubs, we deliver it via Resend to the recipients you have selected. Every dispatch includes an unsubscribe link. Recipients receive one email at a time and other recipients are not shown in the email.
Transactional emails include account-related emails such as email verification or password reset. These are required to operate the service and cannot be opted out of while you have an active account. We do not send marketing emails.
7. Your Rights Under GDPR
Right of access: You can request a copy of all personal data we hold about you.
Right to rectification: You can correct your account name via account settings, or contact us to correct other personal data.
Right to erasure: You can delete your account in Settings. Your data will be deleted, except minimal records retained where needed to respect unsubscribe requests, document consent, handle complaints, prevent abuse, or meet legal obligations. You can still contact hello@duyve.app for help.
Right to restriction: You can ask us to temporarily stop processing your data while a complaint is being resolved.
Right to data portability: You can request your data in a structured, machine-readable format.
Right to object: You can object to processing based on legitimate interest.
Right to withdraw consent: Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing.
These rights also apply to recipients whose email address was added by a sender, even if the recipient does not have a Duyve account. To exercise any of these rights, contact us at hello@duyve.app. We will respond within 30 days.
You also have the right to lodge a complaint with the Belgian Data Protection Authority:
Gegevensbeschermingsautoriteit (GBA)
Drukpersstraat 35, 1000 Brussels
www.gegevensbeschermingsautoriteit.be
8. Legal Basis for Processing
We process your data on the following legal grounds under GDPR Article 6:
| Processing activity | Legal basis |
|---|---|
| Account management | Performance of a contract (Art. 6.1.b) |
| Sender-created clubs, contacts, dispatches, and uploads | Performance of a contract (Art. 6.1.b) |
| Delivering dispatches to recipients selected by the sender | Performance of a contract (Art. 6.1.b) and legitimate interest (Art. 6.1.f) |
| Consent and sending logs | Legitimate interest (Art. 6.1.f) and, where applicable, legal obligation (Art. 6.1.c) |
| Unsubscribe and suppression records | Legal obligation (Art. 6.1.c) and legitimate interest (Art. 6.1.f) |
| Abuse prevention, security, and rate limiting | Legitimate interest (Art. 6.1.f) |
9. Data Security
We take the security of your data seriously. All data is transmitted over encrypted HTTPS connections, passwords are hashed and never stored in plain text, database access is restricted via Row Level Security, file uploads are validated and stored with generated file names, rate limiting is applied to sensitive endpoints to reduce abuse, and we review the codebase for security issues.
Despite these measures, no system is completely secure. If you discover a security vulnerability, please report it to hello@duyve.app.
Duyve is not end-to-end encrypted. Dispatch emails and embedded image URLs may be processed by email providers and may be forwarded, copied, screenshotted, or shared by recipients.
10. Children's Privacy
Duyve is a general-purpose platform and is not specifically directed at children. We do not knowingly collect personal data from children under the age of 13. If you believe a child has provided us with personal data without parental consent, please contact us at hello@duyve.app and we will delete the data promptly.
11. Changes to This Policy
We may update this privacy policy from time to time. When we make significant changes, we will update the "Last updated" date at the top of this page. For material changes, we will notify you by email if you have an account.
We encourage you to review this policy periodically.
12. Contact
For any questions, concerns, or requests regarding your personal data, email hello@duyve.app. We aim to respond to all privacy-related requests within 30 days.
To report unwanted email, image/privacy takedown concerns, illegal content, or other misuse, use the abuse reporting page.