Account & Access
Your account stays yours.
Duyve uses authenticated accounts to protect private parts of the app. Access to clubs, contacts and notes is scoped to the account that owns them.
- Authentication
- Account access is handled through Supabase Auth.
- Data isolation
- Database access is restricted with Row Level Security so users cannot simply request another account's private data.
- Server-side checks
- Sensitive actions are checked on the server rather than trusting the browser alone.
Data & Input
What comes in gets checked.
Duyve validates incoming data before it is processed. Uploads and note content are checked rather than silently accepting anything that is sent to the app.
- Uploads
- Image uploads are restricted to JPEG, PNG and WebP files, with a maximum size of 5 MB.
- Note content
- Unsupported note structures, unsafe links and images outside Duyve uploads are rejected before a note can be sent.
- Secrets
- Sensitive configuration and service credentials stay server-side.
- Connections
- Duyve is served over HTTPS so data is encrypted while travelling between your browser and the service.
Sending & Abuse
Sending comes with limits.
Duyve is made for personal updates, not bulk marketing. Sending and authentication flows include safeguards against spam and automated abuse.
- Rate limits
- Sensitive routes are rate-limited to reduce automated abuse and repeated requests.
- Consent
- Clubs are for people who have agreed to hear from you. Purchased, scraped or unsolicited mailing lists are not allowed.
- Unsubscribe
- Recipients can stop future Duyve emails without creating an account.
- Abuse
- Unwanted or abusive use can be reported to Duyve for review.
Limits
What Duyve doesn't promise.
Duyve is not end-to-end encrypted.
Notes are delivered through email. An email can be forwarded, copied, downloaded or accessed by someone who has access to the recipient's inbox.
Duyve can protect access to the service. It cannot control what happens to a note after it reaches someone else's inbox.
Don't use Duyve as a secure vault for highly sensitive information.
If you believe you've found a security issue in Duyve, let us know.
hello@duyve.app