Privacy Policy

Version 1.0 · Effective 18 September 2026 · Operator: [ALIGNED OPERATIONS LLC] · Contact: legal@duets.us

[ALIGNED OPERATIONS LLC] (“we”, “us”) operates the Duets matchmaking service at duets.us (the “Service”). This Privacy Policy explains what personal data we collect, why we collect it, how long we keep it, and the choices you have.

It is written in plain language, but it is a legal document: it forms part of your agreement with us alongside the Terms of Service. Contact: legal@duets.us.

1. Who we are

[ALIGNED OPERATIONS LLC] is the data controller for the Service. You can reach us at legal@duets.us for any privacy question, request, or complaint.

The Service runs on Google Cloud (Firebase and Vertex AI). Google acts as a processor on our instructions; more in Section 5.

2. What we collect

We collect only what the Service needs to function, verify, and protect its users:

• Account data — when you sign in with Google: your email address, name, and (if available on your Google profile) date of birth, from which we store only your age. Your Google password never reaches us.
• Phone number — required once at sign-up to verify you are a real person via SMS. Used for verification and abuse prevention only; never shown to other users.
• Selfie and face data — a live selfie taken at sign-up, from which we compute a mathematical face descriptor (a list of numbers). Used solely to verify that the photos you upload depict you. The selfie image and descriptor are never shown to other users.
• Profile text — the three free-text sections you write: “About You” (public), “Private Details” (never shown to others, used only for matching), and “What You’re Looking For” (never shown to others, used only for matching). Private Details may include sensitive information about you (for example health, sexual orientation, political or religious views). We process this only with your explicit consent (Section 3) and only to compute matches.
• Photos — the profile photos you choose to upload (screened by automated content analysis before publication).
• Location — your city-level location (detected from your device/IP or chosen manually). Used for matching and shown on your profile.
• Messages and chat images — the text and images you exchange in chats, delivered to your match. Chat images are NOT pre-screened (see Terms §6.2).
• Engagement data — which profiles you open (anonymised counters), whom you select, and your match list.
• AI-derived data — mathematical representations (“embeddings”) of your profile text and structured traits automatically extracted from it (for example “hiking” or “non-smoker”), used only for matching.
• Abuse reports — reports other users submit about you, or you about them, with the reason given.

We do not collect browsing history outside the Service, do not use advertising or tracking cookies, and do not build profiles about you for third parties.

3. Why we use your data (legal bases)

3.1 To provide the Service — account creation, verification, matching, chat. Legal basis: performance of the contract with you.

3.2 Sensitive details in your profile text and automated analysis of your text — legal basis: your explicit consent, given at sign-up and withdrawable at any time (Section 9). If you withdraw consent, delete the affected text or your account; matching cannot work without the text analysis.

3.3 Safety and abuse prevention — verification data, reports, bans. Legal basis: our legitimate interest in keeping the Service and its users safe.

3.4 Legal obligations — retaining specific records where law requires.

4. How matching works, in data terms

When your profile text changes, our server converts your text into an embedding (a list of 768 numbers that represents its meaning) and asks Google’s Gemini AI to extract structured traits from it. To find matches, we compare your embeddings and traits with other users’ — in both directions — plus your stated location and age range, and propose mutually compatible users. All scoring happens on our servers; other users never see your texts, traits, or preferences — only your public profile.

5. Sharing

We do not sell, rent, or trade your personal data. We do not share it with advertisers.

• Google Cloud (Firebase Authentication, Firestore, Cloud Storage, Vertex AI) — hosts the Service and runs the embedding and trait-extraction models, under Google’s processor commitments to us.
• Nominatim (OpenStreetMap) — converts coordinates to a city name when you auto-detect your location; receives coordinates only, no identity.
• Legal and safety — where we are legally required, or where we reasonably believe disclosure is necessary to enforce the Terms, protect users, or cooperate with law enforcement.

6. How long we keep your data (retention)

Retention is enforced automatically, so this table reflects what actually happens:

• Your profile, photos, embeddings, and traits — while your account exists. The in-app “Delete account” DEACTIVATES you: it signs you out, removes you from all matching, and resets your verification, but keeps your texts, photos, and chats so everything is restored when you return and re-verify. Permanent erasure of everything is available at any time on request at legal@duets.us.
• Chats and messages — deleted automatically after 12 months of chat inactivity, or immediately when either person deletes their account or removes the match.
• Abuse reports — kept for up to 24 months after creation (investigation, repeat-offender detection, and legal defense), then deleted.
• Backups — up to 30 days, after which deleted data is gone from backups too.

7. Security

Data is encrypted in transit. Access to the database is governed by strict least-privilege rules: other users can never read your private sections, messages, or verification data — the server decides exactly which fields are ever exposed. Scoring and matching run server-side only. No system is perfectly secure; if a breach affects you, we will notify you and the competent authorities as required by law.

8. International transfers

The Service operates on Google Cloud infrastructure in the United States. If you are in the European Economic Area, the United Kingdom, or Switzerland, your data is transferred on the basis of the European Commission’s Standard Contractual Clauses (as incorporated in Google’s Data Processing Terms) together with additional safeguards where available.

9. Your rights

Where GDPR, UK GDPR, CCPA/CPRA, or similar laws apply to you, you have rights over your data. We honour them in practice, not just on paper:

• Access & portability — see your data or receive a copy: email us.
• Rectification — fix your profile, photos, name, age, and location directly in the app at any time.
• Erasure — the in-app “Delete account” button deactivates your account (sign-out, removal from matching, verification reset) while retaining your data for your return; permanent and complete erasure is available on request at legal@duets.us and takes effect within 30 days, subject to the exceptions in Section 6.
• Restriction & objection — ask us to pause or stop specific processing by email.
• Withdraw consent — for sensitive-data processing and automated text analysis: delete the affected text or your account. Withdrawal does not affect processing already lawfully carried out.
• Automated decisions — matching is automated; you can contest outcomes or ask for human review by email.
• Complain — to your national data protection authority (for EU residents, the authority of your member state; e.g. the Garante in Italy, the BfDI in Germany).

To exercise any right, use the in-app controls or email legal@duets.us. We respond within the statutory deadlines and may ask minimal questions to verify identity.

10. Children

11. Changes to this policy

We may update this Privacy Policy as the Service evolves. Material changes are announced in-app with a new effective date; continued use after that date constitutes acceptance. Earlier versions are available on request.

12. Contact

[ALIGNED OPERATIONS LLC] — legal@duets.us. For anything about your data, that address reaches the people who can act on it.