Privacy Policy

Version 1.0 — Android edition, updated on September 21, 2026.

This policy explains how LustDuo handles data to offer a private space to an adult couple. To exercise privacy rights or talk to the data controller, write to nicolasoliveira@kirvano.com.

Data processed and purpose

• Account: email, credentials managed by Supabase Auth, internal identifier, age confirmation, accepted terms version and consent dates. We use this data to create, protect and recover the account.

• Couple: invitations, link between the two accounts and shared settings. We use this data for pairing and synchronization.

• Intimate content: votes, matches, reviews and personalized fantasies. We use this data only to perform the functions chosen by the couple.

• Games and temporary rooms: sealed actions, codes, presence and answers required to calculate an aggregated result. The isolated answer stays in private tables and is removed with the session.

• Routine: during the journey, each account maintains its own grid of up to 30 nights (made, passed or current). This personal history is not shown to the partner and is deleted when restarting, ending, undoing the couple or invalidating the applicable consent.

• Commercial accesses: product, offer, provider, access status and technical identifiers of the external transaction. The webhook normalizes the email provided to Kirvano and the ledger only stores its HMAC with a server secret, not the plain email address. To link a purchase made before registration, the account needs to confirm the same email. If the address has already been confirmed by another account, the access remains pending for support confirmation; there is no automatic transfer.

• Device and notifications: platform, installation identifier, notification preferences and push token, when authorized. We use this data to deliver neutral notifications and maintain discretion choices.

• Security and operation: minimum technical records of authentication, calls and errors maintained by the providers. We use this data for abuse prevention, diagnosis and security.

We do not ask for real name, photo, contacts or exact location. Card, PIX and payment credentials are processed outside the LustDuo website and apps by the external purchase provider. LustDuo does not receive the card number and does not offer purchase, price or payment link on its surfaces. This version does not use ads, IDFA or behavioral analytics SDK.

What your partner sees

Catalog votes are individual. Your partner does not receive your individual decision; only a compatible choice generates a match visible to both.

A customized fantasy is an explicit exception: when sending it, the text goes to their partner's deck and shows interest from whoever created it. The send screen must confirm this disclosure before creation.

Each game informs before the round what will be revealed and only opens the result after the quorum. In Intersections and in the aggregated result modules, we do not disclose which person answered, which individual answer prevented a combination or "almost" indicators. In Who in the Couple, after both answer, the two round choices can appear side by side, without authorship label; since each person knows their own choice, they can infer their partner's answer. This disclosure is part of the explicit rule of this module.

In the Body Map, each person only sees the positive markings made by the partner on their own body map; absence of marking does not become a negative response. The subsequent feedback remains private and only a positive confirmation from both increases the future weight. In the Liberal journey, the closed agreement is aggregated; the chosen exit signal for a meeting remains only in the local vault and is not sent to the server.

Content moderation

Before saving a custom fantasy, the full content is processed by the backend and may be sent to OpenAI's moderation and privacy classification endpoints. The decision is used to accept, reject, or forward the material for human review.

According to the data controls published for the OpenAI API, API data is not used to train models by default. LustDuo sends store: false to the endpoint /v1/responses; however, in the provider's default regime, abuse monitoring logs may contain the content for up to 30 days. The endpoint /v1/moderations does not maintain application state or standard abuse monitoring log retention. Specific contractual controls may alter these deadlines. The current rules are at https://platform.openai.com/docs/models/default-usage-policies-by-endpoint.

Providers

• Supabase: authentication, PostgreSQL database, Realtime and Edge Functions, currently hosted in the sa-east-1 region.

• OpenAI: moderation of text from custom fantasies.

• Google Firebase Cloud Messaging: delivery of neutral notices on Android when you enable notifications. It receives the device token and technical account, installation and delivery identifiers to prevent notices appearing in another account. It does not receive desires, answers or game details.

• Kirvano: processing of the external transaction and server-to-server sending of purchase, renewal, cancellation, expiration, refund and chargeback events.

• Google Play: distribution of the Android app and store operation; this version does not process purchases through the store.

• Transaction email provider: account confirmation, recovery and security alerts.

These providers only receive the data necessary for the corresponding function and operate according to their own terms and security measures.

PIN and local storage

The raw PIN and exit signal are not sent to the server. In the Android app, the PIN-derived verifier, session credentials, saved Liberal agreement, exit signal and pending command queues are encrypted with AES-GCM using a key protected by Android Keystore. These files are excluded from system backups. Language preferences remain in local app storage. This allows choices and attempts to be recovered after restarts, without promising fully offline functionality.

Biometrics are optional. Android performs authentication; LustDuo only receives success or failure and does not receive facial images, fingerprints or biometric models. Audio guidance uses local synthetic voice files. The app does not record the microphone or send audio from the couple.

These storage rules describe the native Android app. The web and iOS versions have their own mechanisms, described in the policies available in those versions.

Retention and deletion

Account data remains as long as it is active. Dissolving the couple removes the link and the shared data defined in the confirmation of the operation. Deleting the account removes the active data and initiates the deletion of the authentication identity. The irreversible HMAC used as the safeguard against duplicate purchase claims can remain with the minimum purchase records to prevent the same address from being reused automatically by another account.

Common sessions are closed and purged within a short period; the Intersection quiz expires in up to 24 hours. Minimum technical counters may remain without cards, answers or scoreboards. The visible exception is the personal grid of the Routine described above, limited to the active session and never shared with the partner. Minimum purchase records and fraud prevention can be retained for the applicable period.

The project currently uses the Supabase Pro plan, with daily backups accessible for up to seven days. Therefore, previously deleted records from the active database can remain in protected backups until the corresponding cycle expires. Technical logs follow the deadlines of the respective providers.

Communications and discretion

Push and email use neutral text and do not include fantasy, match or individual decision. Disabling notifications prevents new sends to that installation after preference synchronization.

Covering content when leaving the app and when screen recording is detected reduces exposure, but does not prevent screenshots or provide absolute protection. The icon and the name remain LustDuo. The operating system, external recordings or a photo of the screen can reveal the content or the name of the app.

Security and limits

We use row-level security in the database, user-scope functions, secure storage on the device and additional confirmations for sensitive operations. Local encryption does not mean end-to-end encryption: the backend processes content necessary for operation and moderation. No system eliminates risk completely; keep the device and account protected and do not share invites, passwords or codes.

Your rights

You can request confirmation of data processing, access, correction, information about sharing and deletion, according to applicable legislation. Some information may be retained for the necessary period for security, legal compliance or expiration of backups. Requests: nicolasoliveira@kirvano.com.

Changes

Material changes to this policy require a new version and new notice or consent when applicable.