Privacy Policy

Scope and approach

This policy applies to duu.to public pages, campaigns, artist hubs, and the dashboard. We use a Mongolia-first, globally conservative privacy baseline: marketing integrations are off unless a visitor actively allows them, and first-party analytics is anonymous and cookieless, with an opt-out. A browser's Global Privacy Control signal is treated as a refusal of both.

What we collect

• Account and workspace data — authentication email, profiles, campaigns, links, artwork, and settings needed to provide the service.
• Fan subscriptions — the email, optional name, consent text, source, and delivery/unsubscribe records submitted through an artist's form. Abuse-prevention systems may use a short-lived IP-derived key; raw IP addresses are not stored in analytics tables.
• Unlocks — when you unlock an artist's content by joining their list, your email and consent are recorded as a fan subscription for that release; by pre-saving, the pre-save record is used. We keep a one-way hash of the email with the unlock (to count downloads per fan) and a functional cookie that remembers the unlock in your browser.
• First-party analytics — anonymous and cookieless: event type, workspace/campaign/profile/block/link identifiers, country derived from the request, coarse device and browser families, referrer hostname, path without query parameters, safe UTM source/medium/campaign values, and timestamp. No cookie, visitor identifier or IP address is stored, so events cannot be linked to a person or to each other. Visits are counted unless you opt out in Privacy choices or your browser sends Global Privacy Control; an opt-out stops counting from that point.
• Optional marketing events — only after marketing consent and only for an approved provider configured by a workspace owner. Queue records contain provider/event identifiers, a deduplication key, a consent receipt, a redacted URL path, and delivery status. Custom image beacons and arbitrary webhooks are not enabled.

How we use information

We use account and content data to operate duu.to, protect the service, deliver fan subscriptions, and show workspace analytics when allowed. Approved marketing providers may receive an event only when the visitor's current consent receipt permits it. Workspace owners cannot override this platform-wide rule.

On public release and artist pages we read the country, and city when our network provider supplies it, that it derives from your request, to show store links for your region and the tour date nearest you. This is used only to build that page: it is not stored, logged, or passed to marketing providers, and we do not use a location database.

Server and edge error reporting may be enabled for reliability. It is error-only: browser telemetry, replay, performance traces, and logs are disabled under this policy. Error events are scrubbed of request headers, cookies, query strings, user data, breadcrumbs, and extra payloads before delivery.

Cookies and choices

Essential authentication and security cookies support signed-in features. The optional preference cookie is versioned as duu_privacy_consent_v1 and lasts 180 days. On public pages, use the fixed Privacy choices control to accept, reject, change, or withdraw optional categories. The control has equal accept/reject access and withdrawal takes effect before a queued marketing event can be delivered.

See Cookies & privacy choices for the category-by-category inventory.

Retention

• First-party analytics events: up to 90 days.
• Legacy click events: up to 90 days.
• Marketing delivery logs: up to 30 days.
• Consent receipts: up to 395 days for audit and renewal.
• Account, content, and fan-subscription data: until account/list deletion or another documented service requirement.
• Contact-form name, email, optional subject, and message: stored until the workspace is deleted. A timed purge is not implemented.

Retention of analytics, click, delivery, and consent-receipt data is enforced by an authenticated, bounded purge job. Account deletion continues to cascade through workspace-owned records, including contact-form messages.

Service providers and transfers

duu.to uses self-hosted Supabase services for authentication, PostgreSQL, and object storage; a self-hosted Redis instance on the same infrastructure for short-lived rate-limit keys; Sentry for scrubbed server/edge errors when enabled; and Resend to deliver account emails (sign-in links and, for artists who keep them on, a notice that a contact message arrived). Those notices contain no part of the message or the sender's details. Resend also delivers release-day emails on an artist's behalf to fans who asked for them (by pre-saving with that option, tapping “Notify me”, or joining the artist's list): it receives the fan's email address and records delivery, open, bounce and complaint events. Each email carries a one-click unsubscribe, which we honour for that artist's future release emails. Approved marketing integrations (Meta, TikTok, Google Analytics, or Google Ads) receive data only after consent and have their own terms and privacy notices. Platform destinations such as Spotify or Apple Music process visits under their own policies.

Embedded players

Artist pages can offer Spotify, Apple Music, and YouTube players. Nothing is loaded from those services when a page opens. A player loads only after you select Play here; from then on that service receives your visit (including your IP address and browser details), may set its own cookies, and handles that data under its own privacy policy. YouTube players use the privacy-enhanced youtube-nocookie.com domain. You can always use the “Open on” link instead to listen on the service directly.

Your requests

Account owners can delete their account from Dashboard Settings. Fan subscribers can use the unsubscribe link supplied by the list owner. For a privacy question or a deletion request, contact [email protected].

Contact

Privacy policy and provider-review questions: [email protected].