Privacy Policy

1. Who we are (Data Controller)

DUVOX is operated by Houssam Kharbouchi, an independent developer based in France.

For any privacy-related questions or requests, contact us at:
Email: privacy@duvox.app
Address: France (full address provided upon request to the above email)

2. What data we collect

We collect only the minimum data necessary to operate the service.

• Waitlist registration: Your email address, and the date/time you registered.
• App usage (when launched): Votes cast (anonymous, not linked to identity), debate participation (anonymous), country/region (derived from IP, not stored as IP), app language and timezone.
• Technical data: IP address (used only for geo-region detection, not stored beyond the request), browser/device type (for analytics only, anonymised).
• Communications: If you contact us by email, the content of that correspondence.

We do not collect: names, phone numbers, social media handles, payment information (at this stage), precise GPS location, or any special category data (health, religion, politics, etc.).

3. Why we collect it (Legal basis)

• Waitlist email — Your consent (Article 6(1)(a) GDPR). You may withdraw at any time.
• Service operation — Performance of a contract / legitimate interest (Article 6(1)(b) and (f) GDPR).
• Security and fraud prevention — Legitimate interest (Article 6(1)(f) GDPR).
• Legal compliance — Legal obligation (Article 6(1)(c) GDPR) where applicable.

4. How we use your data

• To notify you when DUVOX launches (waitlist email only).
• To send infrequent pre-launch updates — maximum one per month, only if you signed up for the waitlist.
• To understand aggregate usage patterns and improve the product (anonymised analytics only).
• To respond to your support or privacy requests.

We will never sell your data. We will never use your email for third-party advertising.

5. Who we share your data with

We minimise third-party data sharing. Where we use third-party processors, they are contractually bound to process data only on our instructions and in compliance with the GDPR.

• Hosting provider (IONOS / 1&1): Our server infrastructure, located in the EU. Their privacy policy →
• Email delivery (optional, TBD): A transactional email provider (e.g. Brevo/Sendinblue or Resend) for sending launch notifications. We will update this policy when a provider is selected.

We do not share your data with analytics companies, advertising networks, data brokers, or social media platforms.

6. Data retention

• Waitlist emails: Retained until DUVOX launches and you receive your first notification, or until you unsubscribe — whichever comes first. After the launch window (90 days post-launch), waitlist-only emails are purged.
• App account data (when launched): Retained for the duration of your account, plus 30 days after deletion.
• Server logs: 30 days maximum, then automatically deleted.
• Anonymised analytics: Retained indefinitely (no personal data).

7. Your rights (GDPR)

If you are in the EU/EEA, you have the following rights:

• Right of access — Request a copy of the data we hold about you.
• Right of rectification — Ask us to correct inaccurate data.
• Right of erasure — Ask us to delete your data ("right to be forgotten").
• Right to restriction — Ask us to pause processing your data.
• Right to data portability — Receive your data in a machine-readable format.
• Right to object — Object to processing based on legitimate interest.
• Right to withdraw consent — Withdraw consent at any time (e.g. unsubscribe from the waitlist). This does not affect the lawfulness of processing before withdrawal.

To exercise any of these rights, email privacy@duvox.app. We will respond within 30 days. Identity verification may be required.

You also have the right to lodge a complaint with the French data protection authority: CNIL — Commission Nationale de l'Informatique et des Libertés.

8. Cookies and tracking

The DUVOX waitlist page uses no third-party cookies and no tracking pixels. We do not use Google Analytics, Facebook Pixel, or any similar tools on this site.

When the full app launches, we will use a minimal, privacy-first analytics solution (self-hosted or cookie-free) and update this policy accordingly.

9. Security

Your data is stored on servers within the European Union. Access is restricted to authorised personnel only. Email addresses are stored in an encrypted database. We use HTTPS (TLS 1.3) for all data in transit.

No system is 100% secure. In the unlikely event of a data breach affecting your rights and freedoms, we will notify you and the CNIL within 72 hours as required by the GDPR.

10. International transfers

Your data is processed and stored within the EU. We do not transfer personal data outside the EEA unless covered by an adequacy decision or appropriate safeguards under Article 46 GDPR.

11. Children's privacy

DUVOX is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, contact us at privacy@duvox.app and we will delete it immediately.

12. Changes to this policy

We may update this policy as the product evolves. Significant changes will be communicated by email to waitlist subscribers. The "last updated" date at the top of this page always reflects the current version. We recommend reviewing this page periodically.