Privacy policy

Google sign-in information

If you choose Google sign-in, Supabase authentication processes your account identifier, email address, and basic profile such as your name and profile picture when Google provides them. We use this information to create your account, maintain sign-in and connect your workspace. You do not give duyat your Google password.

The requested permissions are the basic sign-in scopes openid, email and profile. Google sign-in alone does not read your Gmail inbox or send email. Any future mailbox connection will explain its permissions and data use separately.

Work data you enter

We store information you enter, including projects, recipient names, emails and companies, notes, sent-message records, reply and follow-up status, templates and their versions. Only enter information you are authorized to use. Storage and synchronization are linked to your signed-in workspace.

Service operation uses session cookies and browser storage for preferences, work caches and analytics consent. Infrastructure services such as Vercel and Supabase may process request IP addresses, browser and connection information, and error or security logs.

Purposes and service providers

Data supports sign-in, storing and synchronizing work, template editing, usage limits, troubleshooting and support. Google sign-in data is used for account functionality, not sold or used for personalized advertising.

Vercel provides web hosting and request processing; Supabase provides authentication and the database. The current work database region is Seoul, South Korea. This does not mean all authentication, hosting, logs or backups are processed only in Seoul. External providers may process some information outside your country.

Optional AI copy suggestions

You can edit and save templates without AI. Only when a signed-in user requests an AI suggestion are the selected language and that template's submitted title, body and button label sent to OpenRouter and the model provider handling the request. We do not import your inbox or automatically attach your Google profile to the AI request.

Requests use a routing setting that denies provider data collection. This is not a guarantee of zero retention across every external service. Avoid secrets and unnecessary personal information, and review suggestions before applying them. Account-linked request usage records support daily limits.

Optional usage analytics

If you allow usage analytics on the public landing page, Google Tag Manager and Google Analytics 4 process visit and device information and events such as starting a demo. Analytics tags are not newly loaded in signed-in workspaces, demos or this policy page. Google receives technical connection information when processing analytics requests.

You can use the service after refusing analytics. Change your choice using the landing page's analytics controls, and manage cookies or site data in your browser. Necessary sign-in sessions are separate from optional analytics.

Retention and deletion

Account and work data is retained until deletion is requested or data is otherwise removed during service operation. The beta does not offer a fixed automatic expiration period or promise immediate permanent deletion. Archiving and version history are not deletion, and previous content can remain in records.

Request account or work-data deletion using the contact email below. We verify account ownership and the request's scope before explaining the action taken. Backups and security logs may remain subject to provider retention procedures or necessary preservation reasons. Revoking duyat in your Google account does not itself delete work data already stored.

Resetting the demo resets browser-based trial state. It is not cloud account deletion. Development and test reset APIs are not offered as an account-deletion mechanism.

Your choices and contact

You can view and edit work in the service. Contact us to request access, correction, a copy or deletion of account data, or ask about processing. We may ask for proportionate identity verification to avoid disclosing or deleting another person's data.

duyat uses HTTPS and account-specific access controls. No online service can eliminate every security risk. Use the same contact to report suspected access or data issues.

Policy changes

When processing features or services change, this page and its update date will change. Features requiring new permissions or a different use of data will explain that use in context. The current beta privacy contact is the email below.