DUO SPACE
Privacy
How Duo Space handles accounts, shared spaces, and photos.
Updated November 1, 2026Invitations and space status records
The invitation link and QR code contain the same private invitation credential; do not share it publicly. The invitation page reads only availability and expiry, without showing member names, photos or text. Membership changes only after an explicit in-app confirmation. To handle leaving, mutual dissolution and recovery, the server stores member authorization, consent records, recovery deadlines and cleanup status. Admins can review status and deadlines and retry failed cleanup, but cannot consent for members or shorten the seven-day recovery period. An archive is read-only for its remaining member. Closed space content is unavailable to members during the recovery period.
Today Together, calendars and Live Activities
When you use Today Together, arrival status, a manual ETA, food choices, feelings and needs, checklists and shared plans that you deliberately submit are shared with current space members. Duo Space does not continuously track location or automatically upload your system calendar; only events you explicitly select are shared. A route search you start sends your chosen origin and destination to Apple Maps; Duo Space receives only the ETA you choose to share. Short-lived statuses stop displaying and sending reminders at expiry; online records are cleaned up approximately seven days later. Other non-repeating records are cleaned up after 30 days without updates once their event has passed; enabled repeat templates remain until stopped. Idempotency and delivery records are retained for up to seven days. Live Activity tokens are used only to update and end that activity, with a maximum eight-hour activity period. Signing out, removing a device or leaving a space stops updates and schedules the activity to end. Watch actions use the same account and space permissions and do not collect additional health information. The admin interface shows operational counts and delivery state, not a browser for private statuses.
Life tools and private drafts
We store the records you choose to create, including shared topics, votes, trips, meal choices and expense splits. Expense records do not initiate payments or access bank accounts. Unpublished daily notes and surprise drafts are author-only until shared or their chosen reveal time. Local drafts are scoped to your account and space. Recoverable content and revision history are kept for 30 days unless removed through account or space cleanup.
Voice, short video and drawings
Microphone access is requested only when you start a recording. You select any video or photo before uploading it. Voice recordings are limited to 60 seconds and 8 MB, videos to 30 seconds and 32 MB, and drawings to 2 MB. Private attachments use the same Hong Kong gateway and Firebase storage as the space, count toward its capacity, and are accessible only under the space access rules. Flagged attachments may be reviewed to resolve a report; access and decisions are logged.
Selected calendars and temporary location
Reading system calendars requires your permission. Free-time sharing sends only the time windows you select, not event titles, locations or attendees. Calendar-file imports include only the selected titles, notes and dates. Temporary precise location starts only at your request, lasts at most two hours, and may continue in the background only while your session and iOS permissions allow. Stopping is sent when connectivity is available; expired sessions are hidden and then cleared by maintenance. Coordinates are excluded from local persistent drafts, version history and your export. Backup copies, if present, expire under the backup retention policy. Location-session chat, photos and videos are separate from permanent moments. Joining a map does not publish your own location. Session access closes when either joined member ends it or its timer expires; attachments and device caches are then removed automatically, with failed deletions retried. Temporary attachment bytes are excluded from the app’s photo backup job. Infrastructure backups, if present, expire under their retention policy. In-app route requests and opening an external map share the selected coordinates with the chosen map provider.
Profile avatars
A profile photo is optional and is visible to you and members who currently have access to a shared space with you. It belongs to your account rather than a single space. We create smaller display copies and remove photo location metadata. Replacing or removing an avatar stops new access to its old version; interrupted storage cleanup is retried. Permanent account deletion includes the avatar and its display copies. Signing out clears in-app avatar memory. A local-mode profile keeps its selected photo on this device until you remove it.
Saving and sharing media copies
Photos and videos are saved to your photo library or shared with another app only when you choose the corresponding action. Saving requests permission to add photos, not to read the whole library. An exported, shared or saved copy is separate from Duo Space and follows the destination service or device rules. Ending location sharing, deleting the original or deleting your account does not erase those external copies. If you explicitly keep a temporary attachment as a moment or memory, it becomes ordinary space content. App and server cleanup may take time; provider backup copies expire under their own retention rules.
Information we keep
To provide shared spaces, we process account email, display name, space membership, and the photos, text, dates, and activity you choose to save. Email verification requests, website and app feedback, app and iOS versions, and admin actions are stored by our own service.
Storage and providers
The app sends sign-in, sync, photo, and notification-setting requests through our Tencent Cloud server in Hong Kong to the same Firebase project. Firebase Authentication verifies accounts; Firestore and Storage in Hong Kong store shared content and photos. Apple Push Notification service delivers optional alerts, and our email service sends verification messages. Your phone may cache photos; clearing local copies does not remove cloud photos.
Connection and sync diagnostics
To diagnose sign-in, home loading, and photo transfer failures, the app may send anonymous connection events: operation, success or failure, duration, app version, the device's selected country or region, network type, and error category. These events contain no account ID, device identifier, private text, photos, raw URL, or precise location. The country or region comes from device settings, not physical location. The server briefly uses the connection IP to limit requests but does not store it with diagnostic events. Events may wait on the device while offline. The server aggregates them by hour and retains the diagnostic aggregates for up to 30 days.
Diagnostics you choose to submit
The app keeps up to 100 sanitized connection records for 48 hours on the device, separated by account. Only after you explicitly agree and submit are reports linked to your account and uploaded; server copies expire after 7 days. Reports include versions, hardware model, network-stage timings and request identifiers, but no photos, message bodies, raw URLs or credentials. Any explanation you enter is included. Request identifiers may match server timing and status records retained for up to 7 days. iOS may also provide delayed launch, hang and crash summaries; raw stack traces are not uploaded.
Notification status
The app reports when you open a specific notification or acknowledge an announcement, retained for up to 30 days, to distinguish sending from observed actions. A missing report does not mean a message was unread. Turning off system notifications does not disable in-app account and service features.
Optional announcement emails
Emails about new versions and service announcements are off by default. You can opt in from Notification Settings and turn them off there at any time. We send them only to the verified email address of your own Duo Space account, using the email service configured for Duo Space. We store your choice, a hashed mailbox binding and sending status to apply your preferences and avoid duplicate sends. This setting does not change account security emails or support-ticket emails, which have separate purposes and controls. Email-service acceptance does not confirm that you received or read a message.
Account and device security
After sign-in, random installation and separate session identifiers are stored as hashes with the account, hardware model, iOS and app versions, language, system region, time zone, notification authorization, and sign-in and last-active times. These support device management and account security, not advertising tracking, and do not depend on notification authorization. Security-event IP addresses are encrypted, masked by default, and matched against an offline database for approximate region and network information; this is not a physical location. IP addresses and user security events are retained for up to 30 days. Authorized access to a full IP requires a reason and is audited. Administrative action records are retained for up to 365 days, with network fields cleared after 30 days. Device records are removed through account-deletion cleanup.
Trusted administrator devices
Administrators may register a management device using its public keys and signed requests. The App does not save the administrator password. Device credentials are stored in device-only Keychain storage; private signing keys stay on the device. iOS handles Face ID, Touch ID or device-passcode confirmation, and Duo Space receives no biometric data. Administrators can revoke a trusted device. Local management drafts are separated by account, protected by iOS file protection and excluded from cloud backup. They stop being restorable seven days after their last save and are deleted when next accessed. Administrator notifications are separately optional and off by default, with per-device categories and quiet hours. They contain no user message text, photos or account details; opening one still requires administrator access. Delivery records are retained for up to 30 days and describe push-service acceptance, not viewing.
Access
Space content is available to its members. Admins can see account, space, and service data for support; the admin console does not normally show private photos or text. Cloud providers process data as needed to deliver the service.
Content safety and appeals
If content safety checks are enabled, new photos and text you submit are sent to Tencent Cloud content safety services before sharing; the processing region may be outside Hong Kong. Content assessed as clearly unsafe may be blocked; uncertain content is withheld from the other member for review by an authorized administrator. Only flagged content appears in the review console, and viewing flagged text or photos is logged. You can check the status and appeal in the app. Once automatic cleanup is enabled, rejected quarantined photos are deleted from live storage and backups about 22 days after the final decision; cloud soft-delete copies can remain for up to seven more days. Approved quarantine copies are removed after a successful reupload. When the feature is disabled, content is not sent to Tencent Cloud for this check.
Retention and deletion
Request account deletion in Settings > Account & security. A seven-day cancellation period is offered by default; content is kept but ordinary access is paused. Sign in and explicitly cancel before the deadline to retain your account. After the deadline, or if you explicitly choose immediate deletion, irreversible cleanup removes the account, membership and identifiable contributions. The other member retains their content and read-only shared history. Failures are retried and backup copies follow their retention rules.
Contact and updates
Use our help form to request access, correction, or deletion of related information. Changes to this policy will be reflected here with an updated date.