Privacy Policy

Effective 17 October 2026 · Applies to the DuoTutor app (com.tarikdavulcu.duotutor), its Apple Watch app and widgets, and this website.

1. Summary

DuoTutor does not collect, transmit, sell or share personal data. The app has no servers, accounts, analytics, advertising or third-party SDKs. Everything you create stays on your device.

2. Data controller

Tarik Davulcu, the developer, is the controller under the GDPR (EU 2016/679) and the UK GDPR. Because no personal data reaches the developer, there is no processing by the developer.

3. Data stored on your device

• Study progress, review history and scores are stored locally with Apple SwiftData. iCloud sync is disabled.
• Student names and notes (Teacher Pack) are encrypted with AES-256-GCM (CryptoKit). The key is kept in your device's Keychain and is not synced.
• A free-trial counter is kept in the Keychain so the 3 free sessions are not reset by reinstalling.

4. Microphone & speech recognition

Pronunciation grading uses Apple's Speech framework with on-device recognition required. Audio is processed in memory and is not recorded to disk or sent anywhere. If your language has no on-device model, grading is turned off rather than falling back to a server.

5. Apple Watch, widgets & Live Activities

The Watch remote talks to your iPhone only through Apple's WatchConnectivity link between your paired devices. Widgets read the daily word from a shared container on your device. Live Activities are started locally, without push tokens.

6. Purchases

Apple processes all payments through the App Store. The developer does not receive your payment details or identity. Apple's privacy policy applies to those transactions.

7. Your rights (GDPR Art. 15–22)

Your data is never in the developer's possession, so you can exercise access, rectification, erasure and portability directly in the app: export PDF reports, delete students, or delete the app to erase all data. For questions, use the support contact on the App Store listing.

8. This website

This site sets no cookies and runs no tracking scripts. Fonts and Bootstrap are loaded from public CDNs (Google Fonts, jsDelivr), which receive your IP address as part of a normal web request. Self-host them to avoid this.

9. Children

DuoTutor collects no data from anyone, including children, and is suitable for classroom use under COPPA and GDPR-K.

10. Changes

Any changes will be posted here with a new effective date.