Privacy Policy

1. Who we are and scope

Dunori Labs is responsible for the personal data processed through Dunori ID, our Apps (including Unnote, Focuse and Nuntius), our websites and our Cloud Services (together, the “Services”). Terms used here have the same meaning as in our Terms of Service.

This policy applies to all Services. An App may give more privacy details in the App or its store listing. Those details add to this policy.

2. Local-first by default

Data you create with offline features, such as notes, timers, tasks, settings and images handled by on-device features like OCR, is stored and processed on your device. We cannot see it. It leaves your device only if you turn on a Cloud Service, export or share it, or send it to us, for example in a bug report.

3. Data we collect

Depending on which Services you use, we collect:

• Account data: email address, tagname, display name, avatar, a hashed password (never the password itself), and preferences such as theme and language
• Sign-in and security data: linked sign-in methods (Google, X), passkey public keys, two-factor settings, and which version of our Terms you accepted and when; if you sign in with Google or X, we receive basic profile details from them, such as your name, email and picture
• Device and session data: IP address, browser and operating system, sign-in times and active sessions, used to show your devices and protect your account
• Cloud content: data you choose to store or sync with Cloud Services, such as notes, tasks, focus sessions, statistics and attachments, plus the metadata needed to sync them, such as timestamps and deleted status
• Purchase data: your plans and purchases, their status and billing period, the store used, and transaction identifiers; card details are handled by Paddle, Apple or Google, and we never receive full card numbers
• Feedback and support: messages, screenshots and attachments you send us
• Diagnostics: crash reports and error details, such as stack traces, App version and device model, when error reporting is on
• Usage analytics: in some Apps, events such as screens opened, features used and session counts, plus device and App details, to understand how the App is used
• Ads data: in free Apps that show ads, our ad partners may collect your device’s advertising ID, IP address and ad interactions
• Notification tokens: if you allow push notifications, a device token so we can deliver them

4. Device permissions

Some features ask for device permissions, such as notifications, exact alarms, app usage access (for example, Focuse’s Focus Shield, which detects distracting apps during a session), camera or files. Data accessed through these permissions is processed on your device for that feature only and is not sent to us, unless the App clearly tells you otherwise. You can revoke permissions at any time in your device settings.

5. Third-party accounts inside our Apps

Some Apps work as clients for other platforms. For example, Nuntius lets you use Messenger and Locket accounts. In these Apps:

• You sign in directly with the platform; your passwords go to the platform, not to Dunori Labs
• Session cookies and sign-in tokens are kept only on your device, in the App’s browser profile or the Windows credential vault
• Your messages, contacts and media are exchanged directly between your device and the platform, and are not sent to our servers
• Any local cache of that data is stored on your device, encrypted where the App says so, and deleted when you remove the account or turn the feature off
• The platform’s own privacy policy applies to the data it processes

6. How we use data

We do not sell your personal data. We do not use Your Content (your notes, messages, files and similar content) for advertising or to train artificial intelligence models. We use data to:

• Create and secure your account, sign you in, and detect suspicious activity and abuse
• Provide Cloud Services: store, sync and restore your content across devices
• Process purchases and determine which Apps and features you can use
• Send service emails, such as verification codes, password resets, security alerts and important changes to our Terms; we do not send marketing emails without your consent
• Respond to feedback and support requests
• Diagnose crashes, measure usage and improve the reliability and design of the Services
• Show and measure ads in free Apps
• Meet legal obligations and enforce our Terms

7. Legal bases

Where the law requires a legal basis, we rely on: performing our contract with you (providing the Services you ask for); our legitimate interests (keeping the Services secure, fixing problems and improving them, in a way that respects your rights); your consent (for example, personalized ads or optional analytics where consent is required, which you can withdraw at any time); and legal obligations (such as tax and accounting records).

8. Who can access your cloud content

Cloud content is encrypted in transit and at rest by our infrastructure providers. It is not end-to-end encrypted, which means our systems process it in order to sync it. Access controls in our database ensure each user can reach only their own data.

Dunori Labs staff do not look at Your Content except when you ask us to (for example, to help with a problem), when we need to investigate a security incident or abuse, or when the law requires it. Access is limited to authorized people.

9. Service providers

We share data only with providers that help us run the Services, and only what they need for their task:

• Supabase: database, sign-in and file storage behind Dunori ID and Dunori Cloud
• Google Firebase: sign-in, database sync, analytics, crash reporting, push notifications and remote settings in some Apps
• Paddle: checkout on our websites and in Windows Apps; merchant of record for payments, taxes and invoices
• RevenueCat: keeps subscription status consistent across Paddle, the App Store and Google Play
• Apple, Google and Microsoft: app distribution, in-app purchases and license checks on their platforms
• Google and X: only if you choose to sign in with them
• Google AdMob: ads in free Apps
• Resend: delivery of account and security emails
• Sentry: crash and error diagnostics
• Hosting and infrastructure providers that run our websites

10. Other disclosures

We may disclose data if the law requires it, to protect the rights, property or safety of users, the public or Dunori Labs, or as part of a merger, acquisition or sale of assets. In that last case, this policy continues to protect your data, and we will tell you before it becomes subject to a different policy.

11. International transfers

Our providers may process data in countries other than yours, including the United States and countries in the European Union and Asia. Where the law requires it, we use appropriate safeguards for these transfers, such as standard contractual clauses.

12. How long we keep data

• Account data: as long as your Dunori ID exists
• Cloud content: until you delete it or delete your account; some Apps keep deleted items in a trash or recycle bin for a short time so you can restore them
• When you delete your Dunori ID, we immediately remove your profile, cloud content, avatar and related records from our live systems; leftover copies in backups are removed when those backups expire
• Purchase records: as long as tax, accounting and other laws require, which can be after your account is deleted; payment providers keep their own records
• Diagnostics, analytics and email delivery logs: for the limited periods set in each provider’s configuration
• Feedback: as long as needed to handle it and improve the Services

13. Security

We use encryption in transit, hashed passwords, per-user access controls, and optional two-factor authentication and passkeys. No system is completely secure, so please protect your devices and sign-in methods too. If a breach affects your personal data, we will notify you and the authorities as the law requires.

14. Your choices

You can control your data directly in the Services:

• Edit your profile in Account settings, and manage sign-in methods, passkeys, two-factor and active sessions in Security settings
• Turn Cloud Services on or off per App, delete individual cloud items, or delete your whole account
• Export your content from the Apps
• Turn off error reporting, analytics or personalized ads in App settings where offered, or reset your advertising ID in your device settings
• Turn off notifications and other device permissions in your device settings

15. Your legal rights

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to restrict or object to processing, and to withdraw consent. To make a request, email us at the address below. We may need to verify your identity, and we will respond within the time the law requires. You can also complain to your local data protection authority.

16. Cookies on our websites

Our websites use essential cookies and local storage to keep you signed in, remember your language and theme, and protect against abuse. We do not use advertising or cross-site tracking cookies on our websites. Paddle may set cookies needed to complete a checkout when you open one.

17. Children

The Services are not directed to children under 13, or under the higher minimum age set in their country. We do not knowingly collect personal data from them. If you think a child has given us personal data, contact us and we will delete it.

18. Changes to this policy

We may update this policy from time to time. The effective date at the top always shows the current version. If a change is significant, we will tell you through the Services or by email before it takes effect.

19. Contact

Privacy questions and data requests: support@dunorilabs.com

Business and company inquiries: contact@dunorilabs.com