Privacy Policy

Last updated: November 1, 2026

This policy explains how Duwata (“Duwata”, “we”, “us”) handles personal data when you use the Duwata mobile app and the duwata.app website. We process personal data in line with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and issuances of the National Privacy Commission (NPC).

1. Who we are

Duwata is the personal information controller for the data described here. You can reach us, including our Data Protection Officer, at support@duwata.app.

2. Data we collect

Account data: your email address and, if you sign in with Google or Apple, the name and profile photo that provider shares with us. You can replace your photo in the app.
Profile data: your city and the sports and skill details you choose to add.
Location (optional): see Location. We don't store your GPS coordinates on our servers.
Bookings and games: booking requests, open-play games you post or join, and related times and venues.
Community and chat content: posts, messages, reactions, photos and videos you share in communities and chats, and the communities you join.
Venue claims and removal requests: the name, contact email and/or phone, and message you submit when you claim a venue or ask us to remove one.
Support requests: what you send us by email.
Launch list (website): your email address if you ask to be notified at launch.
Technical data: device and app version, and server logs (such as IP address and timestamps) kept by our hosting providers for security and reliability.

We don't sell personal data, and we don't use it for third-party advertising.

3. How we use it and our legal basis

Purpose	Legal basis (RA 10173)
Create and run your account, sign-in, and profile	Necessary to provide the service you asked for (contract)
Show venues near your city, handle bookings and open play	Contract
Communities and chat	Contract
Review venue claims and removal requests and contact the requester	Legitimate interests in accurate listings; contract with the requester
Safety, moderation, fraud and abuse prevention, security	Legitimate interests; legal obligations
Launch emails	Consent, which you can withdraw at any time
Comply with law and respond to lawful requests	Legal obligation

4. Location

If you tap “Use my location”, the app asks your device for its location, uses it on your device to suggest your city, and asks you to confirm before saving anything. Only the city you confirm is saved to your profile. We don't save raw GPS coordinates on our servers. You can turn off location access in your device settings at any time and pick your city by hand instead.

We share personal data only as needed to run Duwata:

Service providers (processors) that act on our instructions under contract: Supabase (database, authentication, file storage), Vercel (website and API hosting), Expo (app delivery and over-the-air updates), and Google and Apple sign-in (authentication, only if you choose them).
Other users: your display name, photo, and the content you post are visible to members of the communities and chats you join. Claimant contact details are never shown to other users; only Duwata admins see them.
Venues: when you book a claimed venue in the app, the venue sees the booking details needed to honor it. For unclaimed venues, you book on the venue's own page, and their own privacy terms apply.
Legal reasons: when required by law, or to protect the rights, safety and security of users and the public.

6. International transfers

Our processors may store or process data outside the Philippines (for example in Singapore, the United States or other regions where they operate). When that happens, we rely on contracts and safeguards that provide protection comparable to RA 10173, and we remain accountable for your data.

7. Retention

Account, profile, booking, community and chat data: while your account is active. When you delete your account, we delete it as described on our account deletion page.
Venue claim and removal requests: up to 2 years after we decide on the request, to keep a record of listing changes.
Launch list emails: until launch or until you ask us to remove yours.
Server and security logs: kept for limited periods by our hosting providers, typically up to 90 days.
Data we must keep to meet a legal obligation or resolve a dispute: only as long as needed for that purpose.

8. Your rights

Under RA 10173 you have the right to be informed, to access, to object, to erasure or blocking, to rectification, to data portability, to withdraw consent, and to claim damages. To use these rights, email support@duwata.app from your account email. We'll respond within a reasonable time and may need to confirm your identity. You can also file a complaint with the National Privacy Commission (privacy.gov.ph).

9. Children

Duwata is not meant for children under 13, and we don't knowingly collect their data. Users under 18 should use Duwata with a parent's or guardian's permission. If you believe a child has given us data, email support@duwata.app and we'll delete it.

10. Security

We use encryption in transit (HTTPS), access controls including database row-level security, limited admin access, and reputable providers. No system is perfectly secure. If a breach affecting your data occurs, we'll notify you and the NPC as required by law.

11. Changes to this policy

We'll post updates here and change the “Last updated” date. For material changes, we'll also notify you in the app or by email.

12. Contact and Data Protection Officer

Data Protection Officer, Duwata: support@duwata.app