Privacy Policy

What we collect

duu.to collects only the data necessary to operate the service:

• Email address — used solely for account authentication via magic link. We do not sell or share your email with third parties.
• Click events — when a fan clicks a platform link on a campaign page, we record the platform name, referrer hostname, country (derived from IP at time of click), and timestamp. We do not store IP addresses, full user-agent strings, or any personally identifiable information.
• Fan capture submissions— when a visitor signs up through an artist hub or campaign capture form, we store the email address, optional name, the source page URL, the consent text they agreed to, the timestamp of consent, and a country code derived from the visitor's IP. We also store a one-way hash of the visitor's IP address and a length-capped user-agent string to detect duplicate or abusive submissions. The raw IP is not stored.
• Artwork and content — files you upload are stored in Supabase Storage and served only through your campaign pages.

How we use your data

Your email is used for authentication. Click event data is aggregated and displayed in your campaign analytics dashboard so you can understand how fans interact with your links. Artwork is displayed on your public campaign pages.

Fan capture submissions are stored so the artist can export the list (as CSV) and contact subscribers about future releases. Each subscriber is given a unique unsubscribe token. Artists can also delete any subscriber from their dashboard at any time.

How long we keep it

Account data persists until you delete your account. Click events are retained indefinitely but contain no personally identifiable information. If you delete your account, all associated data — campaigns, click events, and uploaded files — are permanently removed.

How to delete your data

You can delete your account at any time from Dashboard Settings. This permanently removes your profile, all campaigns, click events, and uploaded files. This action cannot be undone.

Subscribers captured through fan forms can be deleted by the artist from the Fans dashboard at any time, or by the subscriber themselves using the unique unsubscribe link included with every list export.

You may also request deletion by emailing privacy@duu.to.

Third-party services

We use Supabase (self-hosted) for database, authentication, and file storage. Supabase does not have access to your data beyond what is necessary to operate the infrastructure. Platform links redirect to third-party services (Spotify, Apple Music, etc.) — those services have their own privacy policies.

Cookies

duu.to uses only essential session cookies for authentication. We do not use tracking cookies, analytics cookies, or any third-party tracking scripts.

Contact

For privacy-related questions, contact privacy@duu.to.