Privacy policy

This policy describes how dupy handles information on dupy.app, in the dupy workspace at studio.dupy.app and through dupy's MCP connection. You can sign up with a Google account or an email and password and create a workspace without an invitation. Invitations let other people join an existing workspace; they are not required to create your own.

Who handles your information

dupy is operated by 디스틸, a business in South Korea (business registration 271-04-03553). The representative and privacy officer is 박성일. Contact details are at the end of this policy.

What we collect and how we use it

Sign-in and access

• Email sign-in. We store your email address and a salted password hash, never the original password. Email signup creates a separate workspace and does not automatically link Google accounts or existing invitations.
• Google sign-in. When you sign in, Google sends us a signed token. We verify it to sign you in and associate your account with the workspaces you create or join. Google may show your name and profile photo on its sign-in screen, but dupy does not store them. dupy never receives your Google password.
• Session cookie. After sign-in we set one signed, HttpOnly cookie that contains your email address and expires after 24 hours or when you sign out.
• Workspaces and membership. We store the workspaces you create or join, your membership and role, and invitation records. Content you create belongs to its workspace and can be shared with its members. Leaving a workspace does not automatically delete content other members use.
• MCP connections. If you connect an AI client to dupy over MCP, we store the client's name and redirect addresses, and hashed authorization codes and tokens linked to your email address. Codes expire after 5 minutes, access tokens after 1 hour and refresh tokens after 30 days.

Instagram and Threads profile connections

If you explicitly connect an Instagram or Threads profile, we store its identifier, username, granted permissions and encrypted access token to operate the connection. When you open your own posts, we retrieve the text, media links, publication times, original links, available insights, comments and Instagram conversations from the authorised profile. Only the individual who connected that profile can view this feed in dupy; membership in the same workspace does not give another person access. This viewer does not store post contents or media in the dupy database or send them to generative AI services. You can disconnect in account settings to delete the stored credential and stop further reads, or revoke dupy's access through the platform’s permissions settings. Disconnecting does not delete already published posts.

Publishing, replies and Instagram automated responses

Publishing and scheduling use the caption, media, profile and time you confirm. Comment replies and Instagram DM replies require your final confirmation. Automated DM rules start inactive: you explicitly activate a reply for a keyword on a selected own post or for an incoming DM keyword. Replies disclose that they are automated. A comment private reply is sent at most once within seven days of the comment; a DM response is sent within 24 hours of the recipient’s latest message. Incoming message bodies are not saved or sent to generative AI. We encrypt outgoing templates and queued reply data, remove queued payloads after processing, and retain delivery receipts and manual-send deduplication records for 30 days. You can stop a rule; disconnect deletes the profile’s rules and pending events. Captions, schedules and publication history are kept until your deletion request or service closure. AI caption writing uses the brief you enter, without fetched private comments or DMs.

YouTube channel connections

If you choose to connect YouTube, dupy uses YouTube API Services to read the channel you authorise and upload completed videos to it. We store your channel ID and name, an encrypted refresh token, your upload settings, and upload records including video IDs and visibility. We request upload and read-only permissions; we do not receive your Google password. YouTube connection and upload API records are removed after 30 days without a refresh or sooner when you disconnect. A daily maintenance task enforces this limit. Your connected YouTube data is used to operate these features and is not used to train general-purpose AI models.

Finishing a video does not upload it. You review the completed video, title, description, channel, visibility, audience, altered-content declaration and any publication time, then explicitly request an upload. You can disconnect YouTube in channel settings or revoke all permissions through Google Account connections. Disconnecting deletes the stored channel details, refresh token, upload-session credentials and upload records, and cancels pending uploads. It does not delete videos already uploaded to YouTube. You can request deletion of remaining upload records using the contact details below.

dupy's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. YouTube also processes uploaded videos under the Google Privacy Policy.

TikTok account connections

If you choose to connect TikTok, dupy uses TikTok Login Kit, the Content Posting API and the Display API with the permissions you grant. We store your TikTok open ID, display name and avatar, the permissions you granted, encrypted access and refresh tokens, and records of the posts and drafts you send, including their status and TikTok post IDs. Your follower, following, like and video counts and your public videos with their view, like, comment and share counts are fetched from TikTok when you open them and are not stored. We do not receive your TikTok password.

A video is sent to TikTok only after you review it and select Post to TikTok or Send to TikTok as draft. Direct Post sends the caption, audience, interaction, content disclosure and AI-generated label settings you choose in Dupy. Sending a draft transfers the video to your TikTok inbox; you finish editing and choose posting settings in the TikTok app. TikTok downloads the video from a temporary studio.dupy.app address that expires within 75 minutes. Disconnecting deletes stored tokens and post records and requests TikTok to revoke access. If revocation cannot be confirmed, we tell you to remove Dupy from your connected apps in TikTok. It does not delete videos already on TikTok. TikTok processes posted content under the TikTok Privacy Policy.

Content you create in the workspace

• Projects, topics, search keywords, themes, followed channels, review decisions and saved references.
• Studio workflows, productions, scripts, edits and the video, image, voice and music files generated for them.
• Personas and the media you attach to them, such as names, descriptions, face or style images and voice samples, and files you upload to the media library. Only upload images or voices of people who have agreed to that use.

We use this content to run the features you ask for: finding and analysing videos, and producing and rendering new ones.

Ask dupy conversations

Ask dupy saves your conversations in the workspace database, linked to your email address, so you can reopen them from any browser. A saved conversation includes your messages, the images you attach, the assistant's replies, the tools it ran with their results, and the project and topic you were viewing. Large images are reduced in size before they are sent and saved. Other members of the workspace cannot see your conversations in dupy.

When you send a message, the conversation so far and the relevant workspace context pass through our server to an AI model provider (via OpenCode Go) to produce the reply. We use saved conversations to show you your history, and we look at them only when you ask for help, to investigate abuse or a security problem, or when the law requires it. You can delete a conversation from the chat list at any time, which removes it from the database.

Public short-form content we collect

To show what is performing in a topic, dupy collects publicly available information from TikTok, Instagram and YouTube through data providers (TikHub and the YouTube Data API). This includes video links, captions and hashtags, public view and engagement counts over time, creator handles and channel names, public channel statistics and music details. For permitted non-YouTube videos selected for analysis we keep a private copy of the video, audio, captions and cover image, and produce a transcript and a structural analysis. New YouTube reference downloads are disabled; use original source footage you are authorised to upload. This content can include creators' names, faces and voices. We process it to research formats and trends. We do not use it to identify or contact creators. Creators can ask us to remove their content from dupy using the contact details below.

Subscriptions and billing

Card payments are processed by Toss Payments, which processes the purchaser's name, contact details and payment information. Dupy keeps order identifiers, the service account email, plan, amount, payment and refund status, and monthly credit records to supply the purchased service. Dupy does not store full card numbers or security codes.

Records of contracts, withdrawal, payment and service supply are retained for five years, consumer complaints and dispute records for three years, and advertising records for six months where required by Korean law. These records are kept separately and used only for the required purpose.

Technical information

Our hosting and security providers process IP addresses, request times, requested addresses, browser information and response codes to deliver and protect the service.

Browser storage

Besides the session cookie, dupy stores a few settings in your browser: your interface language, the last topic you opened, a cached copy of the dashboard for faster loading and which Ask dupy conversation you had open. dupy does not use advertising or analytics cookies.

Support

If you email us, we receive your email address and the contents of your message.

How long we keep it

• Session cookies: 24 hours. MCP codes and tokens: until they expire as described above.
• Account information: until account deletion is processed. Workspace membership: while you remain a member. Legally required records may be retained separately.
• Ask dupy conversations: until you delete them, until you ask us to delete them, or until the service ends.
• Workspace content, collected content and generated files: until they are deleted in the workspace, until you ask us to delete them, or until the service ends.
• Support emails: as long as needed to resolve your request.
• Where Korean law requires us to keep a record for a set period, we keep it for that period only.

When information is no longer needed, we delete electronic files so they cannot be restored.

Who processes it for us

We do not sell personal information and do not share it with third parties for their own purposes. We use the service providers below to run dupy. They process information on our instructions.

Transfers outside South Korea

Using dupy transfers information to the providers above in the USA and Japan over encrypted network connections, at the time you use each feature. The items transferred are the ones described for each provider: your email address and sign-in tokens, workspace content, messages and uploads you send for processing, collected content and request logs. They are kept for the periods in this policy. You can avoid a transfer by not using the feature that requires it, for example Ask dupy or a Studio step. Because sign-in and hosting need these providers, you cannot use dupy without the transfer to Vercel and Google.

Your rights

You can ask to access, correct, delete or stop the processing of your personal information, and ask for a copy. Email us from the address you use with dupy and we will answer within 10 days. If we cannot fully meet a request, for example because the law requires us to keep a record, we will explain why. Team members can also ask the workspace owner to remove their access.

How we protect it

• All connections use HTTPS. Session cookies are signed, HttpOnly and limited to our own site.
• MCP authorization codes and tokens are stored only as hashes.
• Collected media and uploads are kept in a private storage bucket. Service accounts get only the access they need, and API keys are kept in a secrets manager.
• Sign-in requires an authenticated Google or email account. Access to an existing workspace is checked against your membership and role.

Children

dupy is a tool for businesses and creators and is not intended for anyone under 14. We do not knowingly collect information from children.

Changes

We will update this policy when dupy changes how it handles information and will show the new effective date here. For material changes we will also tell users in the workspace before the change applies.

Contact and privacy officer

Privacy officer: 박성일.

• Email: help@dupy.app
• Phone: 070-8065-1516
• Postal address: 디스틸, 서울특별시 강남구 테헤란로20길 18, 2층 8호(역삼동, 부봉빌딩)

If you are in South Korea and need further help, you can also contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118) or the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972).