Privacy Policy

Doyoo — Privacy Policy

Effective date: 28 September 2026 Last updated: 28 September 2026

This Privacy Policy explains how the provider of Doyoo ("we", "us", "our") collects, uses, shares and protects personal data when you use the Doyoo mobile application for iOS (the "App") and the related backend services (together, the "Service").

We are the data controller for the personal data described below.

If you do not agree with this Policy, please do not use the App.

1. Summary

• Doyoo is a video challenge app. You can browse and join challenges, create your own challenge (from a template or from scratch) with a task and a deadline, invite friends, record or upload a video as your entry, and talk with the other participants in the challenge's group chat.
• We collect the minimum needed to run the Service: your account identifier, the challenges you create or join, the videos, photos and messages you post, basic device and diagnostic data, and any reports you submit.
• We do not upload or store your address book. Choosing a friend to invite happens inside iOS, on your device (see section 4).
• We do not sell or share your personal data for advertising, we do not run third-party ad networks in the App, and we do not track you across other companies' apps or websites.
• You can delete your account from inside the App at any time.

2. Personal data we collect

2.1 Data you give us

2.2 Data collected automatically

2.3 Permissions the App asks for

We request these iOS permissions only when the related feature is used, and you can change them at any time in iOS Settings → Doyoo. If you decline any of them, the rest of the App continues to work.

• Notifications — to tell you about invitations, new messages in a challenge chat, approaching deadlines and account notices.
• Camera and Microphone — only while you are recording a challenge entry or a video message in the App. We do not access the camera or microphone in the background.
• Photo library — only so you can choose an existing video or photo to post. We use the iOS picker, so we receive only the items you select, never your whole library.
• Contacts — only to let you pick a friend to invite. See section 4.

2.4 Data we do not collect

• We do not collect your address book — see section 4.
• We do not collect precise (GPS) location.
• We do not collect payment card data — the App currently offers no purchases or subscriptions.
• We do not operate video or audio calls in the App, and therefore do not process call content or call records.
• We do not collect health, biometric, genetic, racial or ethnic origin, political, religious, trade-union, or sexual-orientation data, and you should not send such data to us in support requests.
• We do not use advertising identifiers (IDFA), ad networks, or cross-app/cross-site tracking, and we therefore do not ask for App Tracking Transparency permission.

3. Videos, photos and chat — who can see them

This section matters, because it is the part of the App where you share the most.

• Your entry is visible to the challenge. The video or photo you post as your entry, and the messages you send in a challenge's group chat, are shown to the other participants of that challenge. Treat a challenge chat as a group of people, not a private conversation.
• Participants can be people you did not invite. Anyone who can see a challenge and joins it becomes a participant and can see the content posted in it. Do not post anything you would not want every participant to see.
• Other people appear in your content. If you film or photograph someone else, you are responsible for having their agreement — see the Terms and Conditions. We process their image and voice only to display and store the content you posted, on the legal basis in section 6.
• Moderation. Content posted in the App may be reviewed, automatically or by our moderators, so we can detect and remove content that breaks our rules. Content attached to a report is retained under section 9 even if you delete it, so a decision can be reviewed and enforced.
• Sharing outside the App. If you use the iOS share sheet to share a challenge link, the App or service you share it to receives that link and handles it under its own terms and privacy policy, not ours.

4. Inviting friends — how contacts are handled

We never upload, store, scan or copy your address book.

• When you tap Add from Contacts, iOS shows its own contact picker. That picker runs on your device; we do not see your contacts and cannot browse them.
• The contacts you choose are shown to you in the App so you can confirm the invitation. The invitation is then sent from your device through iOS, so your contacts' details are never sent to, or stored on, our servers.
• We do not use your contacts to build a social graph, to suggest people to other users, to send marketing, or for any purpose other than sending the invitation you asked for.
• You can also invite people with a share link instead of granting Contacts access at all.
• Revoking Contacts access in iOS Settings → Doyoo stops the picker from working; nothing has to be deleted on our side, because nothing was stored.

5. How we use personal data

1. To provide the Service — create and maintain your account, authenticate you, create and list challenges, enforce deadlines, upload, transcode, store and play back your entries, deliver group chat messages, and remember your settings.
2. To deliver notifications — send push notifications about invitations, new messages, deadlines and your account.
3. To keep the Service safe — moderate content; detect and prevent spam, fraud, abuse, account takeover and other violations; review reports; apply blocks, suspensions and terminations.
4. To support you — respond to your requests and troubleshoot problems.
5. To maintain and improve the Service — diagnose crashes and errors, measure reliability, and fix defects.
6. To comply with law — meet legal obligations and respond to lawful requests, and to establish, exercise or defend legal claims.

We do not use your videos, photos or messages to train machine-learning models for unrelated purposes, to profile you for advertising, or for automated decision-making that produces legal or similarly significant effects on you. Automated tools used for moderation only flag content for human review; a restriction on your account is confirmed by a person, and you can contest it (section 10).

6. Legal bases (EEA, UK and Switzerland)

Where we rely on legitimate interests, you have the right to object (section 10). You can ask us for our balancing assessment at support@doyoo.live.

7. Who we share personal data with

We do not sell personal data. We share it only as follows:

All service providers act as processors under a written data processing agreement, may process data only on our documented instructions, and must apply appropriate security measures.

8. International transfers

Our providers may process data outside your country, including outside the EEA/UK. Where we transfer personal data from the EEA, UK or Switzerland to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where relevant), combined with a transfer risk assessment and technical measures such as encryption in transit and at rest. You can request a copy of the safeguards at support@doyoo.live.

9. Retention

We keep personal data only as long as necessary for the purposes above. How long that is depends on the type of data and the purpose it was collected for, balanced against our need to remove data that is outdated or no longer used at the earliest reasonable time. Where we must keep data to comply with a legal obligation, to resolve a dispute, to enforce our rules, or to prevent fraud and abuse, we keep it for as long as that purpose requires.

The one fixed period we commit to is account deletion:

Data deleted from our live systems also disappears from backups, which are overwritten on a rolling cycle.

10. Your rights

10.1 Everyone

You can view and change your account data and settings in the App, manage your blocked list in Settings → Privacy → Blocked users, leave a challenge, delete content you posted, control notifications and all permissions in iOS Settings, and delete your account (section 11).

10.2 EEA, UK and Switzerland (GDPR / UK GDPR)

You have the right to: access your data; rectify inaccurate data; erase data ("right to be forgotten"); restrict processing; data portability; object to processing based on legitimate interests, including profiling; and withdraw consent at any time without affecting prior processing.

To exercise a right, write to support@doyoo.live. We respond within one month, extendable by two further months for complex requests. We may ask you to verify your identity. Exercising your rights is free unless a request is manifestly unfounded or excessive.

You may also lodge a complaint with the supervisory authority in the country where you live or work. In the UK, this is the Information Commissioner's Office (ico.org.uk).

10.3 California (CCPA/CPRA)

Notice at collection. In the past 12 months we have collected the categories of personal information listed in section 2, namely: identifiers; customer records; internet or other electronic network activity information; audio, electronic, visual or similar information (the videos, photos and media you post); geolocation only at the coarse, IP-derived level; and inferences are not drawn for profiling. The sources, purposes, retention and recipients are described in sections 2, 5, 7 and 9.

We do not sell personal information and we do not share it for cross-context behavioural advertising, and we have not done so in the past 12 months. We do not sell or share the personal information of minors under 16.

Sensitive personal information. We do not use or disclose sensitive personal information for purposes other than those permitted under CPRA § 7027(m). Content you choose to post may itself be sensitive; we process it only to deliver the Service and to moderate it.

Your California rights: to know/access, to delete, to correct, to opt out of sale/sharing (not applicable — see above), to limit sensitive PI use (not applicable), and to non-discrimination for exercising your rights. Submit a request at support@doyoo.live or delete your account in the App. An authorised agent may submit a request with written permission and proof of identity.

10.4 Other US states

If you live in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana or another state with a comprehensive privacy law, you have broadly equivalent rights to access, correct, delete, obtain a copy of, and opt out of targeted advertising, sale and profiling — we do not engage in any of those three. You may appeal a refused request by replying to our decision; if the appeal is denied you may contact your state Attorney General.

11. Deleting your account

You can delete your account in ≤3 taps: Settings → Account → Delete Account. You will be asked for a reason, then asked to confirm.

• Before you confirm, the App tells you clearly that your account enters a 30-day grace period and is not erased immediately. You can log in during that window to reactivate it; any later login attempt shows the deletion status screen.
• After 30 days your account and associated personal data are permanently deleted, except data we must keep under section 9 (for example, abuse records or legally required records).
• Content you posted in a challenge is removed with your account. Copies that other participants downloaded or re-shared outside the App are outside our control.
• A challenge you created may remain available to its other participants until it expires; the entries and messages you posted in it are removed with your account.
• You may also request deletion, or immediate deletion within the grace period, by writing to support@doyoo.live. We verify the request before acting on it.

12. Security

We apply measures appropriate to the risk, including: encryption in transit (TLS) and encryption at rest; access control on a least-privilege, need-to-know basis with logging; signed, expiring URLs for media access; segregation of production environments; secure development practices and dependency review; and a documented incident response process. Where a personal data breach is likely to result in a risk to your rights, we notify the competent supervisory authority within 72 hours and notify affected users without undue delay where the law requires it.

No system is perfectly secure. Keep your device passcode and your verification codes confidential, and tell us immediately at support@doyoo.live if you suspect unauthorised access.

13. Children

The App is not directed to children. You must be at least 13 years old to use it, or 16 if you are in the European Economic Area, the United Kingdom or another jurisdiction where 16 is the minimum age for consent to information-society services — unless a higher local minimum age applies, in which case that age governs.

We do not knowingly collect personal data from anyone below the applicable age. If we learn that we have, we delete the account and its data promptly. If you believe a child has provided us with personal data, contact support@doyoo.live. You can also report a suspected underage user from inside the App using Report → Underage user.

14. Apple App Store

Our App Store privacy labels describe the same practices as this Policy. Apple processes your App Store download relationship with Apple under Apple's own privacy policy, not this one. We do not receive your Apple ID password or payment details.

15. Changes to this Policy

We may update this Policy. When we do, we change the "Last updated" date above and, for material changes, notify you in the App or by email before the change takes effect. Where a change requires your consent under applicable law, we will ask for it. Continuing to use the App after a change takes effect means you accept the updated Policy.

Previous versions are available on request at support@doyoo.live.

16. Languages

This Policy is published in English and translated into the languages the App supports: Arabic, English, Spanish, Filipino, Portuguese, Russian, Tamil, Telugu, Turkish, Ukrainian and Vietnamese. Translations are provided for your convenience. If a translation and the English version conflict, the English version prevails, except where applicable local law requires otherwise.

17. Contact us

We aim to acknowledge every privacy request within 5 business days and to resolve it within the period required by applicable law.