Public policy
Privacy & Location Notice
Effective 4 September 2026 · Version 2026-09-04 · Controller: DUAUK, led by Dave Jones · Contact: support@duauk.co.uk
This notice explains what the DUAUK Android app and online service use, where information is stored, and the choices available to users.
Local private data
Private Map markers, imported files, Field Journal routes, private documents, voice notes and locally captured photographs are stored on the user’s device. DUAUK does not automatically upload those files. Cloud sync and cloud backup of this private material are not currently available.
Online account and shared data
When an online account is used, DUAUK collects the name, email address, DUAUK user ID, optional telephone number, password hash, session and security records, and chosen profile information. DUAUK also processes content deliberately submitted through messages, connections, groups, projects, sharing, reports and Atlas contribution or review tools.
Profile visibility and discoverability are controlled by the user. Shared information is shown only to the selected audience, subject to blocking, membership and permission checks.
Precise location and background route recording
DUAUK accesses precise location when a user starts an exploration or invokes a location-based feature. During an active exploration, route recording can continue while the app is minimised or the screen is locked. Android displays a persistent notification while that foreground service is running. Recording stops when the user finishes the exploration.
The recorded exploration route remains on the device unless the user deliberately exports or shares it. Selected or current coordinates may leave the device when requesting weather or elevation information, loading map tiles, or performing a location-based Atlas search. Those requests are necessary to provide the chosen function and may disclose the requested coordinate or map area and the device’s IP address to the relevant provider.
Service providers and external recipients
- Railway and PostgreSQL infrastructure host the DUAUK account/API service.
- The configured email provider delivers password-recovery messages.
- Open-Meteo supplies selected weather and elevation results.
- Map and data-layer providers supply tiles or datasets selected by the user; the active provider is credited in the Map.
- The user’s chosen email application receives a crash report only when the user explicitly asks to send it.
DUAUK does not sell personal data, use targeted advertising or use an advertising identifier.
Security
Online traffic is restricted to HTTPS. Passwords are stored as one-way hashes. Session tokens and authenticator secrets are protected and are omitted from the in-app diagnostic report. These controls are not described as end-to-end encryption. Private cloud storage is not currently offered.
Retention
Active account and shared information is retained while the account or relevant collaboration remains active. Security audit events and public Atlas revision history may be retained to protect the service and the integrity and provenance of the archive. Password-recovery and session records expire or are revoked under their security rules. Content reports are retained for moderation, safety and accountability.
Deletion and user choices
Users can edit profile visibility, stop location recording, block another user, revoke sessions and request deletion of the online account. The in-app request immediately changes the account state and revokes its server sessions; DUAUK then verifies and completes deletion or irreversible anonymisation of profile/contact information, credentials, memberships, direct conversations and private online sharing information. Public Atlas history and security audit events may remain under a pseudonymous identifier with no public profile or contact link. Local files on the device are not erased by online-account deletion.
A user without the app can begin the same verified process at Delete your DUAUK account.
Rights and questions
Contact support@duauk.co.uk to ask about access, correction, objection, restriction or deletion. UK users may also raise a concern with the Information Commissioner’s Office.