This Privacy Policy explains what personal data Dūbu collects, why, and what rights you have.
Dūbu is operated by SulekhaDD AB, registration number 559597-8635, 44244 Kungälv, Sweden, which is the data controller under the EU General Data Protection Regulation (GDPR).
Contact for all privacy matters: dubu@sulekhadd.app
1. SUMMARY
Dūbu is built to collect as little personal data as possible. We use Google Sign-In to create your account, store your learning progress and purchases so they sync across your devices, and process payments through your app store. Analytics and crash reporting are optional and off unless you turn them on. We do not sell your personal data, and we do not use it to train AI models.
2. DATA WE COLLECT
Account data. Your Firebase/Google user id, display name and email address, collected through Google Sign-In so you can have an account and sync across devices. The display name is the one on your Google account; Dūbu does not currently let you set a different one.
Device data. Device model and app version, used for support and to keep the app compatible.
Learning data. Which decks you download, cards you have seen, quiz results, scores, streaks and study statistics, used to power your progress, daily quiz, and leaderboard standing.
Purchase and token data. A record of the decks you have unlocked, your token balance, and the tokens you have been granted or have spent. We use this to give you access to what you paid for and to keep your balance accurate. Payment is handled by your app store; we never receive or store your card or bank details.
Fair-play data. Signals we use to detect manipulation of quizzes, leaderboards or the token system — for example, unusual answer timing, duplicate accounts, or automated play.
Optional analytics and diagnostics. If you turn them on, Firebase Analytics and Crashlytics collect app-usage events, crash reports, and a device-generated identifier. These are off by default and you can turn them off again at any time in Settings.
Configuration data. We use Firebase Remote Config to deliver feature settings and content versions to the app. This does not identify you.
3. HOW WE USE YOUR DATA
We use your data to:
- provide the app, your account and sync across your devices;
- deliver content, quizzes and your progress;
- run leaderboards and grant rewards;
- process, restore and support purchases and token balances;
- detect and prevent cheating, multiple accounts, fraud and abuse, and enforce our Terms;
- provide support and answer your messages;
- keep the service secure and working; and
- meet our legal obligations, including accounting and consumer-law record keeping.
If you opt in, we also use analytics and crash data to understand how the app is used and to fix faults.
4. LEGAL BASES (GDPR)
| What | Legal basis |
|---|---|
| Your account, sync, content delivery, purchases, token balance, leaderboards | Performance of a contract (Art. 6(1)(b)) |
| Security, fraud prevention, anti-cheat, enforcement of our Terms | Legitimate interests (Art. 6(1)(f)) — keeping the service fair, secure and usable for everyone |
| Analytics and crash reporting | Your consent (Art. 6(1)(a)), which you can withdraw at any time in Settings |
| Accounting and consumer-law records | Legal obligation (Art. 6(1)(c)) |
We do not rely on consent for marketing, because Dūbu does not send marketing communications.
Analytics and crash reporting involve storing and reading information on your device. We only do this with your consent, as required by the Swedish Electronic Communications Act. Turning them off stops it, and does not affect your use of the app.
5. WHAT OTHER USERS CAN SEE
If you take part in Arena quizzes, your display name and score appear on a leaderboard visible to other Dūbu users. Leaderboards are separate for each study country, and you appear only on the board for the country you were studying when the quiz opened.
Nothing else is public. Your email address, your purchases, your token balance and your practice results are never shown to other users.
Your display name comes from your Google account. Dūbu does not currently offer a separate in-app name, so the name shown on a leaderboard is the name on the Google account you signed in with — for many people, their full name. If you change it in your Google account, it updates in Dūbu the next time you sign in.
If you do not want that name visible to other users, do not take part in Arena. Practice study and practice quizzes are private and never appear on any leaderboard.
6. SERVICE PROVIDERS WE SHARE DATA WITH
We use trusted providers who process data on our behalf:
- Google Firebase (Authentication, Cloud Firestore, Remote Config, Crashlytics, Analytics) — accounts, data storage, crash and usage diagnostics.
- Google Play Billing — purchase processing and verification.
- Google ML Kit — on-device translation of study content. Translation runs on your device; card text is not sent to us or to Google for this purpose.
- Wikimedia / Wikipedia — source of study content and images. We fetch public content; we do not share your personal data with them.
A current, dated list of our processors is available on request from dubu@sulekhadd.app. We will update it before adding a new processor.
Where your data is stored. Our Firestore database is located in the European Union (Google Cloud region europe-west1, Belgium). Some processing by Google may take place outside the EU/EEA. Where it does, transfers are covered by the European Commission's Standard Contractual Clauses together with Google's supplementary measures, under the data-processing terms we have in place with them.
We do not sell personal data, and we do not share it with advertisers or data brokers.
7. DATA RETENTION
- Data How long
- Account and learning data While your account exists
- Deleted accounts Marked for deletion immediately, erased or anonymised within 30 days
- Purchase, token and accounting records 7 years, as required by the Swedish Bookkeeping Act
- Fair-play and abuse records 12 months after the case is closed
- Support correspondence 24 months
- Analytics and crash data 14 months, or until you withdraw consent
- 8. YOUR RIGHTS
Under the GDPR you have the right to access, correct, delete, restrict or object to the processing of your personal data, the right to data portability, and the right to withdraw consent where processing is based on it.
Exercising them. You can delete your account directly in the app, under Profile → Session. To request a copy of your data, or to exercise any of your other rights, write to dubu@sulekhadd.app. We will reply within one month.
Complaints. If you are unhappy with how we have handled your data, please tell us first. You also have the right to complain to a supervisory authority:
- Sweden: Integritetsskyddsmyndigheten (IMY) — imy.se
- Germany: the data protection authority of your federal state, or the BfDI
- United Kingdom: Information Commissioner's Office (ICO) — ico.org.uk
- Elsewhere in the EU/EEA: your national data protection authority
India. If you are in India, you may contact our grievance officer at dubu@sulekhadd.app in relation to your rights under the Digital Personal Data Protection Act.
9. DATA PROTECTION OFFICER
We are not required to appoint a Data Protection Officer, and we have not appointed one. Privacy matters are handled directly by SulekhaDD AB and can be raised at dubu@sulekhadd.app.
10. CHILDREN
Dūbu is not directed at children. You must be at least 16 to create an account, and at least 18 in India unless a parent or guardian has given verifiable consent. We do not knowingly collect personal data from anyone below these ages. If you believe a child has created an account, write to dubu@sulekhadd.app and we will delete it.
11. SECURITY
We protect your data with industry-standard measures, including encrypted transport, encrypted on-device storage, and server-side access controls that limit who can reach what.
If something goes wrong. No method of transmission or storage is completely secure. If a personal data breach occurs, we will notify Integritetsskyddsmyndigheten within 72 hours of becoming aware of it where the breach is likely to result in a risk to your rights, and we will notify you directly, without undue delay, where the risk to you is high — telling you what happened, what data was involved, and what you should do.
12. AI AND AUTOMATED DECISIONS
We use automated tools, including AI, to help draft and translate study content. We do not use your personal data to train AI models, and we do not make decisions about you by purely automated means that produce legal or similarly significant effects. Automated fair-play checks may flag an account, but any suspension or closure is reviewed by a person and can be contested under our Terms.
13. COUNTRY-SPECIFIC INFORMATION
Sweden and the EU/EEA. This policy is written to meet the GDPR. Supervisory authority: IMY.
United Kingdom. Where UK GDPR applies, the same rights apply and the supervisory authority is the ICO.
India. Where the Digital Personal Data Protection Act 2023 applies, SulekhaDD AB is the Data Fiduciary, you are the Data Principal, and our grievance officer is reachable at dubu@sulekhadd.app. Users under 18 require verifiable parental consent, and we do not track or profile users under 18.
14. CHANGES TO THIS POLICY
We may update this Privacy Policy. When we make a material change we will increase the version number, give you at least 30 days' notice, and ask you to review and accept the updated policy before continuing to use the app. Every version is listed below.
15. CONTACT
Data controller: SulekhaDD AB, 44244 Kungälv, Sweden Registration number 559597-8635 Privacy questions and requests: dubu@sulekhadd.app
VERSION HISTORY
Version 2.0 — 06-09-2026 — Section 8 corrected. The previous version said you could export your data in the app; there is no in-app export, so requests for a copy of your data are handled by email. The account-deletion path was also renamed to match the app (Profile → Session).
Version 1.0 — 30-08-2026 — First published version of this Privacy Policy.