1. Who we are
Dunzo (“Dunzo,” “we,” “us,” “our”) is operated by Dunzo , an individual sole operator based in the State of Ohio, United States. Dunzo is a family dunzo and rewards management application available on the web at dunzo.rocks. Mobile apps for iOS and Android are in development; this policy will cover them when they ship.
For privacy questions, data requests, or anything else, reach us at support-dunzo@googlegroups.com.
2. What this policy covers
This policy describes what information we collect when you use Dunzo, how we use it, who we share it with, and the choices you have. It applies to the Dunzo website, mobile apps, and APIs.
3. Information we collect
Account information
- Email address (for adult accounts)
- Password (stored hashed, never in plain text)
- Display name
- Optional username
- Whether your email has been verified
Sign-in with Google or Apple
When you choose to sign in with Google or Apple, we receive your name, email address, and a stable account identifier from that provider. We use this only to create or authenticate your Dunzo account.
Supervised user accounts (children)
Accounts for children are created and managed by a parent or guardian. We collect a username, a display name, and a hashed password for these accounts. We do not collect an email address for supervised accounts.
Family activity
- Dunzos you create, claim, complete, approve, or reject
- Optional proof notes attached to dunzo completions
- Points ledger entries (credits from approved dunzos, debits from reward redemptions)
- Rewards you define and redemptions made by family members
- Streaks and achievements derived from your dunzo approval history
- Family invitations you create
Technical information
- IP address and basic device information
- Server logs (request paths, status codes, timestamps) for security and debugging
4. How we use your information
We use the information we collect to:
- Operate Dunzo for you and your family
- Authenticate you and keep your account secure
- Sync dunzos, points, and rewards across the web and mobile apps
- Send transactional emails (password reset, email verification, family invitations)
- Prevent fraud, abuse, and unauthorized access
- Improve the product based on aggregated usage patterns
We do not sell your personal information. We do not run advertising on Dunzo and we do not share your data with advertisers or data brokers.
5. Google user data
When you sign in with Google, Dunzo receives your name, email address, and Google account ID (the stable sub claim). This data is used solely to authenticate you to your Dunzo account. We do not sell, transfer, or share Google user data with any third party for advertising or any purpose other than the user-facing features of Dunzo. We do not use Google user data to train AI or machine-learning models.
Dunzo’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
6. Service providers
We use a small number of trusted service providers to run Dunzo. These providers process data on our behalf and are bound by their own privacy commitments.
- Neon — PostgreSQL database hosting
- Vercel — web app hosting and edge functions
- Railway — API hosting
- Resend — transactional email delivery
- Google Identity — OAuth sign-in
- Apple ID — OAuth sign-in
- Expo — mobile app delivery and (when enabled) push notifications
7. Children’s privacy
Dunzo is designed to be used by families, and we take children’s privacy (including COPPA) seriously. Accounts for children are created and managed by a parent or guardian within the family: the parent chooses the username and password, affirms their consent to the practices described here at the moment of creation, and receives an email confirming what was created. We do not knowingly collect personal information directly from children outside of this parent-supervised flow.
What we collect from a supervised (child) account — and nothing more
- The username and display name the parent chose. Never an email address.
- A hashed password (set and resettable only by the parent)
- Activity inside the family: dunzos claimed and completed, optional proof notes, points earned and spent, rewards redeemed, and streaks derived from that history
- Technical identifiers (IP address, session tokens) used solely for signing the child in, keeping the service secure, and debugging — what COPPA calls “support for internal operations.” We use them for nothing else.
What we never do with children’s information
- No advertising of any kind is shown to children
- No child’s personal information is disclosed to third parties
- No third-party analytics or tracking runs on child-facing screens
- No profiling, and no use of children’s data to train AI models
Parents’ rights
As the parent or guardian, you can review your child’s activity from your own account at any time, reset their password, decline further collection by removing them from your family, and delete their account — which permanently erases their personal information (username, name, password) from our systems. All of this is available in-app from your Family page, or by emailing support-dunzo@googlegroups.com.
8. Your rights
You have the right to:
- Access the personal information we hold about you
- Correct inaccurate information
- Request deletion of your account and associated data
- Request a copy of your data in a portable format
You can delete your account yourself at any time from Settings → Delete account inside Dunzo. For anything else, email us at support-dunzo@googlegroups.com. We’ll respond within a reasonable time, typically within 30 days.
9. Data retention
We keep personal information only as long as it is needed for the purpose it was collected. Our retention schedule:
- Active accounts: account and family activity data are retained while the account exists.
- Deleted accounts:personal information (email, username, name, password, avatar, linked sign-in providers) is erased from active systems immediately when an account is deleted — by you in Settings, or by a parent deleting a child’s account. Family activity records (points history, completed dunzos) are retained in de-identified form so the rest of the family’s history stays intact.
- Security tokens: password-reset and email-verification tokens expire within minutes to hours and are purged after expiry.
- Parental consent records: retained as required to demonstrate compliance, including for a period after account deletion.
- Backups: encrypted database backups roll off within 90 days, after which deleted data is permanently unrecoverable.
We do not retain children’s personal information indefinitely, and never for purposes beyond those described in this policy.
10. Cookies and tracking
Dunzo uses local browser storage and session cookies to keep you signed in. We do not use third-party analytics, advertising cookies, or cross-site tracking. If we add analytics in the future, we’ll update this policy and use a privacy-respecting tool (no cookies, no PII).
11. Security
We take reasonable measures to protect your data. Passwords are hashed using bcrypt (cost 12). Authentication uses JWT tokens. All traffic is served over HTTPS. We apply rate limiting on our API to prevent abuse.
That said, no system is perfectly secure. We commit to notifying affected users promptly if we ever become aware of a security incident involving their data.
12. International users
Dunzo is operated from the United States. If you access Dunzo from outside the United States, your information will be transferred to, stored, and processed in the United States and other countries where our service providers operate.
13. Changes to this policy
We may update this policy from time to time. When we do, we’ll update the “Last updated” date at the top of this page. For material changes, we’ll notify users by email before the changes take effect.
14. Contact
Questions, complaints, or requests about your data? Email support-dunzo@googlegroups.com. We read every message.