Durusu Privacy Policy
Last updated: 8 September 2026
Durusu is an exam revision and practice app for school learners. It is published by Starqode Hub ("we", "us"). This policy explains exactly what the app collects, why, who else sees it, and how to get it deleted. It applies wherever you use Durusu, whichever grades, subjects, or curricula the app offers you.
We have written it to be read by parents and teachers, not only by lawyers.
The short version
- We ask for an email address so your subscription follows you between devices. Nothing else about you is required — no name, no phone number, no date of birth, no location.
- We store your practice results so you can see your progress.
- We show no adverts, use no analytics or tracking SDKs, and build no advertising profiles. We never sell or rent personal data to anyone.
- You can delete your account from inside the app, and everything we hold about you goes with it.
1. Who we are
Starqode Hub is the data controller for the personal data described here.
- Contact: info@starqodehub.com
- Registered address: [REGISTERED ADDRESS]
2. What we collect
Account information
| Data | Why | Required? |
|---|---|---|
| Email address | Identifies your account so your subscription and results work on any device you sign in on | Yes, to create an account |
| Password | To sign you in. Stored only as a cryptographic hash — we cannot read it | Only for email accounts |
| Apple or Google account identifier | If you sign in with Apple or Google, we store the identifier they give us instead of a password | Only if you use social sign-in |
| Default grade | So the app opens on the right grade | Optional |
If you sign in with Apple or Google, we receive an identifier and your email address. We do not receive your contacts, photos, calendar, or anything else from those accounts.
Practice data
When you finish an exam paper or topic session, we record the subject and topic, the mode (exam or topic practice), your score and the total marks available, how long you took, the questions you were served, and the answers you gave.
This exists so you can review a paper you have already sat and watch your progress over time. It is not used to rank, profile, or advertise to you.
Subscription information
If you subscribe, our subscription provider RevenueCat tells our server whether your subscription is active, which product you bought, when it expires, and whether it is a live or test purchase. This is what unlocks premium content.
We never see or store your card, bank, or payment details. Payment is handled entirely by Google Play or the Apple App Store under their own terms and privacy policies.
Technical logs
Our server keeps ordinary operational logs of the requests it receives, which can include IP addresses and timestamps. These exist to keep the service running and secure, and are not used to build a picture of any individual.
What we do not collect
No name, phone number, postal address, date of birth, gender, precise or approximate location, photos, contacts, microphone or camera data, advertising identifiers, or biometric data. The app requests only two Android permissions: internet access, and vibration for exam-timer feedback.
3. Children's privacy
Durusu is built for school-age learners, and we treat that as the centre of this policy rather than a footnote.
- We collect the minimum needed to run an account, and nothing that identifies a child beyond an email address.
- We show no advertising of any kind, and run no third-party advertising or analytics SDKs.
- We do no profiling, behavioural targeting, or automated decision-making.
- We do not sell, rent, or share children's personal data for marketing.
Where the law requires a parent or guardian to consent on behalf of a child, the account must be created and managed by that parent or guardian. If you believe a child has created an account without that consent, email us and we will delete it.
4. Why we may use your data, lawfully
- To provide the service you asked for — creating your account, saving your results, unlocking what you paid for. (Performance of a contract.)
- To keep the service working and secure — server logs, abuse prevention, investigating a disputed subscription. (Legitimate interests.)
- To meet legal and tax obligations — records connected to purchases. (Legal obligation.)
- Where you have given consent — which you may withdraw at any time.
We do not use your data for marketing.
5. Who else sees it
We share personal data only with the providers needed to run Durusu, and only what each one needs:
| Who | What they get | Why |
|---|---|---|
| RevenueCat | Your account identifier and subscription events | Manages subscription status across Apple and Google |
| Apple App Store / Google Play | Your purchase, under your own store account | Take payment and manage billing |
| Apple / Google sign-in | Only if you choose social sign-in | Verifies it is really you |
| Our hosting provider | Hosts the server and database | Runs the service |
We never sell personal data, never rent it, and never hand it to advertisers or data brokers. We disclose data to authorities only where the law actually requires it.
6. Where your data is stored, and how it is protected
Your account and results are stored in our own PostgreSQL database on a private server, not in a third-party analytics platform. The database is not reachable from the internet — only our API server can talk to it.
Passwords are stored as hashes and never in readable form. Traffic between the app and our server is encrypted with HTTPS. Access to the admin panel is restricted to the account owner.
No system is perfectly secure, and we do not claim otherwise. If a breach affects your personal data, we will notify you and the Office of the Data Protection Commissioner as the law requires.
7. How long we keep it
- Account and practice data: for as long as your account exists.
- When you delete your account: removed immediately. Deletion cascades — your results and subscription records go with the account.
- Purchase records: we may retain the minimum required by tax and accounting law, even after account deletion.
- Server logs: kept briefly for operational purposes, then rotated out.
8. Your rights
Under the Kenya Data Protection Act, 2019, and comparable laws elsewhere, you may ask us to:
- tell you what we hold about you, and give you a copy;
- correct anything inaccurate;
- delete your data;
- restrict or object to how we use it;
- withdraw consent where our use of your data relies on it.
Email info@starqodehub.com and we will respond within the statutory time limit. If you are not satisfied with our response, you may complain to the Office of the Data Protection Commissioner (ODPC), Kenya, at odpc.go.ke.
9. Deleting your account
Open Settings → Delete account in the app. This removes your account, your practice results, and your subscription records from our servers.
Deleting your account does not cancel your subscription — subscriptions are held by Apple or Google, so cancel yours in the App Store or Play Store subscriptions screen to stop future charges.
10. Data kept on your device
The app stores some things locally on your phone: your sign-in token, your chosen grade, any exam in progress, and results saved while you were offline. This never leaves your device except when syncing to your account, and uninstalling the app removes it.
11. Changes to this policy
If we change this policy we will update the date at the top, and tell you in the app before any material change takes effect.
12. Contact us
Questions, requests, or complaints: info@starqodehub.com