Showdio Privacy Policy

Last updated: May 13, 2026 Effective date: May 13, 2026

This Privacy Policy explains how Duel App Inc., the Delaware corporation that operates the Showdio™ platform ("Showdio," "we," "us," or "our"), collects, uses, shares, and protects personal information when you use our websites and services, including:

showdio.com — our marketing site
app.showdio.com — the consumer app where you create and enter Showdios
admin.showdio.com — our internal admin dashboard
brands.showdio.com — the portal for brand customers running campaigns
nonprofits.showdio.com — the portal for nonprofit partners receiving donations

We use the word "Services" throughout this policy to refer to all of the above, together with related mobile apps, emails, push notifications, and APIs.

If you have any questions about this policy or how we handle your information, email us at support@showdio.com.

1. Who we are

Duel App Inc. is a Delaware corporation. We operate the Showdio™ platform — a video competition service where users create and enter short-form video contests (each a "Showdio"), other users score those entries, and prizes are awarded to winners. Brand customers run campaigns on the platform. Nonprofit partners receive donations through it. "Showdio" is a trademark of Duel App Inc.

For the purposes of data protection law:

For visitors and account holders on showdio.com and app.showdio.com, Duel App Inc. is the controller of your personal information.
For users acting on behalf of a brand customer or nonprofit partner using brands.showdio.com or nonprofits.showdio.com, Duel App Inc. is typically the controller of account and platform data, and the brand or nonprofit may be a separate controller of the campaign or fundraising data they configure.

2. Scope of this policy

This policy covers personal information we process when you:

visit any showdio.com domain or subdomain;
create or sign in to a Showdio account;
create, enter, or score a Showdio;
upload videos, images, comments, backstories, or other content;
use our AI-assisted creation tools;
subscribe to a paid plan, run a brand campaign, or make or receive a donation;
contact us for support;
receive emails, push notifications, or other communications from us; or
otherwise interact with the Services.

This policy does not cover the practices of third parties we don't own or control, including external websites or services that the Services may link to. We encourage you to read the privacy policies of any third parties you interact with.

3. Information we collect

We collect personal information in three ways: information you give us, information we collect automatically when you use the Services, and information we receive from third parties.

3.1 Information you give us

Account information. When you sign up we collect your email address, a chosen username, a password (stored as a salted hash, never in plaintext), and your assigned role (user, pro, judge, brand, admin, superadmin, or nonprofit partner). If you sign in through a third-party identity provider such as Google or Apple, we receive the basic profile information that provider sends us.

Profile information. You may add a display name, avatar image, short bio, location (city/region, not precise coordinates unless you opt in), pronouns, social handles, age band, and other optional fields. Profile information you mark as public is visible to other users.

Content you upload. This includes Showdios you create, video entries you submit, thumbnails, hero images, titles, descriptions, backstories, scoring inputs, comments, reactions, and any other content you provide. Videos and images you upload include their file content plus technical metadata (codec, resolution, duration, embedded EXIF where present — we strip GPS coordinates from EXIF by default before storing).

Payment information. When you subscribe, make a one-off purchase, run a brand campaign, or donate, payment is processed by Stripe. We do not collect or store your full card number, CVV, or bank account number. Stripe shares a payment-method token, the last four digits of your card, the card brand, country, and billing ZIP back to us so we can show you which payment method is on file. For brand and nonprofit billing we additionally collect business name, business address, and tax identification fields (e.g., EIN) where required.

Identity verification information. Some features — for example, claiming prizes above certain thresholds, verifying nonprofit status, or qualifying for certain pro tiers — require identity verification through Stripe Identity. When you go through that flow you provide a government ID image, a selfie, and related metadata directly to Stripe. We receive a pass/fail result and limited verification metadata (name, date of birth, country, document type, last four digits), but we do not receive or store the actual ID image or selfie.

Prize fulfillment information. If you win a prize, we collect the information needed to deliver it — mailing address for physical prizes, payout details for cash prizes (routed through Stripe), tax forms (e.g., W-9) where U.S. tax law requires reporting, or other delivery details specific to the prize.

Brand and campaign information. Brand customers provide company information, brand assets, campaign briefs, target audiences, placement preferences, and Stripe billing details. Brand seat users provide their work email and role within the brand organization.

Nonprofit information. Nonprofit partners provide organization name, tax-exempt status documentation (e.g., 501(c)(3) determination letter), authorized signer contact, mission summary, payout banking details (via Stripe), and tax documentation for receipting donors.

Communications you send us. When you contact support, reply to a system email, fill out a feedback form, or interact with us on social media, we keep a record of that exchange so we can respond and improve the Services.

Survey, research, and beta participation. If you opt in to a survey, user research interview, or a closed beta, we collect what you share with us in that context.

Referrals and invites. If you invite a friend through our invite tool, we collect the email address or share link you used and basic data about whether the invite was acted on, so we can credit referrals.

3.2 Information we collect automatically

Usage data. We collect information about how you use the Services: pages and screens viewed, features used, Showdios browsed or entered, time spent, scrolling and click behavior at an aggregate level, and the path you took through the app. We use this to make the product better and to detect abuse.

Device and connection data. We collect your IP address, approximate location derived from your IP address (city/region level), device type, operating system, browser, mobile carrier where applicable, screen resolution, time zone, and language settings.

Cookies and similar technologies. We use cookies, local storage, and similar technologies for authentication, session management, fraud prevention, preferences, and basic analytics. See Section 11 (Cookies and tracking) for details and your choices.

Log data. Server logs include request URLs, request and response timestamps, status codes, referring URLs, and similar diagnostic data. Logs are retained for a limited period for security, abuse-detection, and operational debugging.

Push and email engagement. When you receive emails or push notifications from us, our delivery systems may record opens, clicks, and bounces so we can troubleshoot deliverability and stop sending things you ignore.

3.3 Information we receive from third parties

Authentication providers. If you sign in with Google or Apple, we receive the basic profile fields you authorize through that provider's sign-in flow.

Payment and identity processors. Stripe and Stripe Identity send us verification outcomes, payout statuses, dispute notices, and the limited payment-method metadata described above.

Fraud and safety vendors. We may receive risk signals from vendors that help us detect bots, automated abuse, payment fraud, and coordinated inauthentic behavior.

Brand and nonprofit administrators. If your employer or organization adds you to a brand or nonprofit workspace, we receive your email and role from the administrator who added you.

Publicly available sources. For account research, fraud investigations, and DMCA handling, we may consult publicly available sources (e.g., a website registrant, a public social profile referenced in a takedown notice).

We do not purchase contact lists from data brokers, and we do not enrich consumer profiles with third-party demographic data without your consent.

4. How we use your information

We use personal information to operate, maintain, and improve the Services, and specifically to:

create and manage your account, authenticate you, and keep your sessions secure;
let you create, enter, score, browse, share, and comment on Showdios;
run AI-assisted features such as generating titles, hero art, badges, blog posts, how-to content, and other assets you ask us to generate;
process payments, subscriptions, payouts, refunds, chargebacks, and tax reporting;
verify your identity where the feature you're using requires it;
compute results, tier badges, XP, and final rankings for Showdios (note: we never display final ranking positions until a Showdio is closed);
send transactional emails and push notifications (account changes, entry status, results, payment receipts);
send product updates, marketing communications, and recommendations where you've opted in (you can opt out of marketing at any time);
power recommendations of Showdios, brands, and ads that may be relevant to you;
moderate content for compliance with our Terms of Service, applicable law, and community standards;
investigate and respond to abuse, fraud, security incidents, DMCA notices, and other reports;
comply with our legal obligations and respond to lawful requests from authorities;
enforce our agreements, defend ourselves in disputes, and protect the rights, property, and safety of Showdio, our users, and others;
analyze usage and improve performance, reliability, and design of the Services;
run user research, A/B tests, and beta programs;
support brand customers in measuring campaign reach and performance through aggregated and de-identified data;
support nonprofit partners in measuring fundraising performance and producing donor receipts;
create de-identified or aggregated data sets that no longer identify you, which we may use for any lawful purpose.

We do not sell your personal information for money. We do not use the content of your private messages, draft entries, or unpublished Showdios to train third-party generative AI models, and we do not send your private content to third-party AI providers for any purpose other than producing the output you asked for.

4.1 How we use AI

We use Anthropic's Claude models for text generation tasks (titles, descriptions, blog posts, how-tos, judging assistance, suggestions) and Google's Gemini models for image generation tasks (hero art, badges, logos). When you use an AI-assisted feature:

the prompt you submit and any context we attach (for example, the Showdio's title and category) are sent to the AI provider so they can generate a response;
the response is returned to us and shown to you;
by default, we do not allow these providers to retain your prompts or outputs for model training. We rely on contractual commitments from Anthropic and Google to this effect for traffic routed through their enterprise/API products.

You are responsible for the prompts you submit and the outputs you choose to publish. See our Terms of Service for the rules around AI-generated content.

5. Legal bases for processing (EU, UK, and EEA users)

If you are in the European Union, the United Kingdom, the European Economic Area, or Switzerland, our legal basis for processing your personal information depends on the specific processing activity:

Contract. Most processing tied to providing the Services is necessary to perform our contract with you (these Terms) or to take steps at your request before entering into that contract.
Legitimate interests. We rely on legitimate interests for security, fraud prevention, debugging, abuse handling, product analytics, modest marketing of similar services to existing users, and protecting our rights — balanced against your interests and fundamental rights.
Consent. Where required, we ask for your consent — for example, for certain cookies, certain marketing communications, or for processing sensitive categories of data. You can withdraw consent at any time without affecting prior processing.
Legal obligation. Some processing is required to meet our legal obligations (e.g., tax reporting on prize payouts, responding to lawful requests).
Vital interests / public interest. In rare cases (for example, a safety emergency) we may process information to protect someone's vital interests.

6. How we share your information

We share personal information in the following limited circumstances. We do not sell it.

6.1 With other users

By design, much of what you create on Showdio is public:

your username, public profile, and any content you publish (Showdios, public entries, comments, reactions);
aggregated entry counts, scores, and tier badges while a Showdio is in progress;
your final placement once a Showdio is closed and results are computed (we never reveal placements before close);
your participation in a Showdio's leaderboard, finals, or duel.

You can keep some content private (e.g., a private Showdio you invite specific people to, a duel between two named participants). Private Showdios are only visible to invited participants, judges where applicable, and Showdio staff for moderation and support purposes.

6.2 With service providers

We share personal information with vendors that process data on our behalf and under contract. Today these include:

Supabase — authentication, database, file storage, edge compute (our primary backend infrastructure);
Vercel — hosting for our web apps;
Stripe — payment processing, subscriptions, payouts, billing;
Stripe Identity — identity verification;
Anthropic — Claude models for text generation;
Google (Gemini) — image generation;
email delivery providers for transactional and marketing email;
push notification providers for mobile push;
analytics, error-reporting, and observability vendors;
customer support and ticketing tools;
fraud and abuse-detection vendors.

We may add, remove, or change vendors over time. We require these vendors to handle personal information only on our documented instructions and to implement appropriate security and confidentiality protections.

6.3 With brand customers and nonprofit partners

If you interact with a brand campaign or a nonprofit-affiliated Showdio (for example, by viewing a placement, entering a brand-sponsored Showdio, or making a donation), we share the information described below with the relevant brand or nonprofit:

Brands receive aggregated and de-identified campaign metrics (impressions, click-throughs, entries, completion rates, geographic and demographic breakdowns). For Showdio entries you submitted to a brand-sponsored contest, the brand may also receive the entry itself, your public profile, and contact information you provided to enter (such as email and shipping address for prize fulfillment).
Nonprofits receive aggregated donation and engagement metrics for their campaigns, plus the donor information necessary to issue a tax receipt for U.S. donors (name, email, donation amount, date), unless you elect to give anonymously.

Brands and nonprofits are separately responsible for how they use the information they receive. Their use is governed by their own agreements with us and their own privacy practices.

6.4 For legal, safety, and compliance reasons

We may share personal information when we have a good-faith belief that doing so is reasonably necessary to:

comply with applicable law, regulation, court order, subpoena, or other valid legal process;
enforce our Terms of Service or other agreements, including investigating potential violations;
detect, prevent, or otherwise address fraud, security, or technical issues;
protect against harm to the rights, property, or safety of Showdio, our users, or the public.

Where legally permitted, we will notify you of a legal request before responding.

6.5 In a business transaction

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, asset sale, or similar transaction, personal information may be transferred to the surviving or acquiring entity. We will notify you of any change in ownership or use of your personal information, as well as any choices you may have about it.

6.6 With your consent or at your direction

We may share information in other ways with your consent or at your direction — for example, when you publicly share an entry to social media via an in-app sharing button.

7. International data transfers

We are based in the United States, and our primary infrastructure and most of our service providers operate in the United States. If you access the Services from outside the United States, your personal information will be transferred to and processed in the United States and other countries where we and our service providers operate.

Where applicable law requires, we use appropriate safeguards for cross-border transfers, such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and equivalent mechanisms for other jurisdictions. You can request more information about these transfer mechanisms by contacting us at support@showdio.com.

8. How long we keep your information

We retain personal information for as long as we need it for the purposes set out in this policy, and then we delete or anonymize it. Specifically:

Account data. Kept while your account is active. If you delete your account, we delete or anonymize your account data within 90 days, subject to the exceptions below.
Content you publish. Public Showdios, entries, and comments remain on the platform after deletion of your account if other users have engaged with them (for example, an entry that's part of a now-closed Showdio's record), but we will anonymize your association with that content on request, subject to legitimate exceptions (such as fraud investigations).
Payment and tax records. Retained for the period required by applicable tax, accounting, and consumer protection laws (typically 7 years in the U.S.).
Identity verification metadata. Retained for the period required to defend against fraud and meet our compliance obligations.
Support and abuse records. Retained for as long as needed to resolve the issue and for a reasonable period afterward to identify patterns and recurrence.
Logs. Server logs are retained for a short rolling window (typically 30–90 days) for operational and security purposes.
Backups. Backups are rotated on a schedule; information deleted from production systems will persist in backups until the relevant backup expires.

If we are required to retain personal information to meet a legal obligation or to defend a claim, we will retain it until that obligation or claim is resolved.

9. How we protect your information

We use a combination of organizational and technical measures to protect personal information, including:

encryption in transit (TLS) for all traffic to the Services;
encryption at rest for our primary databases and object storage;
salted password hashing — we never store passwords in plaintext;
access controls and least-privilege permissions for staff;
audit logging of sensitive administrative actions;
separation of production and non-production environments;
regular review of dependencies and security patches;
vendor due diligence;
incident response procedures.

No system is perfectly secure. If a security incident affects your personal information, we will notify you and the appropriate authorities where required by law.

10. Children and teens

The Services are not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If we learn we have collected personal information from a child under 13, we will delete it.

If you are between 13 and the age of majority in your jurisdiction (typically 18 in the U.S.):

you may use the Services only with the consent and involvement of a parent or legal guardian;
to enter Showdios that offer cash prizes, to claim prizes above certain thresholds, or to use features that require identity verification, you may need a parent or guardian to act on your behalf or approve the activity;
additional privacy protections may apply under your local law, including state laws that grant minors specific rights;
a parent or legal guardian can contact us at support@showdio.com to review, request deletion of, or refuse further collection of their child's information.

If you believe a minor has provided us with personal information without the consent of a parent or guardian, please contact support@showdio.com and we will investigate.

11. Cookies and tracking

We use cookies and similar technologies on the Services. Categories include:

Strictly necessary — required to deliver the Services (authentication tokens, session cookies, CSRF protection, load balancing). These can't be turned off without breaking the Services.
Functional — remember your preferences and settings (language, last-used filters, notification preferences).
Analytics — help us understand how the Services are used so we can improve them. We use first-party analytics and a limited number of trusted third-party analytics tools configured to minimize cross-site tracking.
Marketing — used to measure and attribute marketing campaigns. Limited use and only where you've consented in jurisdictions that require consent.

You can control cookies through your browser settings and, where applicable, through an in-app or on-site cookie preferences control. Blocking strictly necessary cookies may make parts of the Services stop working.

We honor Global Privacy Control ("GPC") signals as a request to opt out of sale or sharing of personal information for cross-context behavioral advertising in jurisdictions that recognize GPC.

12. Your choices

Regardless of where you live, you have the following choices about your information:

Access and update. You can view and edit most account and profile information in your account settings.
Delete content. You can delete individual Showdios, entries, and comments through the relevant in-product controls.
Delete your account. You can request account deletion from your account settings or by emailing support@showdio.com.
Communications. You can opt out of marketing emails through the unsubscribe link in any marketing email or in your account settings. You can disable push notifications in your device settings. We will still send transactional communications you can't opt out of (e.g., security alerts, payment receipts) while you have an account.
Cookies. See Section 11.
Public profile. You can change what's visible on your public profile or make your profile private (subject to feature availability).

13. Your privacy rights in the United States

Several U.S. states grant residents specific privacy rights. This section explains those rights and how to exercise them.

13.1 California (CCPA / CPRA)

If you are a California resident, you have the right to:

Know. Request the categories and specific pieces of personal information we have collected about you, the sources, the purposes for collecting it, and the categories of third parties with whom we share it.
Delete. Request that we delete personal information we have collected from you, subject to legal exceptions.
Correct. Request that we correct inaccurate personal information.
Opt out of sale or sharing. We do not sell personal information for money, and we do not "share" personal information for cross-context behavioral advertising as defined by the CPRA. If we ever change this, we will provide a "Do Not Sell or Share My Personal Information" mechanism and honor GPC signals.
Limit use of sensitive personal information. We do not use sensitive personal information for purposes beyond what's reasonably necessary to provide the Services.
Non-discrimination. We will not discriminate against you for exercising these rights. We may not be able to provide certain features (e.g., a paid subscription) without certain information.

Categories of personal information collected in the last 12 months. Identifiers (name, email, username, IP), customer records (account, payment-method metadata), commercial information (subscription and purchase history), internet activity (usage and device data), geolocation (approximate, from IP), audio/visual (videos and images you upload), professional or employment information (for brand and nonprofit users), and inferences drawn from the above.

Sources. You, automatically from your use of the Services, and our service providers.

Purposes. As described in Section 4.

Sharing. As described in Section 6. We share with service providers and, where applicable, brand customers and nonprofit partners. We do not sell.

To exercise your rights, email support@showdio.com from the email associated with your account or use the request form in your account settings. We will verify your identity before responding. We will respond within 45 days; we may extend by an additional 45 days where reasonably necessary and will let you know if we need more time. You may also authorize an agent to act on your behalf with appropriate proof of authority.

You can submit up to 2 verifiable requests within a 12-month period free of charge.

13.2 Virginia (VCDPA)

If you are a Virginia resident, you have the right to confirm whether we process your personal data and to access it, to correct inaccuracies, to delete personal data, to obtain a copy in a portable format, and to opt out of (i) sale of personal data, (ii) targeted advertising, and (iii) profiling in furtherance of decisions producing legal or similarly significant effects.

We do not sell personal data, do not engage in targeted advertising as defined by the VCDPA, and do not engage in such profiling. To exercise your rights, contact us as described in Section 13.1. We will respond within 45 days and may extend by 45 days where reasonably necessary. If we deny a request, you may appeal by replying to our decision; we will respond to the appeal within 60 days. If we deny the appeal, you may contact the Virginia Attorney General to submit a complaint.

13.3 Colorado (CPA)

If you are a Colorado resident, you have rights substantially similar to those described under the VCDPA above, including the right to opt out of targeted advertising, sale, and certain profiling. To exercise your rights, contact us as described in Section 13.1. We honor universal opt-out mechanisms recognized under the CPA, including GPC.

13.4 Connecticut (CTDPA)

If you are a Connecticut resident, you have rights substantially similar to those described under the VCDPA above. To exercise your rights, contact us as described in Section 13.1.

13.5 Utah (UCPA)

If you are a Utah resident, you have the right to confirm processing, access, delete, and obtain a portable copy of your personal data, and to opt out of targeted advertising and sale. To exercise your rights, contact us as described in Section 13.1.

13.6 Other states

We extend the rights described above to residents of other U.S. states with comprehensive consumer privacy laws (including Texas, Oregon, Montana, Iowa, Tennessee, and Delaware) to the extent those laws apply to us. The mechanics for exercising rights are the same as in Section 13.1.

13.7 Non-discrimination

We will not deny you Services, charge you a different price, or provide a different level or quality of Services solely because you exercised your privacy rights. We may, where permitted by law, offer different prices or features in connection with bona fide loyalty, rewards, premium, or subscription programs.

14. International users

14.1 European Union, European Economic Area, and Switzerland (GDPR / FADP)

If you are in the EU, EEA, or Switzerland, you have the following rights, subject to legal exceptions: access, rectification, erasure, restriction of processing, data portability, objection (including to direct marketing, at any time), and the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Where we rely on consent, you may withdraw it at any time.

If you believe our processing of your personal information violates applicable law, you have the right to lodge a complaint with your supervisory authority. We would appreciate the chance to address your concerns first, so please consider contacting us at support@showdio.com.

The legal bases on which we process personal information are described in Section 5.

14.2 United Kingdom (UK GDPR)

If you are in the United Kingdom, the rights described in Section 14.1 apply with reference to the UK GDPR and the Data Protection Act 2018. You may lodge a complaint with the Information Commissioner's Office (ICO).

14.3 Brazil (LGPD)

If you are in Brazil, you have rights under the Lei Geral de Proteção de Dados (LGPD), including the right to: confirm processing, access your personal data, correct incomplete or inaccurate data, anonymize or delete unnecessary data, request portability, obtain information about sharing, revoke consent, oppose unlawful processing, and request review of automated decisions. To exercise these rights, contact support@showdio.com. You may also lodge a complaint with the ANPD (National Data Protection Authority).

14.4 Canada, Australia, and other jurisdictions

If you are in Canada, Australia, or another jurisdiction with applicable data protection law, we honor the privacy rights granted under that law. Contact us at support@showdio.com to exercise them.

15. Subdomain-specific notes

15.1 showdio.com

Our marketing site uses lightweight analytics and a contact form. We do not require an account to browse. If you submit the contact form, sign up for the waitlist, or download a resource, we collect the information you provide for the purpose of responding and (with your consent where required) sending you product updates.

15.2 app.showdio.com

This is the primary consumer experience. The bulk of this Privacy Policy describes our practices on app.showdio.com.

15.3 admin.showdio.com

This subdomain is for Showdio staff and is not intended for public use. Access is restricted to authorized personnel. If you reach it as a non-staff user, you have no relationship to its processing other than as a visitor to a sign-in page, which is logged for security purposes.

15.4 brands.showdio.com

The brand portal is intended for brand customers and the individuals authorized to act on their behalf. In addition to the general practices described here, when you use the brand portal we process information about your role within your brand organization, your campaign activity, and your billing. We act as a controller of your account information and as a processor of certain campaign data on behalf of the brand. The brand customer's own privacy practices apply to data they configure or upload.

15.5 nonprofits.showdio.com

The nonprofit portal is intended for nonprofit partners and the individuals authorized to act on their behalf. In addition to the general practices described here, when you use the nonprofit portal we process organization information, tax-exempt status documentation, donor information collected for receipting, and payout information. The nonprofit's own privacy practices apply to donor data and other information the nonprofit independently collects.

16. Do Not Track signals

Some browsers offer a "Do Not Track" ("DNT") signal. There is no industry-standard interpretation of DNT, and we currently do not respond to DNT signals. We do honor Global Privacy Control ("GPC") signals where they are recognized under applicable law.

17. Third-party links and content

The Services may contain links to third-party sites, services, or content. We are not responsible for the practices of those third parties. Please read their privacy policies before interacting with them.

18. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting the updated policy on the Services and, where appropriate, by emailing you or showing a notice in-product before the change takes effect. The "Last updated" date at the top of this policy tells you when it was last revised.

Your continued use of the Services after the effective date of an updated policy constitutes your acceptance of the updates, except where additional consent is required by applicable law (in which case we will obtain it).

19. How to contact us

If you have questions, concerns, or requests about this Privacy Policy or our handling of your personal information, contact us:

Duel App Inc. (operator of the Showdio™ platform) Email: support@showdio.com Mailing address: [PLACEHOLDER — Duel App Inc. mailing address]

For data subject rights requests, please use the same email and reference the right you are exercising. We may ask you to verify your identity before responding.