Privacy Policy

1. Who we are

Dupelikit (“we”, “us”, “our”) is a community-powered makeup dupe discovery platform. Our website is dupelikit.com. Questions about this policy can be sent to hello@dupelikit.com.

2. What data we collect

• Account data — email address and password (hashed) when you create an account. Display name, username, and profile photo if you choose to add them.
• Content you create — dupes you submit, votes, reviews, kit items, and lists. This content is associated with your account.
• Usage data — pages visited and search queries.
• Cookies — a session cookie to keep you signed in, and an anonymous analytics cookie. See our Cookie Policy for details.

We do not collect payment information. We do not sell your data.

3. How we use your data

• To operate the platform and show you your kit, lists, and activity.
• To attribute your submitted dupes and votes to your public profile (if your profile is set to public).
• To improve the site — understanding which products and categories are most popular.
• To send transactional emails (password reset, notification emails you opt into). We do not send marketing emails without your explicit consent.

4. Data sharing

We share data only with:

• Supabase — our database and authentication provider. Data is stored in the EU.
• Vercel — our hosting provider. Serves pages from edge locations globally.

We do not share your data with advertisers or data brokers.

5. Your rights

Depending on where you live you have the right to access, correct, or delete your personal data, and to object to or restrict certain processing. To exercise any of these rights, email us at hello@dupelikit.com. We will respond within 30 days.

You can delete your account at any time from your profile settings. This removes your personal data; anonymised content (votes, dupe submissions) may be retained to preserve the integrity of the community database.

6. Data retention

We keep your account data for as long as your account is active. If you delete your account we remove your personal data within 30 days. Anonymised analytics data may be retained indefinitely.

7. Security

Passwords are hashed and never stored in plain text. Database access is protected by row-level security policies. All traffic is encrypted in transit (HTTPS). We take reasonable technical measures to protect your data, but no system is completely secure.

8. Changes to this policy

We may update this policy from time to time. We will update the “last updated” date at the top. Continued use of the site after changes constitutes acceptance of the updated policy.

9. Contact

For any privacy-related questions, email hello@dupelikit.com.