================================================================================ DURUHA — GOOGLE PLAY READINESS PACKAGE ================================================================================ Audit Date: June 14, 2026 (rev. — verification model switched to KYC front/back/selfie, user-to-user blocking implemented, UI deletion and manual location entry confirmed in code) Codebase: /lib, /android, /supabase/migrations Status: BETA TEST PREPARATION CHANGE LOG (June 14, 2026): - VERIFICATION MODEL CHANGED. The old dual-copy model (Copy A unredacted internal + Copy B redacted PUBLIC copy) no longer exists in the code. Verification is now a private KYC flow: the user submits a government ID FRONT image, ID BACK image, and a SELFIE, plus full name, date of birth, and place of birth (verification_remote_source.dart → `profile_verification_requests`, bucket `profile-verification-documents`). All three images are PRIVATE — none are displayed on a public profile. A SHA-256 "identity fingerprint" over the concatenated image bytes is computed client-side and enforced server-side to flag duplicate submissions. Raw ID images are purged on approval; only hashes are retained. Sections 2.2, 4, and the Section 2 verification policy have been rewritten accordingly. (cryptography ^2.7.0 added for Sha256.) - USER-TO-USER BLOCKING IMPLEMENTED. Two levels — block this persona only, or block all personas on the account (block_remote_source.dart → `profile_persona_blocks`, RPCs block_profile_persona / unblock_profile_persona). Resolves Q4 and 0B safety-disclosure items. - POST/COMMENT DELETION and MANUAL LOCATION ENTRY confirmed in code; [NEEDS FOUNDER CONFIRMATION] placeholders for these removed. CHANGE LOG (June 9, 2026): - Private/encrypted messaging (Signal Protocol) was REMOVED from the launch build. All E2EE messaging, chat, and key-backup disclosures have been struck from the policy. (Code lives on the `feature/chat` branch; DB tables retained for possible future revival but no chat UI ships.) (The agenda "private comments" encrypted-thread UI that briefly reused this was removed June 14, 2026 — no encrypted messaging ships at launch.) - Push notifications via Firebase Cloud Messaging (firebase_core + firebase_messaging) are now IMPLEMENTED. Device push tokens are collected and stored in `profile_push_tokens`. Disclosures and the Data Safety form have been updated accordingly. This resolves checklist item 0B-7. - applicationId confirmed: com.duruha.app (resolves Q1). - Agenda "private comments" encrypted-thread UI and all payment/HitPay UI have been REMOVED from the launch build (future features). No encrypted messaging of any kind ships, and no payment data is collected. This document is the single source of truth for Duruha's privacy policy, community guidelines, safety disclosures, and Google Play compliance. It replaces the previous partial policy. Sections marked [NEEDS FOUNDER CONFIRMATION] must be resolved before public launch. ================================================================================ SECTION 0 — BETA LAUNCH CHECKLIST ================================================================================ Use this section as your living checklist. Check off items as you complete them. Items are grouped by priority. ✅ Section 0A — All closed-beta blockers resolved (May 27 2026). -------------------------------------------------------------------------------- 0B. REQUIRED BEFORE PUBLIC LAUNCH (not blockers for closed beta) -------------------------------------------------------------------------------- [ ] 0B-1 Draft and host Terms of Service. Play Console requires ToS for the store listing. Must cover: usage rights, content ownership, verification obligations, account suspension, limitation of liability. [NEEDS FOUNDER CONFIRMATION: legal entity name for ToS header] [ ] 0B-2 Confirm the legal entity name, registered address, and jurisdiction (Philippines). Required for privacy policy, ToS, and Play Console account registration. [NEEDS FOUNDER CONFIRMATION] [ ] 0B-3 → See 0B-16 (moved to separate item with recommended values). [done] 0B-4 Users can delete their own posts and comments from the UI. - Post delete: news_card_engagement.dart → deleteNews() in post_creation_provider.dart:377 (sets status 'removed', reason 'author_deleted') with confirmation dialog. - Comment delete: unified_comment_tile.dart:444 → deleteComment() RPC via comment_remote_source.dart with confirmation dialog. [done] 0B-5 ACCESS_FINE_LOCATION is justified. Onboarding uses LocationAccuracy.high (onboarding_screen.dart:141) for barangay-level community matching, which requires GPS precision. Both FINE and COARSE are declared in AndroidManifest.xml:66-67. Decision: retain FINE — barangay resolution requires it. [ ] 0B-6 Set up crash reporting before public launch. Not yet implemented — no Sentry or Firebase Crashlytics in pubspec.yaml. Production crashes are currently invisible. When added, update the Data Safety form and Section 4 of this document to disclose it. [done] 0B-7 Push notifications IMPLEMENTED via Firebase Cloud Messaging (firebase_core + firebase_messaging in pubspec.yaml; flutter_local_notifications for local display). FCM device tokens are stored per-persona in `profile_push_tokens` (notification_remote_source.dart), deactivated on sign-out / token refresh. POST_NOTIFICATIONS declared in AndroidManifest.xml. Data Safety form (0D) and Privacy Policy Sections updated to disclose push token collection and Google/Firebase as processor. [ ] 0B-8 google_fonts ^6.2.1 is in pubspec.yaml. Inter font is fetched from Google CDN at runtime (lib/app/theme.dart:385-386 via GoogleFonts.interTextTheme()). No local fonts/ asset bundle exists. Decision needed: accept CDN dependency or bundle Inter locally. Bundling eliminates the Google network call but is optional. [done] 0B-9 Payments are NOT at launch. The HitPay placeholder key (.env) and the unused escrow model were removed from the codebase (June 14, 2026). Sections 8 and 9 now state plainly that no payment data is collected. Revisit only if payments are added later. [ ] 0B-10 Consider appointing a Data Protection Officer (DPO) as required under Philippines RA 10173 for organizations processing sensitive personal information at scale. Register with the National Privacy Commission if required. [NEEDS FOUNDER CONFIRMATION: check NPC registration threshold] [ ] 0B-11 Fill in all [NEEDS FOUNDER CONFIRMATION] placeholders throughout this document before hosting it publicly. [ ] 0B-12 Set up trust@duruha.social inbox and ensure it is actively monitored. It is referenced as the safety and fraud reporting contact in this document. [n/a] 0B-17 (OBSOLETE) pg_cron schedules for `expire_due_messages` / `cleanup_ended_chats` are no longer required at launch — private messaging was removed from the build (June 9, 2026). Chat tables remain in the DB but are dormant. Revisit only if messaging is re-enabled from the `feature/chat` branch. [ ] 0B-13 Set Play Console distribution to Philippines only before submitting. Play Console → Store presence → Countries / regions → select PH only. Expand later when ready for other markets. [ ] 0B-14 Register a legal entity (business name / corporation) in the Philippines before public launch. Required for: Play Console developer account, Terms of Service header, Privacy Policy signature block, and NPC registration if applicable. [ ] 0B-15 Create a dedicated privacy/data contact email (e.g. privacy@duruha.com) and a public-facing contact address. Required for the hosted Privacy Policy and Play Console listing. [ ] 0B-16 Decide and document data retention periods for: - User posts and media - Comments - Content reports (news_reports, action_reports) Then fill in Section 9 (Data Retention) of this document. Recommended starting point: posts/comments indefinitely until deleted by user; reports 2 years. (Private message ciphertext no longer applies — messaging removed.) -------------------------------------------------------------------------------- 0C. FOUNDER CONFIRMATION QUESTIONS (answer before public launch) -------------------------------------------------------------------------------- Q1. What is the final applicationId / package name? ANSWERED: com.duruha.app (confirmed in android/app/build.gradle). Q2. What is the minimum age for Duruha users? ANSWERED: 13. Users must be at least 13 years old. Q3. Can users delete their own individual posts and comments from the UI? ANSWERED: YES — confirmed in code (see 0B-4). Q4. Is there a user-to-user block feature (not just community muting)? ANSWERED: YES — implemented. Two block levels (this persona only / all personas on the account) via block_profile_persona RPC, surfaced in the profile header and profile settings (see Section 10). Q5. What is the data retention period for posts, comments, and content reports? (Exchange/escrow deferred — not at launch) Q6. What is the legal entity name, registered address, and jurisdiction? STATUS: Not yet registered. Required before public launch (Play Console developer account, ToS header, Privacy Policy signature block). Q7. What email address should be listed as the privacy / data contact? STATUS: No contact email yet. Required before hosting the Privacy Policy publicly. Create a dedicated address (e.g. privacy@duruha.com) before public launch. Q8. Where will this Privacy Policy be publicly hosted? (URL) Q9. (ANSWERED: NO) HitPay / payments are not at launch — deferred feature. Q10. Does onboarding support skipping GPS and entering location manually? ANSWERED: YES — GeoHierarchyPicker allows manual selection (onboarding_screen.dart:709-727); GPS capture button is optional; _skipStage2() allows skipping verification entirely. Q11. (ANSWERED: NO) Exchange / escrow is not live in beta — deferred feature. Q12. Does barangay-level community matching require precise GPS, or is approximate location sufficient? ANSWERED: PRECISE — onboarding uses LocationAccuracy.high (onboarding_screen.dart:141). FINE location is required and justified. Q13. Will the app be available outside the Philippines at launch? ANSWERED: Philippines only at launch. Restrict distribution to PH in Play Console → Store presence → Countries / regions before submitting. Q14. Has a Data Protection Officer been assigned? Q15. Is trust@duruha.social active and monitored? Q16. What is the pdf + printing package used for? RESOLVED: The pdf/printing packages are no longer in pubspec.yaml (confirmed June 14, 2026). Nothing to remove. Q17. Has any independent security audit or penetration test been done? Q18. Will there be a Terms of Service hosted at launch? -------------------------------------------------------------------------------- 0D. GOOGLE PLAY DATA SAFETY FORM — QUICK REFERENCE -------------------------------------------------------------------------------- Use these answers when filling in the Play Console Data Safety section. Data collected: - Name YES | Not shared | Required | Account mgmt - Email address YES | Not shared | Required | Account mgmt - Date of birth YES | Not shared | Required | App functionality - Profile photo YES | Not shared | Optional | App functionality - Precise location (GPS) YES | Not shared | Optional | App functionality - Photos / images YES | Not shared | Optional | App functionality - Videos YES | Not shared | Optional | App functionality - Audio files YES | Not shared | Optional | App functionality - User-generated content YES | Not shared | Optional | App functionality - Persona / credentials YES | Visible to community | Optional | App functionality - App interactions YES | Not shared | Automatic | App functionality - Government ID front/back YES | Not shared | Ephemeral | Fraud prevention / compliance - Verification selfie YES | Not shared | Ephemeral | Fraud prevention / compliance - Place of birth YES | Not shared | Optional | Fraud prevention / compliance - Push token (FCM) YES | Shared w/ Google (FCM) | Automatic | App functionality (notifications) NOTE on verification images: ID front, ID back, and selfie are stored in a PRIVATE Supabase bucket, used only for internal KYC review, and purged on approval (only a SHA-256 identity-fingerprint hash is retained). None are displayed publicly. In the Data Safety form, declare "Photos" and a "Government ID" / "Other personal info" item as collected for fraud prevention, not shared, with the deletion-on-approval note. NOTE on push token sharing: the FCM device token is processed through Google's Firebase Cloud Messaging to deliver notifications. In the Play Console Data Safety form, declare "Device or other IDs" as collected and shared with a service provider (Google) for app functionality. Do NOT mark it as shared for advertising. Data NOT collected: - Phone number NO - Precise location (background) NO - Contacts NO - Advertising ID NO (FCM token is a device installation ID, not an ad ID) - Crash logs / analytics NO - Financial info NO (no payment processor integrated) Security practices: - Data encrypted in transit: YES (HTTPS/TLS) - Data encrypted at rest: YES (AES-256 via Supabase; Android Keystore for keys) - Users can request data deletion: YES - Minimum age: Users must be at least 13 years old - Independent security review: [NEEDS FOUNDER CONFIRMATION] ================================================================================ SECTION 1 — PRIVACY POLICY ================================================================================ DURUHA PRIVACY POLICY Effective Date: May 19, 2026 Last Updated: June 14, 2026 -------------------------------------------------------------------------------- 1. Introduction -------------------------------------------------------------------------------- Duruha ("we," "our," or "us") is a trust-first social platform that connects people through verified identities, geo-filtered communities, and credibility- based content. Our mission is to enable meaningful, accountable communication by ensuring that the people behind profiles are who they say they are. This Privacy Policy explains what information we collect from you when you use the Duruha mobile application ("App"), why we collect it, how we use and protect it, and what choices you have. By creating an account or using the App, you agree to the collection and use of information described in this policy. -------------------------------------------------------------------------------- 2. Information We Collect -------------------------------------------------------------------------------- 2.1 Information You Provide Directly When you create an account or use the App, we may collect: - Account information: Email address, password (stored as a hashed credential, never in plain text), and display name. - Profile information: Date of birth, persona labels, bio, and profile photo. - Location information: If you choose to provide it during onboarding, we collect your device's GPS coordinates to place you within our geographic community hierarchy. This is optional. See Section 5 for details. - User-generated content: Posts (text, images, video, audio), comments, reactions, votes, agenda items, and other content you create or share on the platform. - Feed preferences and muted topics: Your algorithm configuration choices, muted geographic areas, and muted communities. 2.2 Identity Verification Information (KYC) If you apply for a Verified Persona badge, we collect, for internal identity review only: - Government ID images: A photo of the FRONT and the BACK of a valid government ID (passport, driver's license, or national ID). - A selfie: A photo of your face, used to confirm that the person submitting the ID is its holder. - Identity details: Your full legal name, date of birth, and place of birth, matched against the submitted ID. These images are uploaded to a PRIVATE storage location. They are never displayed on your public profile and are not shared with other users. They are accessible only to a small number of authorized Duruha compliance staff during the review window. Upon approval, the raw ID and selfie images are permanently deleted; we retain only a one-way SHA-256 "identity fingerprint" derived from the images, used solely to detect duplicate or fraudulent re-submissions. See Section 4. - Persona credentials and links: Professional registry links, portfolio URLs, credential references, or travel records submitted to support a persona claim. These may be visible to other community members. We do not grant verification based on self-attestation alone. All personas require objective, verifiable, matching proof. 2.3 Automatically Collected Information The App does not integrate third-party analytics or crash reporting services. We do not collect advertising IDs and do not build advertising profiles. The only automatically collected information is: - App activity signals: Interactions such as votes, saves, shares, and views, used solely to calculate credibility and reputation signals within the platform. - Session authentication tokens: Managed by Supabase Auth, stored securely using Android Keystore-backed storage. - Push notification token: A device push token issued by Firebase Cloud Messaging (a Google service) and stored on our servers (associated with your active persona) so we can deliver notifications. The token identifies your app installation, not you personally, and is deactivated when you sign out or when the operating system refreshes it. See Section 7. -------------------------------------------------------------------------------- 3. How We Use Your Information -------------------------------------------------------------------------------- We use the information we collect to: - Create and manage your account and verified persona - Authenticate your identity and secure your session - Populate and personalize your geographic and interest-based feeds - Display community and content relevant to your location or persona - Calculate and display credibility and reputation signals - Send you push notifications about activity relevant to you - Review and process verification applications - Enforce community safety, investigate reports, and take moderation action - Detect and prevent fraud, spam, impersonation, and misuse - Respond to support requests - Comply with applicable laws and legal obligations We do NOT use your information for targeted advertising. We do NOT use your information to build advertising profiles. We do NOT sell, rent, trade, lease, or license your personal data to any third party. -------------------------------------------------------------------------------- 4. Identity Verification Documents (Private KYC Model) -------------------------------------------------------------------------------- Verification on Duruha is a private "know your customer" (KYC) review. There is NO publicly displayed copy of your ID. The images you submit are never shown to other users. What you submit: - A photo of the FRONT of your government ID. - A photo of the BACK of your government ID. - A SELFIE used to confirm you are the holder of the ID. - Your full legal name, date of birth, and place of birth. How it is handled: - All three images are uploaded to a private, access-controlled storage bucket (`profile-verification-documents`). They are encrypted at rest. - Access is restricted to a small number of authorized Duruha compliance staff under strict confidentiality obligations, only during the review window. - Before upload, the app computes a one-way SHA-256 "identity fingerprint" over the combined image bytes. This fingerprint is checked against existing records so that duplicate or recycled documents are flagged as a potential fraud signal. - Upon approval, the raw ID and selfie images are permanently and securely deleted from our systems. We retain only the non-reversible identity fingerprint hash and the verification outcome — never the images themselves. - If a verification request is rejected, you may resubmit; rejected images are likewise not retained beyond the review. Because the images are never made public, you do NOT need to redact them. Submit clear, unaltered images so review can succeed. Verification does not constitute endorsement. A verified badge means only that the submitted evidence was reviewed and matched the stated persona at the time of approval. It does not guarantee the accuracy of any future statements, advice, or opinions the user may post. -------------------------------------------------------------------------------- 5. Location Data -------------------------------------------------------------------------------- What we collect: If you choose to provide location during onboarding, we collect your device's GPS coordinates (latitude and longitude) using Android's location services. Why: Location is used to place you within our geographic community hierarchy (barangay, city, province, region, country) and to show you geographically relevant content, communities, and posts. Background location: We do NOT request or use background location. Location is captured only during the one-time onboarding step, with your explicit permission. Public visibility: Your raw GPS coordinates are not displayed to other users. Community-level placement (e.g., city or barangay association) may be visible through your profile or content. Control: Location permission is optional at onboarding. You may deny location access and enter your location manually using the geographic hierarchy picker (barangay → city → province → region → country). You may update your location through the edit-identity screen at any time, and you can revoke location permission at any time through your Android device settings. -------------------------------------------------------------------------------- 6. User-Generated Content -------------------------------------------------------------------------------- Content you post on Duruha — including text posts, images, videos, audio recordings, comments, and linked credentials — may be visible to other users of the platform depending on the community context in which it is shared. You should not post sensitive personal information (government ID numbers, financial information, home addresses, phone numbers) in publicly visible posts or comments. If you believe content violates our Community Guidelines, you can report it through the in-app reporting tool. See Section 10 (User Rights) for your deletion rights. -------------------------------------------------------------------------------- 7. Push Notifications -------------------------------------------------------------------------------- Duruha uses Firebase Cloud Messaging (FCM), a service provided by Google, to deliver push notifications about activity relevant to you (such as replies, mentions, and moderation updates). How it works: - When you enable notifications, your device is issued an FCM push token. We store this token in `profile_push_tokens`, associated with your active persona, so we can route notifications to your device. - The token identifies your app installation, not your real-world identity. - The token is deactivated when you sign out (`is_active = false`) and is refreshed periodically by the operating system. - To deliver a notification, the message payload is transmitted through Google's FCM infrastructure. We minimize the personal content included in notification payloads. - Notifications and push tokens are persona-scoped: tokens, preferences, and delivered notifications are all tied to the active persona. - You can disable notifications at any time in your device settings. NOTE: No private or encrypted messaging of any kind is available in the current launch build. The Signal Protocol end-to-end messaging feature was removed (June 9, 2026), and the agenda "private comments" encrypted-thread feature that briefly reused it was removed from the UI (June 14, 2026). All comments on the platform are non-private. If encrypted messaging is re-introduced in a future release, this policy will be updated to disclose the associated data handling. -------------------------------------------------------------------------------- 8. Sharing of Information -------------------------------------------------------------------------------- We do not sell your personal data. We share information only in the following limited circumstances: - Service providers: We use Supabase as our backend infrastructure provider (database, authentication, and file storage). Supabase processes data on our behalf under contractual data processing terms. See supabase.com/privacy. - Push notifications: We use Firebase Cloud Messaging (Google) to deliver push notifications. Your device push token and notification payloads are processed through Google's infrastructure for this purpose. See Section 7 and Google's privacy policy at policies.google.com/privacy. - Font delivery: The App uses Google Fonts, which may result in font requests being sent to Google's CDN. No personal data is transmitted in these requests. - Community visibility: Certain profile information, persona credentials and supporting links you choose to add, posts, and content you create are visible to other authenticated users of the platform. This is core platform functionality. (Your government ID and verification selfie are never part of this — they are private; see Section 4.) - Legal obligations: We may disclose information if required by law, court order, or government authority, or to protect the rights, safety, or property of Duruha, our users, or the public. - Business transfers: [NEEDS FOUNDER CONFIRMATION — if Duruha is acquired or undergoes a corporate transaction, describe how user data would be handled] - Payments: Duruha does not process payments and does not collect any payment or financial data in the current launch build. No payment processor is integrated. If payment processing is added in the future, this section and the Data Safety form will be updated first. We do not share your personal data with advertisers, data brokers, or any third party for marketing purposes. -------------------------------------------------------------------------------- 9. Data Retention -------------------------------------------------------------------------------- Data Category | Retention Period ----------------------------------|-------------------------------------------- Account data (email, profile) | Until account deletion Verification ID + selfie images | Deleted immediately upon approval (and | not retained after rejection) Identity fingerprint (SHA-256) | Retained for duplicate-fraud detection; | removed on account deletion User posts and media | Until deleted by user or account deletion Comments | Until deleted by user or account deletion Reputation and credibility data | Until account deletion Content reports | [NEEDS FOUNDER CONFIRMATION — recommended | 2 years] Exchange / transaction records | [NEEDS FOUNDER CONFIRMATION — feature not | live at launch] Authentication tokens | Session-scoped, managed by Supabase Auth Push notification token (FCM) | Until sign-out, token refresh, or | account deletion -------------------------------------------------------------------------------- 10. User Rights and Controls -------------------------------------------------------------------------------- You have the following rights regarding your data: - Access: View your profile, posts, and settings within the App. - Correction: Update your profile information at any time in settings. - Deletion: Delete your account through the in-app account deletion flow. This permanently deletes your profile, roles, posts, and all associated data via cascade deletion. - Post and comment deletion: You can delete your own posts and comments directly from the App, each behind a confirmation dialog. - Verification data deletion: Your raw ID and selfie images are deleted automatically once verification is approved. You may request removal of your verification record and the loss of your Verified Persona badge by contacting us. - Location control: Location permission can be denied at onboarding or revoked at any time through Android device settings. - Feed control: Mute geographic areas and communities through feed algorithm settings. - Block users: Block another user directly from their profile or from a post. You can block a single persona, or block all personas belonging to that account. Manage and remove your blocks from profile settings. - Withdraw consent: Where processing is based on consent, you may withdraw it at any time. To exercise any of these rights, use the in-app controls or contact us at: [NEEDS FOUNDER CONFIRMATION — privacy contact email] -------------------------------------------------------------------------------- 11. Security -------------------------------------------------------------------------------- We implement the following safeguards to protect your data: - TLS/HTTPS encryption for all data in transit - AES-256 encryption for data at rest on Supabase backend servers - Android Keystore for local cryptographic key storage - Zero-trust access controls for unredacted verification documents - Automatic permanent deletion of unredacted identity documents after verification approval No system is completely secure. If you believe your data has been compromised, contact us immediately at: [NEEDS FOUNDER CONFIRMATION] -------------------------------------------------------------------------------- 12. Children and Minors -------------------------------------------------------------------------------- Duruha is intended for people who are at least 13 years old. We do not knowingly collect personal information from children under 13. If we become aware that a user is below 13, we will suspend the account and delete associated data promptly. Users who are 13 to 17 are treated as minors for child safety enforcement, including our child sexual abuse and exploitation prevention, reporting, and escalation standards. -------------------------------------------------------------------------------- 13. Philippines Context and International Users -------------------------------------------------------------------------------- Duruha is developed and operated by [NEEDS FOUNDER CONFIRMATION — legal entity name], based in the Philippines. By using the App, you understand that your data may be processed and stored on servers operated by Supabase, which may be located in the United States or the European Union. Filipino users have rights under the Data Privacy Act of 2012 (Republic Act No. 10173) and may contact the National Privacy Commission (privacy.gov.ph) for concerns not resolved by Duruha. [NEEDS FOUNDER CONFIRMATION: Confirm whether GDPR or other regional laws apply based on intended user base.] -------------------------------------------------------------------------------- 14. Contact -------------------------------------------------------------------------------- If you have questions about this Privacy Policy, want to exercise your rights, or need to report a privacy concern: Trust and Safety: trust@duruha.social Privacy Contact: [NEEDS FOUNDER CONFIRMATION] Legal Entity: [NEEDS FOUNDER CONFIRMATION] Address: [NEEDS FOUNDER CONFIRMATION] ================================================================================ SECTION 2 — VERIFICATION AND PERMISSIONS POLICY ================================================================================ This policy governs the criteria required to earn verified status and the platform permissions granted to verified personas on Duruha Social. -------------------------------------------------------------------------------- 1. Verified Personas -------------------------------------------------------------------------------- Duruha Social recognizes specific academic, technical, medical, and lifestyle personas, including but not limited to: - Medical Technologists, Doctors, and Healthcare Practitioners - Research Scientists, Academics, and Doctoral Candidates - Certified Technical Specialists, Engineers, and Legal Professionals - Verified Travellers, Travel Bloggers, and Digital Nomads - Any other platform-approved specialist classification -------------------------------------------------------------------------------- 2. Submission Standards -------------------------------------------------------------------------------- To gain and keep a Verified Persona badge, users must: - Submit an authentic, non-expired Government ID — clear photos of the FRONT and the BACK. - Submit a SELFIE confirming they are the holder of the ID. - Submit matching, valid credentials or verification sources matching the name on their ID. This is a universal requirement for all personas. For Professionals: Matching registry listings, valid state/national licenses, or active institutional directory entries. For Travellers: Matching travel-stamped pages and a corresponding public link or travel image catalog showing their presence in those locations. For any other category: Explicit, verifiable proof that is directly traceable to the individual's legal identity. All submitted ID and selfie images are private and used only for internal review; they are never displayed publicly and are deleted on approval. -------------------------------------------------------------------------------- 3. Verification Lifecycles and Re-Verification Trigger -------------------------------------------------------------------------------- Any change to your verified profile parameters triggers an automatic review: - Editing any field linked to your Verified Persona status or updating your registered name will instantly suspend your Verified Persona badge. - To regain verification after making changes, you must re-submit your ID (front and back) and a selfie for manual review. Once approved, the new images are deleted and only the identity-fingerprint hash is retained. -------------------------------------------------------------------------------- 4. Tiered Platform Permissions -------------------------------------------------------------------------------- Verified status grants users distinct system-level permissions: - The Credibility Badge: A distinct badge denoting a verified profession or lifestyle displayed alongside the user's name. - Content Authority: Posts within a verified domain are prioritized in algorithms to combat misinformation and fake reviews. - Moderation and Peer Review: Verified users may gain permission to flag misleading industry-specific content or moderate designated community sub-spaces. - Community Access: Access to restricted professional-only or travel-exclusive communities and local networking spaces. (Private direct messaging is not available in the current launch build.) ================================================================================ SECTION 3 — COMMUNITY GUIDELINES ================================================================================ Duruha is built on trust. These guidelines define the conduct expected of every user on the platform. 1. Be honest about who you are. Do not create fake profiles, impersonate other people, or submit false, forged, or altered verification documents. Misrepresentation of identity or credentials is grounds for permanent removal. 2. No harassment or hate speech. Do not target, threaten, or demean individuals or groups based on race, ethnicity, religion, gender, sexual orientation, disability, nationality, or any other characteristic. Repeated hostile contact with any user is prohibited. 3. No misinformation. Do not deliberately post false information, fabricated news, or misleading content — especially within your claimed area of expertise. Verified personas carry additional responsibility for accuracy. 4. No spam or manipulation. Do not use automated means, fake accounts, or coordinated behavior to artificially inflate votes, reputation scores, or content visibility. 5. No doxxing. Do not publish or solicit another person's private information — home address, phone number, government ID, financial information, or location — without their explicit consent. 6. No scams or fraudulent exchanges. Do not use the platform to conduct fraud, phishing, deceptive solicitations, or any financial scheme that harms other users. 7. No illegal content. Do not post, share, or facilitate content that is illegal under Philippine law or the laws of your jurisdiction, including content that violates intellectual property rights. 8. No sexual exploitation. Do not post sexually explicit content involving minors. This is cause for immediate permanent ban and will be reported to relevant authorities. 9. No threats or incitement to violence. Do not make threats against individuals or groups or post content that incites others to commit violence or illegal acts. 10. Respect verification integrity. Do not attempt to bypass, undermine, or fraudulently obtain verified status. False verification undermines the platform's core trust system and will result in permanent account termination. Enforcement: Violations may result in content removal, temporary suspension, or permanent account termination, at Duruha's sole discretion. Severe violations may be referred to law enforcement. Report violations through the in-app reporting tool or at trust@duruha.social. ================================================================================ SECTION 4 — SAFETY DISCLOSURES ================================================================================ -------------------------------------------------------------------------------- 4A. User Safety Disclosure -------------------------------------------------------------------------------- - Reporting: You can report any post, comment, or user through the in-app reporting tool. Reports are reviewed by Duruha's trust and safety team. - Blocking and muting: You can mute geographic communities and specific community spaces through your feed settings, and you can block individual users from their profile or from a post (either a single persona, or all personas on that account). This satisfies the Google Play UGC blocking requirement. - Moderation: Reports are reviewed by Duruha staff. We do not guarantee real-time review of all reports, but we treat serious violations (threats, illegal content, child safety) as priority. - Verification is not a safety guarantee: A verified badge means Duruha confirmed the identity and credentials at the time of submission. It does not mean Duruha vouches for the user's character, future behavior, or the accuracy of all content they post. - Reputation scores are signals, not proof: Credibility scores reflect platform engagement signals. They are not independent assessments of a person's trustworthiness or expertise. -------------------------------------------------------------------------------- 4B. Verification Disclaimer -------------------------------------------------------------------------------- A "Verified" badge on Duruha means: - The user submitted evidence reviewed by Duruha's compliance team. - The submitted evidence matched the stated persona at the time of review. - The identity document matched the persona credentials. A "Verified" badge does NOT mean: - Duruha endorses the user's opinions, advice, or professional recommendations. - The user's credentials are currently valid, active, or in good standing. - The user will behave appropriately or safely in all future interactions. - Duruha can independently confirm the current accuracy of linked profiles. Verified status may be revoked if a user submits fraudulent documentation, violates community guidelines, misrepresents their professional status, or otherwise abuses the verification system. Content posted by verified personas is for educational, informational, or entertainment purposes only. It does not substitute for professional medical, scientific, legal, or official travel-safety consultations. -------------------------------------------------------------------------------- 4C. Location Safety Disclosure -------------------------------------------------------------------------------- - Duruha uses your location to place you within a geographic community hierarchy for relevance and community matching. - Your raw GPS coordinates are not displayed to other users. - Do not share your exact home address, workplace address, or daily routine in public posts or profile fields. - Location access is captured once at onboarding. You may deny it and enter your location manually. - Duruha does not access your location in the background. -------------------------------------------------------------------------------- 4D. Push Notification Disclosure -------------------------------------------------------------------------------- - Duruha delivers push notifications through Firebase Cloud Messaging (Google). A device push token is stored on our servers to route notifications to your device. - The token identifies your app installation, not your real-world identity, and is deactivated when you sign out. - You can disable notifications at any time in your device settings. - No private or encrypted messaging is available in the current launch build. -------------------------------------------------------------------------------- 4E. Identity Document Handling -------------------------------------------------------------------------------- Verification on Duruha is a private KYC process. The government ID (front and back) and selfie you submit are never displayed on your public profile and are not shared with other users. They are accessible only to authorized Duruha compliance staff during review and are permanently deleted upon approval; only a non-reversible identity-fingerprint hash is retained for duplicate-fraud detection. Because nothing is published, you do not need to (and should not) alter or redact your ID images before submission. ================================================================================ SECTION 5 — IN-APP PERMISSION RATIONALES ================================================================================ These are the user-facing strings to display when Android requests a permission. Use these verbatim (or close to it) in the rationale dialogs. ACCESS_FINE_LOCATION / ACCESS_COARSE_LOCATION: "Duruha uses your location to show you posts, communities, and news relevant to where you live. This is optional — you can skip it and enter your location manually." CAMERA: "Duruha uses the camera only when you choose to take a photo for your profile, a post, or identity verification (your ID and a selfie). It is never accessed in the background." RECORD_AUDIO: "Duruha uses the microphone only when you choose to record a voice note to include in a post. It is never recorded in the background." READ_MEDIA_IMAGES: "Duruha accesses your photo library only when you choose to upload an image for your profile, a post, or verification documents." READ_MEDIA_VIDEO: "Duruha accesses your video library only when you choose to attach a video to a post." READ_MEDIA_AUDIO: "Duruha accesses audio files only when you choose to attach audio to a post." [REMOVE THIS PERMISSION AND RATIONALE if users cannot select existing audio files from storage — only recording new audio is confirmed in the codebase.] ================================================================================ SECTION 6 — PERMISSIONS AUDIT (for developer reference) ================================================================================ Permission | Justified | Notes ---------------------------|-----------|------------------------------------ INTERNET | Yes | All Supabase calls. Essential. ACCESS_FINE_LOCATION | Partial | Used at onboarding for geo-community | | placement. Review if COARSE suffices. ACCESS_COARSE_LOCATION | Yes | Acceptable fallback. Keep as optional. CAMERA | Yes | Profile photo, post photos, and KYC | | (ID front/back + selfie). RECORD_AUDIO | Yes | Voice posts via AudioRecorder in | | create_news_screen.dart. READ_MEDIA_IMAGES | Yes | Image picker for profiles, posts, KYC. READ_MEDIA_VIDEO | Yes | Video in post feed (news_card_media). READ_MEDIA_AUDIO | Unclear | Confirm or remove. See 0A-5 above. READ_EXTERNAL_STORAGE | Yes | Legacy (maxSdkVersion="32"). Correct. (maxSdkVersion=32) | | WRITE_EXTERNAL_STORAGE | Yes | Legacy (maxSdkVersion="32"); used by (maxSdkVersion=32) | | media/file plugins on older Android. POST_NOTIFICATIONS | Yes | FCM push notifications (firebase_ | | messaging). Declared in manifest. NOT requested (confirmed absent — correct): ACCESS_BACKGROUND_LOCATION, MANAGE_EXTERNAL_STORAGE, READ_CONTACTS, SEND_SMS, READ_SMS, BLUETOOTH, accessibility services ================================================================================ SECTION 7 — THIRD-PARTY SERVICES (for developer reference) ================================================================================ Service | SDK | Data sent externally? ------------------|----------------------------|--------------------------- Supabase | supabase_flutter ^2.8.2 | Yes — all user data, | | auth tokens, media files Google Fonts | google_fonts ^6.2.1 | Font CDN requests only | | (no personal data) Firebase Core | firebase_core ^3.15.1 | Firebase initialization Firebase Cloud | firebase_messaging ^15.2.9 | Yes — device push token + Messaging (FCM) | | notification payloads via | | Google FCM Local notif. | flutter_local_notifications| No — local display only | ^17.2.4 | flutter_secure | flutter_secure_storage | No — Android Keystore sqflite | sqflite ^2.4.1 | No — local SQLite only cryptography | cryptography ^2.7.0 | No — local SHA-256 of ID | | images (identity fingerprint) geolocator | geolocator ^14.0.2 | No — GPS to app only image_picker | image_picker ^1.1.2 | No — files to app only file_picker | file_picker ^8.1.4 | No — files to app only record | record ^5.2.1 | No — audio to app only NOTE: libsignal_protocol_dart was REMOVED — private/encrypted messaging is no longer in the launch build (June 9, 2026). The HitPay/payment placeholder key and the unused escrow model were removed (June 14, 2026); no payment SDK or payment data collection ships. Confirmed absent: Google Analytics, Crashlytics, Sentry, Stripe, HitPay, any payment SDK, Meta SDK, AdMob, any ad network, any data broker SDK. (Firebase IS present, but only Core + Cloud Messaging — no Analytics/Crashlytics.) ================================================================================ END OF DOCUMENT ================================================================================ Last updated: June 14, 2026 Next review: Before public launch — resolve all [NEEDS FOUNDER CONFIRMATION] items (legal entity name, contact emails, hosting URL, retention periods for reports, age gate) and update this document before hosting publicly.