Privacy policy

Last updated: 5 September 2026

Diwigo is a social network designed to nurture real relationships, not to exploit your data. This page explains in plain language what information we process, why, and what you can require at any time.

Who is responsible for your data

Diwigo is published and operated by Dukiwi SA, a Swiss company based in Estavayer-le-Lac. It decides the purposes and means of processing your personal data, and it is the party to contact with any question about them.

Dukiwi SA
Grand-Rue 18
1470 Estavayer-le-Lac
Switzerland
info@diwigo.com · www.dukiwi.com

The data we process

We only collect what is necessary for the service to work:

• Account: last name, first name, display name, e-mail address and password. The password is never stored in clear text: it is hashed with bcrypt and remains unreadable, including to us.
• Profile: the information you choose to add — biography, photo, cover image, phone, address, city, country. Each of these items has its own visibility setting.
• Content: your posts, comments, reactions, as well as the images and videos you upload.
• Relationships: your contacts, your circles and the history of your interactions, which feed the service's reminders and metrics.
• Technical data: IP address, browser type and connection logs, kept for security purposes (detecting intrusion attempts and brute-force attacks).

We do no advertising profiling and build no behavioral profile for commercial purposes.

Why we process this data

• Providing the service: displaying your feed, your circles, your relationships and your posts.
• Protecting accounts: detecting suspicious sign-ins, limiting sign-in attempts, enabling two-factor authentication.
• Notifying you of interactions that concern you, by notification or by e-mail depending on your settings.
• Fixing technical errors and improving the service.

On what legal basis

Every processing operation rests on a specific ground, under the Swiss Federal Act on Data Protection (FADP) and the European regulation (GDPR, art. 6(1)):

• Performance of the contract (GDPR art. 6(1)(b)): everything without which the service would not work — your account, your posts, your circles, the delivery of your messages.
• Legitimate interest (art. 6(1)(f)): the security of accounts and of the service — connection logs, intrusion detection, rate limiting. That interest is yours as much as ours.
• Your consent (art. 6(1)(a)): the optional details of your profile and e-mail notifications. You can withdraw it at any time from your settings, with no need to justify yourself.

Diwigo is a Swiss service, subject to the FADP. The GDPR applies on top of it for members residing in the European Union. Rather than treating members differently depending on their country, we apply the more protective of the two regimes to everyone.

You decide who sees what

Every post has its own visibility: public, restricted to certain circles, or strictly private. The information in your profile works the same way, item by item.

Who this data is shared with

We do not sell or rent your data, to anyone, ever. It is passed on only to the providers strictly necessary for the service to work:

• Hosting: Infomaniak, in Switzerland. Your data and your files stay on Swiss servers.
• Sending e-mails: Infomaniak's mail server, for invitations and notifications.
• Authorities: only upon a valid legal request, and strictly within the limits of what is required.

Transfers abroad

Your data and your files are hosted exclusively in Switzerland, with Infomaniak. Neither your account content, nor your posts, nor your images leave Swiss territory, and nothing is transferred to a third country.

One exception, purely technical, deserves to be stated rather than hidden: the site's icons (Font Awesome) and the charting library used by the Metrics page are loaded from a foreign delivery network, cdnjs, operated by Cloudflare. Your browser then sends it your IP address, as it would for any external resource. No account data is involved, and this is the only outside call the site makes.

How long we keep it

• Your account data is kept for as long as the account exists.
• Technical security logs are kept for a maximum of twelve months, then deleted.
• When your account is deleted, your personal data and your content are erased. The messages you have sent to other members may remain in their own feed, like a letter that has been received.

Cookies

Diwigo only uses cookies that are essential or that correspond to an explicit choice on your part:

• Session cookie: keeps you signed in during your visit. Essential, and cleared when you close your browser.
• remember_me: set only if you tick "Remember me". It holds a random token, never your password, and lasts thirty days.
• dw_theme: remembers your light or dark theme choice, for one year.
• dw_lang: remembers the language you want the site in, for one year.
• dw_cookie_consent: records that you have read this notice, so the banner stops appearing. One year as well.

No advertising cookies, no audience measurement tools, no cookies set by a third party.

How we protect your account

Exchanges are encrypted with HTTPS. Passwords are hashed with bcrypt. You can enable two-factor authentication via an app (six-digit code) and hold backup codes. Sign-in attempts are rate-limited, and a password change occurring just after a sign-in with a backup code freezes the account until your identity is verified — a protection against account takeovers.

Your rights

In accordance with Swiss data protection law and the GDPR, you have the following rights:

• Access: knowing what data concerning you we process.
• Rectification: correcting your information yourself from your profile, at any time.
• Erasure: requesting the deletion of your account and your data.
• Data portability: obtaining a copy of your data in a machine-readable format.
• Objection: objecting to a processing operation, in particular declining e-mail notifications from your settings.

To exercise one of these rights, write to info@diwigo.com from the address associated with your account. We reply within thirty days.

Minors

Diwigo is not intended for children under thirteen. If you notice that an account has been created by a younger child, report it to us and we will delete it.

Changes to this policy

If we make significant changes to this policy, we will inform you on the site or by e-mail before the changes take effect. The date of the last update appears at the top of this page.

Complaints

Write to us first: most situations are settled in a couple of exchanges. If our answer does not satisfy you, you may refer the matter to the Federal Data Protection and Information Commissioner (FDPIC, Bern). If you reside in the European Union, you may also refer it to the supervisory authority of your country of residence.

Contact us

A question, a doubt, a request? Write to info@diwigo.com. A real person will answer you.