Privacy Policy
We take your privacy seriously. This policy explains how we collect, use, and protect your personal information.
Last updated: 20 January 2025
Quick Navigation
Data Controller Information
Company: QuackDuck.dev
Email: privacy@quackduck.dev
Data Protection Contact: hello@quackduck.dev
Response Time: Within 30 days (as required by GDPR)
Information We Collect
Personal Information You Provide
- Account Information: Name, email address, username when you create an account
- Contact Information: Name, email when you contact us or request support
- Payment Information: Billing details processed securely by our payment providers
- Support Communications: Messages, screenshots, and information you provide for support
Automatically Collected Information
- Usage Data: How you interact with our services, features used, time spent
- Device Information: Browser type, operating system, IP address
- Analytics: Page views, clicks, user flows (anonymized where possible)
- Performance Data: Error logs, crash reports to improve service quality
Information We Don't Collect
- • We don't collect sensitive personal data (health, political views, etc.)
- • We don't store payment card details (handled by secure payment processors)
- • We don't track you across other websites
- • We don't sell your personal information to third parties
How We Use Your Data
Service Provision
- • Provide access to our digital products
- • Process payments and manage accounts
- • Deliver customer support
- • Send service-related communications
Service Improvement
- • Analyze usage to improve our products
- • Fix bugs and technical issues
- • Develop new features and services
- • Ensure security and prevent fraud
Legal Compliance
- • Comply with legal obligations
- • Respond to legal requests
- • Protect our rights and property
- • Enforce our terms of service
Communication
- • Respond to your inquiries
- • Send important service updates
- • Provide technical support
- • Share product announcements (with consent)
Legal Basis for Processing (GDPR)
Contract Performance
Processing necessary to provide our services, manage your account, and fulfill our contractual obligations.
Legitimate Interest
Improving our services, security measures, and business operations where our interests don't override your privacy rights.
Consent
For marketing communications, optional features, and analytics where required by law. You can withdraw consent anytime.
Legal Compliance
When required by law, such as tax obligations, legal requests, or regulatory requirements.
Data Sharing & Third Parties
We Never Sell Your Data
We do not sell, rent, or trade your personal information to third parties for marketing purposes.
Service Providers We Use
Authentication & Database
- • Clerk: User authentication and management
- • Convex: Database and backend services
- • Purpose: Account management, data storage
Hosting & Infrastructure
- • Vercel: Website hosting and deployment
- • Cloudflare: CDN and security services
- • Purpose: Fast, secure service delivery
Payment Processing
- • Stripe/PayPal: Secure payment processing
- • Purpose: Handle transactions securely
- • Note: We don't store payment details
Analytics & Support
- • Google Analytics: Website usage analytics
- • Discord: Community support platform
- • Purpose: Improve services and support
International Transfers
Some of our service providers are located outside the UK/EU. We ensure appropriate safeguards are in place, including:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Adequacy decisions for countries with equivalent data protection
- Strong encryption during transit and at rest
Your Privacy Rights
Under GDPR, you have comprehensive rights over your personal data. All rights can be exercised free of charge.
📄Right to Access
Request a copy of all personal data we hold about you, including how it's used and who it's shared with.
✏️Right to Rectification
Request correction of inaccurate or incomplete personal data we hold about you.
🗑️Right to Erasure
Request deletion of your personal data ('right to be forgotten') in certain circumstances.
⏸️Right to Restrict Processing
Request that we limit how we use your personal data in certain situations.
📦Right to Data Portability
Request your personal data in a portable format to transfer to another service.
🛑Right to Object
Object to processing based on legitimate interests or for direct marketing purposes.
↩️Right to Withdraw Consent
Withdraw consent for processing where consent is the legal basis.
📢Right to Complain
Lodge a complaint with the Information Commissioner's Office (ICO) or your local supervisory authority.
How to Exercise Your Rights
To exercise any of these rights, contact us at: privacy@quackduck.dev
We will respond within 30 days as required by GDPR. For complex requests, we may extend this by an additional 60 days and will notify you.
We may need to verify your identity to protect your personal data from unauthorized access.
Cookies & Tracking
Types of Cookies We Use
Essential Cookies
Required for the website to function properly. Cannot be disabled.
- • Authentication tokens
- • Session management
- • Security features
Analytics Cookies
Help us understand how visitors use our website. Can be disabled.
- • Google Analytics
- • Page view tracking
- • Performance monitoring
Functional Cookies
Enhance your experience with personalized features.
- • Language preferences
- • Theme settings
- • User preferences
Marketing Cookies
Currently not used. If we add them, we'll ask for consent first.
- • None currently used
- • Consent required
- • Opt-in only
Cookie Management
You can control cookies through:
- Your browser settings (disable all cookies)
- Our cookie banner when you first visit
- Google Analytics opt-out: Browser Add-on
- Contacting us to opt-out of specific tracking
Data Security & Protection
Technical Safeguards
- • Encryption: All data encrypted in transit (TLS 1.3) and at rest
- • Access Controls: Role-based access with multi-factor authentication
- • Regular Backups: Secure, encrypted backups with tested recovery
- • Monitoring: 24/7 security monitoring and intrusion detection
Organizational Safeguards
- • Staff Training: Regular privacy and security training
- • Data Minimization: We only collect what we need
- • Regular Audits: Internal security assessments
- • Incident Response: Clear procedures for security breaches
Data Breach Notification
In the unlikely event of a data breach affecting your personal data, we will:
- Notify the relevant supervisory authority within 72 hours (as required by GDPR)
- Inform affected individuals without undue delay if there's a high risk to their rights
- Provide clear information about what happened and what we're doing about it
- Take immediate action to contain and remedy the breach
Data Retention
We only retain your personal data for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, or resolve disputes.
Account Data
- • Active accounts: While your account is active
- • Deleted accounts: 30 days after deletion request
- • Inactive accounts: 3 years without login
Transaction Data
- • Payment records: 7 years (legal requirement)
- • Support tickets: 2 years after resolution
- • Refund requests: 7 years (audit trail)
Analytics Data
- • Website analytics: 26 months (Google Analytics)
- • Error logs: 90 days
- • Performance data: 12 months
Legal Obligations
- • Tax records: As required by local law
- • Dispute resolution: Until resolved + 1 year
- • Legal compliance: As mandated by authorities
Automatic Deletion
We have automated processes to delete data when retention periods expire. You can also request early deletion of your data by exercising your right to erasure (see "Your Rights" section above).
Changes to This Policy
We may update this privacy policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons.
When we make significant changes, we will:
- Update the "Last updated" date at the top of this policy
- Notify you via email or a prominent notice on our website
- For material changes affecting your rights, obtain consent where required
- Archive previous versions for transparency
We encourage you to review this policy periodically to stay informed about how we protect your information.
Privacy Questions or Concerns?
Contact Our Privacy Team
Email: privacy@quackduck.dev
Response Time: Within 30 days
Subject Line: Include "Privacy Request" or "GDPR Request"
Supervisory Authority
This privacy policy was last updated on 20 January 2025