Privacy Policy

Who Controls Your Data

DuckNotes ("we", "us", "our") is independently developed and operated by an individual developer, who is responsible for the personal data collected through the website and related services. This Privacy Policy explains what we collect, why we collect it, how we use it, when we share it, and what choices and rights you may have. If you have a privacy question, data rights request, regulator inquiry, or complaint, contact us at privacy@ducknotes.org.

What Data We Collect

The data we collect depends on how you use DuckNotes, what features you choose to use, and whether you create an account. We do not ask for more personal data than we reasonably need to run, secure, improve, and support the service.

• Sign-in data - If you choose Google or Apple sign-in, we receive the account email address, display name, and profile image that your provider shares with us. We do not receive your provider password.
• Account and profile data - Username, display name, avatar, bio, school, country, city, privacy settings, account preferences, and similar profile information you choose to save or update.
• Public profile and visibility data - Information you decide to publish on your profile, the visibility settings you choose, and content that other users can see because you made it public or otherwise available through the service.
• Gameplay and library data - Play sessions, session duration, recent history, likes, collections, favorites, ratings, streaks, leaderboards, gaming reports, and other activity records generated by your use of games and product features.
• Community and moderation data - Posts, reviews, comments, replies, uploads, links, reports, moderation feedback, enforcement metadata, audit records, and other information needed to publish, review, remove, or investigate community content.
• Social data - Follows, follower and following relationships, social interactions, notifications tied to social features, and similar user-to-user activity visible through profile and community features.
• Technical and security data - IP address, request logs, browser and device details, approximate network and region information, consent state, cookie signals, pseudonymous identifiers such as device fingerprints, and other diagnostic or anti-abuse telemetry.
• Cookie and local storage data - Session tokens, login state, language and theme preferences, cookie consent settings, analytics identifiers, and optional marketing or attribution preferences stored on your browser or device.

How We Use Data

We use personal data only where we have a valid reason to do so. Depending on the context, that reason may be performing a contract with you, complying with law, pursuing legitimate interests such as safety or product improvement, or relying on your consent where the law requires consent.

• Provide and operate DuckNotes - Create accounts, authenticate users, save settings, maintain profiles, sync library activity, run leaderboards, generate user-facing reports, and deliver core site functionality.
• Support community and social features - Publish posts, reviews, and comments, attach uploaded media, display profile activity, power follows and notifications, and process user-generated content across the service.
• Moderate content and enforce rules - Use automated tools and human reviewers to detect spam, fraud, harassment, violence, sexual exploitation, illegal content, evasion, and other conduct that may violate our policies or the law.
• Measure and improve the product - Understand which pages, games, and features perform well, diagnose bugs, improve reliability, optimize discovery, and analyze how users interact with optional analytics-enabled features.
• Protect users and the platform - Defend against abuse, secure accounts, investigate suspicious activity, prevent manipulation of metrics or rewards, enforce rate limits, and preserve the integrity of our systems and community.
• Meet legal obligations and defend rights - Respond to lawful requests, investigate complaints, keep records required by law, enforce our Terms, handle disputes, and protect the rights, property, and safety of DuckNotes, our users, and third parties.

Third-Party Games And Services

DuckNotes embeds games and may surface links, media, authentication tools, content delivery services, analytics tools, or other services operated by third parties. Those third parties may collect data directly from your browser or device, set their own cookies, display ads, or apply their own terms and privacy notices. We do not control their independent data practices. You should review the privacy notice of each relevant third-party provider before using its products or services.

Cookies And Similar Technologies

We use cookies, local storage, and similar technologies to keep the site working, remember your choices, protect accounts, and understand product usage. Some technologies are strictly necessary, while others are optional and depend on your jurisdiction and consent settings.

• Strictly necessary technologies - Needed for login, session continuity, security, abuse prevention, language preferences, and other core functions that cannot operate properly without them.
• Analytics technologies - Used to measure usage patterns, understand feature performance, and improve the product. Where required by law, we use these only after you give consent and you can later withdraw that consent.
• Marketing technologies - Used for campaign measurement, attribution, referrals, or partner promotion features when those tools are active. These technologies are optional and are not required to use DuckNotes.

How We Share Data

We do not sell personal data in the ordinary sense of selling user lists for money. We share data only when necessary to operate the service, support our infrastructure, process your chosen sign-in method, comply with the law, respond to valid requests, investigate abuse, or protect the rights and safety of DuckNotes, our users, and others.

• Google - Used for Google sign-in and related account authentication flows when you choose that option.
• Apple - Used for Sign in with Apple when you choose that option.
• PostHog - Used for product analytics, subject to your consent choices where required by law.
• Cloudflare and similar edge or security providers - Used for content delivery, DNS, request routing, bot mitigation, and abuse protection.
• Hosting, storage, and infrastructure providers - Used to host the website, serve media, store backups, operate databases, and run our application stack and security tooling.

International Transfers

DuckNotes and some of our service providers may process personal data outside your country, including in the United States and other jurisdictions where our vendors operate. Where applicable law requires safeguards for international transfers, we rely on contractual commitments, transfer assessments, or other lawful mechanisms intended to provide an adequate level of protection.

Security And Retention Controls

We use administrative, technical, and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, or destruction. These measures can include access controls, authentication protections, logging, abuse detection, and vendor controls. No service can guarantee absolute security, and you should also protect your account credentials and devices.

How Long We Keep Data

We keep personal data only as long as reasonably necessary for the purposes described in this Policy. Account and profile data are typically kept while your account is active. Community content and moderation records may be retained for longer where needed to investigate abuse, defend legal claims, keep audit history, or enforce platform rules. When you request deletion, we begin the account deletion workflow and then delete or anonymize data unless a limited retention period is necessary for security, fraud prevention, legal compliance, dispute resolution, or backup rotation.

Automated Review And Safety Systems

DuckNotes may use automated systems to detect spam, fraud, suspicious traffic, abusive conduct, or potentially unlawful or policy-violating content. These systems may flag content for review, temporarily delay publication, or trigger additional verification or moderation steps. Human reviewers may also review flagged material, account activity, or user reports, especially where context matters.

Your Privacy Rights

Depending on where you live, you may have the right to access, correct, delete, export, or limit the use of your personal data, to object to certain processing, or to withdraw consent where processing depends on consent.

• Access - Ask for a copy of the personal data we hold about you and information about how we process it.
• Correction - Update inaccurate or incomplete profile, account, or contact information.
• Deletion - Ask us to delete your account and associated personal data, subject to legal or security-related exceptions.
• Portability - Ask for an export of data you provided to us in a machine-readable format where applicable.
• Objection - Object to certain processing based on legitimate interests or opt out of optional analytics and marketing technologies.
• Restriction - Ask us to limit certain processing in situations allowed by law.

You can exercise some of these rights directly through in-product tools, such as profile editing, privacy settings, data export, and account deletion. You may also contact us at privacy@ducknotes.org. We may need to verify your identity before acting on a request, and you may have the right to complain to your local data protection authority or other regulator.

Regional Privacy Disclosures

Users in the EEA, UK, and Switzerland may have rights under GDPR or similar laws, including rights to object, restrict processing, and complain to a supervisory authority. Users in California and certain other U.S. states may have rights to know, access, delete, and correct personal information, as well as rights related to certain disclosures or profiling practices under applicable state law. The exact scope of your rights depends on your location and the law that applies to you.

Children's Privacy

DuckNotes is not intended for children under 13, and we do not knowingly collect personal data from them. If you believe a child under 13 has provided personal data to us, contact us at privacy@ducknotes.org and we will investigate and delete the data where required. Parents and guardians should also review the practices of third-party game publishers and service providers that may appear on the platform.

Changes To This Policy

We may update this Privacy Policy when the service, our vendors, our data practices, or applicable law changes. If the changes are material, we will post a clear notice on the site or use another appropriate notification method before the update takes effect. The effective date shown below reflects the most recent revision.

Contact

If you have questions about this Privacy Policy, our data practices, or how to exercise your rights, contact us at privacy@ducknotes.org.