Privacy policy

What DuoDucks stores

Your account includes your email address, display name, account dates, and a securely handled password credential. DuoDucks cannot read your password.

The app stores the things you choose to create: duos, invitations, habits, descriptions, daily goals, entries, notes, credit awards, rewards, redemptions, proposals, and inbox items. It also records a coarse device category and the last time you opened the app so the service can be operated and supported.

When you create an account, DuoDucks records how that visit reached the site: the address of the page that linked you here, any campaign labels carried in the link you followed, and the country the visit came from. Search terms are stripped out before any of this is stored, and the country is only a two-letter code worked out at the network edge - your IP address is not passed on and is not kept. All of it is written once at signup and never updated afterwards. It describes where a visit came from, not who you are.

How the data is used

The data is used to provide your account, sync your habits between devices, show shared progress, calculate credits, keep reward history, secure the service, and diagnose faults. These uses are necessary to provide DuoDucks or are legitimate operational interests in keeping it reliable and safe.

The public pages count visits using Cloudflare Web Analytics. It sets no cookies, keeps nothing on your device, and builds no identifier that follows you between sites or visits - it counts pages, not people. It does not run on the signed-in app at all. There are no advertising trackers, no marketing email, and no push notifications. The signup source above stays inside DuoDucks and is only ever read in aggregate, to see which places send people who stay. Technical error reports contain only an account identifier, a general app area, and a short error code - never emails, habit or reward names, entry notes, or other relationship content.

What your duo partner can see

An active duo partner can see your display name and the habits you share with that duo, including their descriptions, entries, notes, progress, credits, rewards, and redemption history. Solo habits stay private. Ending a duo stops new sharing, while the shared credit balance, rewards, and redemption history remain available to both people.

Invite links are meant to be shared with the person you want to join. Anyone who receives a valid link can see the inviter name and duo name before signing in.

Where the data is processed

DuoDucks uses Supabase for authentication and its hosted database. The primary Supabase project is in the West EU (Ireland) region. Netlify serves the website. Cloudflare handles the domain name records and the visit counting described above. These providers may process ordinary security and access logs while delivering their services.

The browser also keeps your login session, interface preferences, cached app data, and any entries waiting to sync. This local storage makes the app work across visits and while briefly offline; it is not used for advertising. For the length of a single visit the browser also holds where that visit came from, so a signup at the end of it can be credited to the right place; closing the tab discards it.

Retention, export, and deletion

Account data is kept while your account is active. Shared credit and redemption records are kept after a duo ends so neither person's history is silently rewritten.

In Settings, Export my data downloads a JSON copy of your account and app records. Delete account permanently removes your login and display name, ends active duos, clears private habit labels and notes, and signs the device out. An anonymous technical profile and the minimum shared ledger rows remain so former partners keep accurate credit and redemption history.

Your choices and rights

You can update your display name, export your data, or delete your account from Settings. Depending on where you live, you may also have rights to access, correct, restrict, object to, or complain about the handling of your personal data. Iceland's data protection authority is Persónuvernd, and EU or EEA residents may also contact their local authority.

Changes to this policy

This page will be updated when DuoDucks changes what it collects or how it uses data. The date at the top shows the current version.