Privacy Policy

Quacking Ducks (“we”, “us”) operates qducks.com and its related services at family.qducks.com, staff.qducks.com, and api.qducks.com. This policy covers all of them.

For any privacy question or request, contact us at support@qducks.com or through our contact page.

Account information. Your email address, username, date of birth, preferred language, and — if you add them — a profile avatar and bio. Passwords are never stored in readable form; we store only a salted hash.

Sign-in data. Session records, email verification codes, and two-factor (TOTP) settings. If you sign in with Google, GitHub, Apple, or Discord, we store that provider’s account identifier and the verified email address it gives us — we never receive your password for those services.

Family & parental controls. Parent–child links, claim codes, blocked apps, screen-time policies and usage, app access requests, family membership, and family chat messages.

Identity verification. If you choose to verify your identity, the documents and images you submit, plus the resulting status. These are used solely to confirm identity and are treated as sensitive.

Security & activity. Login events (including IP address and browser user-agent), audit logs of significant actions, and anti-abuse signals. These protect your account and let us investigate misuse.

Product activity. Gems and their transaction ledger, quests, cosmetics, vouchers, app reviews and favourites, roadmap votes, support tickets, and reports you file.

We use only what the site needs to function. We do not use advertising or cross-site tracking cookies.

• qd_session — keeps you signed in (essential).
• qd_theme, qd_locale, qd_nav_collapsed — remember your theme, language, and layout preferences.
• Short-lived sign-in cookies used during a social login to protect against cross-site request forgery. They expire within minutes.

To create and secure your account; to provide family and parental-control features; to deliver rewards, quests, and cosmetics; to answer support requests; to detect and prevent abuse, fraud, and security incidents; and to meet legal obligations.

We do not sell your personal data, and we do not use it for behavioural advertising.

We share data only with service providers who process it on our behalf, under contract, and only as needed to run the service:

• Vercel — website and application hosting.
• Supabase — database and file storage.
• Cloudflare Turnstile — bot and abuse protection on sign-up forms.
• Email delivery providers — verification codes, alerts, and support replies.
• Google Translate — powers on-the-fly interface translation. Only interface text is sent, never your account data.
• Google, GitHub, Apple, Discord — only if you choose to sign in with them, and only to complete that sign-in.

We may also disclose information where legally required, or to protect the rights and safety of our users — particularly children.

Quacking Ducks is family-oriented and we take this seriously. If a user indicates they are under 13, their account is held in a limited state and cannot be used until a verified parent or guardian claims it through family.qducks.com using a one-time claim code.

Parents and guardians who have claimed a child account can review that child’s information, control which apps they can access, set screen-time limits, approve or deny requests, and request deletion of the child’s account and data at any time.

We collect only what is needed to operate these features. If you believe a child has created an account without the required parental involvement, contact support@qducks.com and we will remove it promptly.

We keep account data for as long as your account exists. Security and audit logs are kept for a limited period for fraud prevention and incident investigation. When you delete your account, we remove your personal data and anonymise anything we must keep for legal or security reasons.

You can access and correct most of your information directly in your settings. You may also request a copy of your data, ask us to correct or delete it, object to certain processing, or withdraw consent where processing relies on it.

Account deletion can be requested from your settings, or by emailing support@qducks.com. Depending on where you live, you may also have the right to complain to your local data protection authority.

All traffic is encrypted in transit. Passwords are salted and hashed. Optional two-factor authentication is available, and we send login alerts for new sign-ins. Database access is restricted with row-level security, and sensitive actions are audit-logged.

No online service can promise perfect security, but if a breach ever affects your personal data we will notify you and the relevant authorities as required by law.

Our providers may process data in countries other than yours. Where that happens, we rely on appropriate safeguards — such as standard contractual clauses — to protect your information.

We may update this policy as the service evolves. The “last updated” date at the top always reflects the current version, and we will give notice in the app for significant changes.

Questions, requests, or concerns? Email support@qducks.com or use our contact page. We read everything. 🦆