PRIVACY POLICY

Playing as a guest

You need a guest account or a full account to play. Opening a game, leaderboard or Hall of Attempts page creates a guest account automatically, with no email or password. For a guest we store:

• A generated username and the default silhouette avatar. You can choose your own only after you create an account.
• Your Duck Tiles daily results and stats (guesses, time, whether you solved it, streaks), as for a full account.
• Your Duck Tiles Marathon and Duck Down runs (guesses, scores and time taken).
• The days you played each game, kept for about a week (see Daily reminders below).

These are stored on our servers, not only on your device. A guest account can't be recovered once you sign in to another account or clear your browser data.

When you create an account from a guest account you choose a username. We hold your chosen username on our servers until you confirm your email, then apply it. If someone else has taken it in the meantime, we ask you to pick another.

What we collect for a full account

• Your email address, used to sign you in and to send account emails (confirming your address, resetting your password).
• Your password, stored only in hashed form by our sign-in provider — we can never see it.
• A username and avatar you choose.
• Your results for each game: Duck Tiles daily results (guesses, time, whether you solved it) and stats (streaks, win rate), Duck Tiles Marathon results, and your best Duck Down score for each day you play.
• Games you're part-way through, so you can carry on where you left off.
• The days you played each game, kept for about a week (see Daily reminders below).
• Basic sign-in records, such as when you last signed in.

On your device

A sign-in cookie keeps you logged in, including as a guest. Your sound and music settings, dismissed announcements and reminder banner, and current Duck Tiles game are kept in your browser's local storage. If your browser supports it, we also store a small offline page and the Ducktionary icon so you see a friendly message instead of an error when you have no connection. This holds no personal data. We don't use advertising or tracking cookies.

Daily reminders

If you turn on daily reminders, we store this device's push address (a link your browser gives us for sending it notifications) and any games you've switched off. Reminders are per device, for guests and full accounts alike.

So we don't remind you after you've played, we record which days you played each game, whether or not reminders are on. These records are deleted after about a week.

Turning reminders off deletes this device's push address, and so does signing out.

Who can see it

Your username, avatar and results appear on the leaderboards and in the Hall of Attempts, where other players can see them. This includes guests, who appear with their generated name and silhouette avatar. Guests are marked with a Guest badge. The Duck Down leaderboard shows your best Duck Down score for each day you played as well as your all-time best. Your email and detailed stats are private to your account.

Who we use

• Supabase stores your account and game data, in London.
• Vercel hosts the site and collects anonymous page-view and performance data, without cookies.
• Mailgun sends account emails, from its EU region.
• Have I Been Pwned is used to check new passwords against its list of leaked passwords. Only the start of a scrambled copy (a hash) is sent, so it never sees your password.
• If you turn on daily reminders, your browser's own push service delivers them: Google (Chrome and Android), Apple (Safari, iPhone and iPad), Mozilla (Firefox) or Microsoft (Edge). Reminders are encrypted, so the push service can't read them.

They process your data only to run Ducktionary. We don't sell your data or use it for advertising.

Deleting your data

You can delete your account at any time, guest or full: open your Profile and tap Delete account. Deletion is immediate and permanent, and removes your profile, email, stats and leaderboard scores, including a guest's. It also removes any pending username and your reminder settings and push addresses.

Copies in our providers' backups and service logs are deleted automatically on their own retention schedules.

If you can't sign in, email hello@davethedevcodes.com to request deletion of your account and associated data.