Privacy and your account
Updated September 8, 2026
Account information
Ducky stores your account identifier, login methods, email and its verification status, language, and any profile details you provide. Passwords are stored as salted scrypt hashes, not readable passwords. We use this information to sign you in, recover your account and manage your subscription.
Signing in with Google
Google sign-in requests only openid, email and basic profile permissions. Ducky uses your Google account identifier and verified email to create or link your account. It does not request access to Gmail messages, contacts, Drive or Calendar. Google access and refresh tokens are not retained.
Signing in with X
When X sign-in is enabled, Ducky identifies you by your X account ID and stores your name and avatar. X requires users.read and tweet.read scopes; our sign-in flow only retrieves account details, does not read your posts or post for you, and requests no direct-message or offline access. We do not retain X access tokens. Existing Ducky users can link X in their profile and keep their watchlist and subscription in the same account.
Login sessions and avatars
Ducky uses a local access credential and a secure HttpOnly cookie to keep you signed in. The server stores only a hash of the renewal secret. Sessions renew while you use the app, with sign-in required after 30 idle days or 90 days from login. Logging out revokes this device; password changes revoke all devices. Your browser loads your Google or X avatar from that provider’s image domain without sending a page referrer.
Using the service
Your watchlist, alerts, creator follows and subscription records are used to provide the features you choose. Session credentials remain on your device until they expire or you sign out. Operational events help us diagnose failures; public usage counts omit groups smaller than five people.
Service providers
Cloudflare serves the website and API traffic. Resend processes email addresses and transactional emails, including verification and password recovery. Google processes the sign-in you initiate. Payment providers process the checkout you choose. Telegram receives messages only through Telegram features you use.
Deleting your account
In Account, choose Delete account to clear your profile details, login identities, password, watchlist and alerts, and revoke existing sessions. Payment and subscription records remain for accounting. Public market records do not identify your account. For privacy questions or a data request, contact the operator below.
Privacy contact: @DuckyduckyTradeBot