Privacy Policy

QuackPort ("we," "us," or "our") operates the website quackport.com (the "Service"). This Privacy Policy explains what information we collect, how we use it, who we share it with, and your rights regarding your data. By using the Service you agree to the practices described here.

When you register we collect your email address. Optionally you may add a display name, home city and state, and a profile photo. Your email is used for authentication, email verification, transactional notifications, and support.

When you log a duck sighting you provide a location (city, state/region, country). You may optionally provide GPS coordinates (if you allow browser location access), a text message, and a photo. This information is displayed publicly on the duck's travel history and the global map.

When you submit a duck sighting we record your IP address, and use a third-party geolocation service (ip-api.com) to look up your approximate city, region, country, ISP, ASN, and flags indicating whether the connection appears to be a proxy, hosting provider, or mobile network. This data is used only to calculate a trust score for the sighting — it helps us detect spoofed locations and is never displayed publicly. Trust metadata is removed if your account is deleted.

We record your browser user agent string alongside duck sightings as part of the same trust scoring system. We do not build persistent device fingerprints or track you across sessions for advertising.

If you place an order we collect your shipping name and address and email. Payment processing is handled entirely by Stripe — we never see or store your card number, CVV, or full payment details. We retain order records (items, amounts, shipping address) for financial and legal compliance even if your account is later deleted, but your personal details are anonymized on deletion.

If you contact us via the contact form we receive your name, email, subject, and message. We use this information solely to respond to your enquiry.

Like most web services, our servers log standard request metadata including IP addresses, timestamps, pages visited, and HTTP status codes. These logs are used for security monitoring, debugging, and abuse prevention, and are retained for a limited period.

• Provide the Service — authenticate your account, display duck travel histories, power the global map, and process store orders.
• Trust and safety — score the credibility of submitted duck sightings to detect fake or spoofed locations. Sightings with low trust scores are held for admin review rather than shown automatically.
• Transactional email — send account verification, password resets, order confirmations, shipping notifications, and duck-found alerts. We do not send marketing email.
• Support — respond to contact form enquiries and handle account or order issues.
• Security and abuse prevention — detect and block spam accounts, ban evasion, and malicious activity.
• Legal compliance — retain financial records as required by applicable law.

We do not sell your personal information. We share data only in the following limited circumstances:

• Publicly displayed content — duck sighting locations, messages, and photos you submit are shown publicly on the Service (the duck's history page, the global map). Your display name is shown if you have set one.
• Service providers — we use third-party vendors to operate the Service (see Section 5). These providers access only the data needed to perform their function and may not use it for other purposes.
• Legal requirements — we may disclose information if required by law, court order, or to protect the rights, property, or safety of QuackPort, our users, or the public.

We use the following cookies:

• Authentication cookie — keeps you logged in for the duration of your session or "Remember Me" period. This is essential for the Service to function.
• Anti-forgery token cookie — protects forms from cross-site request forgery attacks. Also essential.
• Cart cookie — stores a temporary guest cart identifier if you browse the store without an account.
• TempData cookie — carries one-time flash messages between page loads (e.g. "Sighting saved").

We display advertisements served by Google AdSense (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Google AdSense uses cookies — including the DoubleClick cookie — to serve ads based on your prior visits to this and other websites. These cookies allow Google and its partners to serve ads based on your interests and to measure ad performance.

You can opt out of personalised advertising by visiting Google Ad Settings, or opt out of third-party vendor cookies by visiting the NAI opt-out page. You can also disable cookies in your browser settings, although this may affect the functionality of the Service.

For more information on how Google collects and uses data from sites that use its advertising services, see How Google uses data when you use our partners' sites or apps.

The following third-party services are used and may process some of your data:

• Stripe (stripe.com) — payment processing and tax calculation. Stripe processes card details directly; we never receive them. See Stripe's Privacy Policy.
• Shippo (goshippo.com) — shipping rate calculation and label generation for store orders. Your shipping address is sent to Shippo to obtain rates. See Shippo's Privacy Policy.
• Resend (resend.com) — transactional email delivery. Your email address is passed to Resend to deliver system emails. See Resend's Privacy Policy.
• Google AdSense (google.com) — advertising displayed on the Service. Google may use cookies and device identifiers to show personalised ads. See Google's Privacy Policy and Google's advertising policies.
• OpenStreetMap / Nominatim (openstreetmap.org) — map tiles for duck location maps and address-to-coordinate geocoding. Location queries are sent to Nominatim when you search for a place. See OSM Privacy Policy.
• ip-api.com — IP address geolocation used for trust scoring on duck sightings. Your IP address is sent to this service when you submit a sighting. See ip-api.com legal page.

• Account data is retained until you delete your account.
• Duck sighting logs are retained indefinitely to preserve the duck's travel history. Upon account deletion, your sightings are kept but unlinked from your identity.
• Store orders are retained for financial and legal compliance. Upon account deletion, your name, email, and shipping address on those orders are anonymized but order amounts and line items remain.
• Trust and IP data attached to sightings is removed upon account deletion.
• Server logs are typically retained for 30–90 days.
• Ban registry — if your account is banned, a one-way hash (SHA-256) of your email is retained to prevent re-registration. This hash cannot be reversed to your email address.

Depending on where you are located you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Correction — update your account information at any time via your account settings.
• Deletion (Right to Erasure) — request deletion of your account and personal data. You can do this yourself via your account settings, or by contacting us. We will anonymize your account in accordance with GDPR Article 17. Note that duck sighting records are preserved anonymously and store order records are retained for legal compliance.
• Portability — request a copy of data you have submitted to us in a machine-readable format.
• Objection / Restriction — object to certain processing of your data or request we restrict it.

To exercise any of these rights, please use our contact form or email support@quackport.com. We will respond within 30 days.

If you are in California, you have additional rights under the CCPA including the right to know, delete, and opt-out of the sale of personal information. We do not sell personal information.

If you are in the EU or UK, you may lodge a complaint with your local data protection authority if you believe we have not complied with applicable data protection law.

You may delete your account at any time from your account settings page. Deletion is immediate and irreversible. Upon deletion:

• Your email, display name, home location, profile photo, and password are permanently removed.
• Your duck sighting logs are preserved but unlinked from your identity.
• Your points and achievements are deleted.
• Store order records are retained with personal details anonymized.
• You will receive a confirmation email before your address is wiped.

The Service is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us and we will delete it.

We use industry-standard practices to protect your data, including HTTPS encryption in transit, hashed and salted password storage, and least-privilege access controls. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of the Service after changes are posted constitutes your acceptance of the revised policy.

For any privacy questions, data requests, or concerns:

• Email: support@quackport.com
• Contact form: quackport.com/Contact