data policies

Data retention policy

duckhunt stores the minimum it needs to show your work in one place: the items returned by the sources you connect (tickets, pull requests, emails, calendar events, monitoring alerts), the Slack messages you explicitly send to duckhunt, and the tasks, notes and settings you create in the app.

From each source, duckhunt pulls only what concerns you: tickets assigned to you, your pull requests, the emails matching your filter. Chat messages (for example Slack) only enter when you explicitly send them to duckhunt; channels and conversations are never read, monitored or stored in the background. For a captured message it stores the text, author, channel, a permalink and a short excerpt of the thread so the task keeps its context.

Captured data is retained for as long as your account exists; there is no automatic expiry. You decide what stays by deleting your account (see the removal policy). App sessions expire automatically, and each source's credentials are kept only while that source is connected.

Data archival & removal policy

duckhunt has no separate archive tier: archiving a task only hides it from the board; the data stays in the live database and nowhere else. No copies are sent to third-party services.

Disconnecting a source from settings deletes its access tokens immediately and stops all ingestion from that service. Items already captured remain in your account until you delete it.

You can delete your account at any time from settings (password confirmation required); the instance administrator can also remove accounts. Deletion is immediate and permanent: all your tasks, captured items, events, notes, credentials, sessions and settings are hard-deleted in a single transaction. There is no soft delete and no recovery window.

Short-lived database backups are kept for disaster recovery; deleted data disappears from them as backups rotate. To request removal of specific data, write to [email protected].

Data storage policy

duckhunt runs as a single self-contained instance. All data lives in the instance's own database, on the server that runs the application: it is not replicated to external databases, data warehouses or analytics services, and it is never sold or shared.

Data is always encrypted in transit: the app is served exclusively over HTTPS (TLS), and every call to connected providers (Slack, Atlassian, Google, …) uses TLS as well. At rest, the database is readable only by the application process; passwords are stored as scrypt hashes, and provider tokens never leave the server or reach the browser.

Your data is visible only to your own account, and it leaves the instance only when you access it yourself through an authorized client: the web app, the mobile app, or a personal MCP client you have explicitly authorized via OAuth.

Each integration requests the minimum scopes it needs, read-only wherever possible. duckhunt only writes to a connected service when you explicitly ask it to (for example, posting a comment on a Jira issue or Bitbucket pull request); it never posts, edits or deletes anything on its own.