Privacy policy
Last updated: June 8, 2026
duckhunt processes as little data as possible — only what the tool needs to work. This page explains what we collect, why, and what control you have.
Data controller
The controller of the data collected when you use duckhunt is the person who operates this tool. For any privacy matter you can reach out at [email protected].
What data we process
To use duckhunt you create an account with your email and a password. The password is always stored hashed, never in plain text. We keep the minimum data needed to identify you and provide the service.
To keep you signed in we store a session identifier (a token kept in hashed form), the session start and expiry dates, and your browser or device identifier (user-agent). This lets you review and revoke your active sessions from settings.
We also process the data you generate while using duckhunt: the content and actions that are part of the tool itself, needed for it to work.
How we use it
We use this data solely to authenticate you, keep your session, provide the service and keep it secure (for example, detecting unauthorized access). We do not use it for any other purpose without your consent.
duckhunt ships no third-party analytics, trackers or advertising SDKs. We do not sell or share your data, and we do not build advertising profiles.
Where it is stored
Data is stored in duckhunt's own service database, on its server. It is not transferred to third parties, except, where applicable, to the sign-in provider during authentication.
In the mobile app, your session is stored only on your device (the app’s native storage) to keep you signed in between uses.
How long we keep it
Sessions expire automatically and are deleted when they do, or when you log out. The temporary codes issued during sign-in on the mobile app live for only a few seconds and are discarded after a single use.
Your account data is kept while your account stays active. If you ask to close it, the data is deleted unless we must retain something to meet a legal obligation.
Your rights
You may request access, rectification, erasure and portability of your data, and object to or restrict its processing, under the General Data Protection Regulation (GDPR).
To exercise any of these rights, or if you have questions about how your data is processed, write to [email protected]. You may also lodge a complaint with your competent data protection authority.
Mobile apps
duckhunt’s mobile apps bundle the same interface as the web version and talk to the same service. They request the minimum permissions required to work and collect no device data beyond what this policy describes.
Changes to this policy
If we change this policy, we will publish the updated version on this same page with its new last-updated date. We recommend reviewing it from time to time.
Connected services
duckhunt brings the tasks scattered across your other services into a single board. When you connect a source (for example Jira/Atlassian, Gmail/Google or Wakatime), we store the credentials or access tokens needed to read from it, and pull only the data required to build your tasks. We only access the sources you authorize, and solely to show them to you inside duckhunt.
You can disconnect any source from settings; when you do, we delete its credentials and stop accessing that service.