Privacy Policy

1. Information we collect

You provide: account data (email, password hash, handle, display name, profile, links), the projects, discussions, likes, and deal records and deal messages you create.

Automatically: operational logs including IP address and user agent, kept for security, abuse prevention, and audit; usage analytics (pages visited, referrer, device and browser type, and an approximate location) collected by our self-hosted analytics, which anonymizes (masks) your IP address before storing it; and cookies (see §8).

From services you connect: sign-in methods you add (OAuth account identifiers, passkey public keys, 2FA state) and repository connections you authorize (access tokens stored encrypted, used only for the repository features you invoke).

2. How we use it

To operate the marketplace: authentication, ownership verification, listings, auctions and ownership deals, transactional email (verification, password reset, and — where enabled — notifications), moderation, and abuse prevention. We do not sell personal data or use it for third-party advertising.

3. Legal bases (EEA/UK users)

Where the GDPR/UK GDPR applies, we process personal data on the bases of: performance of a contract (operating your account and transactions), our legitimate interests (security, abuse prevention, improving the service), legal obligation, and consent where required (e.g. certain cookies).

4. How we share it

Service providers (processors): Amazon Web Services (Amazon SES) processes recipient email addresses to deliver transactional email; Cloudflare processes network traffic (including IP addresses) for delivery and security. They act on our instructions and only for these functions.

Services you authorize: when you connect GitHub or GitLab, we access your repositories and account information using tokens you grant, solely to provide repository and verification features. This access is initiated by you.

Legal and safety: we may disclose data where required by law or to protect the rights, safety, or security of users, the public, or loveyducky. We do not otherwise sell or rent personal data.

5. International transfers

Because we operate globally and use the providers above, your data may be processed outside your country, including outside the EEA/UK. Where required, such transfers rely on appropriate safeguards (e.g. standard contractual clauses).

6. Retention

We keep personal data while your account is active and as needed for the purposes above. Deleting your account removes personal data and anonymizes your profile; your handle is reserved to prevent impersonation, and completed deal and audit records are retained in de-identified form as transaction history. Email addresses that hard-bounce or complain are kept on a suppression list so we stop emailing them.

7. Your rights

Subject to applicable law, you may access, correct, export, or delete your personal data, and object to or restrict certain processing. Much of this is self-service in Settings; for anything else, contact the officer below. You may also lodge a complaint with your local data protection authority (in Korea, the Personal Information Protection Commission).

8. Cookies and analytics

We use a session cookie to keep you signed in and short-lived cookies for sign-in flows (e.g. passkey challenges). These are essential and do not require consent.

With your consent (via the cookie banner), our analytics sets cookies to recognize your device across visits. Analytics runs on our own infrastructure (self-hosted Matomo) — no data is sent to any third-party analytics vendor. If you decline, analytics runs without those cookies: we still record individual page visits for statistics, but without cookies that link your visits over time. In all cases your IP address is anonymized (masked) before storage, and raw analytics data is deleted after 13 months. You can change your choice at any time via “Cookies” in the footer. We do not use third-party advertising cookies.

9. Personal Information Protection Officer

Officer: An Hyukjin · Contact: [email protected]. Please direct privacy questions and rights requests here.

10. Children

loveyducky is not directed to children under the age required by your jurisdiction (at least 14 in Korea). We do not knowingly collect data from them; if you believe we have, contact the officer above.

11. Changes to this policy

We may update this policy. Material changes will be announced on the service, and the effective date above will be updated. This document is a pre-legal-review draft.