Privacy Policy

Last updated: June 4, 2026

AquaDucked! ("the Game") is created by NickTheDuck. This privacy policy explains what information we collect when you play, how we use it, and the choices you have.

The core game can be played entirely offline without an account. Signing in is optional and is only required for online features (the Pond community level browser, follows, likes, cloud sync of progress, and leaderboards).

Information We Collect

Account Information (only if you sign in):

• Email address — used as your sign-in identifier and for account recovery.
• Username — the display name you choose, shown on your published levels and social activity.
• Password — stored only as a one-way cryptographic hash; we cannot view or recover it.

Game Activity (only if you sign in):

• Level completion data: which levels you've finished, star rating, best times, and launches used.
• Social activity: users you follow, levels you like, collections you create.
• Leaderboard scores you submit.

User-Generated Content (only if you sign in and publish):

• Levels you publish to The Pond, including the level data, the title you provide, and basic metadata such as upload date and download count.
• Reports you file about other users' levels.
• Ghost replays you upload.

Technical Information:

• IP address — transmitted as part of any HTTPS request to our backend, used for security, abuse prevention, and standard server-side request handling. Not used to track you across sessions or to derive precise location.
• Crash and diagnostic information — if the Game crashes, anonymous crash details may be transmitted to help us fix bugs. This data is not linked to your account.

Information We Don't Collect

• We do not collect your real name, phone number, mailing address, or government identifiers.
• We do not collect precise or coarse location data.
• We do not access your contacts, photos, camera, microphone, calendar, or files.
• We do not collect payment or financial information.
• We do not collect web browsing history or activity outside the Game.
• We do not use third-party advertising networks or behavioral ad tracking.

How We Use Your Information

• To provide online features: cloud sync of progress, social interactions, and the Pond community level browser.
• To maintain security: authenticating sign-ins, preventing abuse, and enforcing community guidelines.
• To improve the Game: aggregated and anonymized statistics about gameplay help us balance levels and fix issues.
• To communicate about your account when necessary (for example, password resets you initiate).

How Information Is Shared

We do not sell your information. We share information only in the following limited cases:

• Publicly within the Game: when you publish a level, like a level, or follow another user, your username and that activity are visible to other signed-in players.
• Service providers: we use Supabase as our backend hosting and authentication provider. Supabase processes your data on our behalf and is bound by its own privacy policy.
• Legal compliance: we may disclose information if required by law, court order, or to protect the safety of users.

Data Security

All communication between the Game and our backend is encrypted in transit using HTTPS (TLS 1.2 or higher). Passwords are stored as one-way cryptographic hashes and are never accessible in plaintext. Database access is restricted by row-level security policies so users can only access and modify their own data.

Your Choices and Controls

• Play without an account: the offline portions of the Game are fully playable without signing in.
• Unpublish or delete individual levels: you can remove any level you have published to The Pond at any time.
• Manage social connections: you can unfollow users and unlike levels at any time.
• Delete your account: you can request full deletion of your account and all associated data at aquaduckedgame.com/delete-account.html.

Data Retention

Account data is retained while your account is active. When you request deletion, your account and associated personal data are removed within 7 business days. Encrypted database backups may briefly retain deleted data for up to 30 days as part of standard disaster-recovery rotation, after which they are overwritten. Anonymized aggregate statistics may be retained indefinitely.

Children's Privacy

AquaDucked! is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at the email below and we will delete the account.

Third-Party Services

The Game relies on the following service providers:

• Supabase — authentication and backend data storage. See Supabase's privacy policy.
• Google Play — app distribution and (on Android) in-app updates. See Google's privacy policy.

Changes to This Policy

We may update this privacy policy from time to time. Any changes will be reflected on this page along with an updated "Last updated" date. Material changes will be highlighted in-game when you next sign in.

Contact

If you have questions about this privacy policy or your data, contact us at aquaduckedgame@gmail.com.