DuckoLab.com · Version duckolab-2026-10-04

Privacy policy

DuckoLab.com uses the information described below to operate accounts, subscriptions, protected publishing and runner authorizations. For privacy questions, data access, correction or deletion, contact [email protected]. We will verify that you own the account before fulfilling your request.

Information the service uses

Account data includes your email address, password hash, verification status, sign-in sessions and security events, including sign-in times and source IP addresses. Emails are used for verification, password recovery, access confirmation and notices about access expiry or price changes. Passwords are not stored in plain text.

Payment data includes the selected plan, its price and version, purchase and consent records, access periods and internal balance accounting. Public top-ups are currently disabled: the service does not issue wallet addresses or payment invoices.

Installation data includes identifiers, public keys, allocated limits, authorization versions and expiry times. Device and runner private keys must remain in their respective secure local stores. Do not include secrets in public project exports or support requests.

When publishing, the project's graph and settings are processed by the publication service to create a protected package. They may contain secrets that you intentionally included in the project. Use the designated secret fields and do not embed unrelated credentials. Protected packages, recipient authorizations and publication records are stored to deliver projects and verify authorized execution.

Where execution data goes

During normal server operation, HTTP requests and responses, runtime variables and cookies remain on your chosen server and with configured recipients. They are not routinely relayed through DuckoLab's licensing API. A project action, publication, file submission to support or an external service you configure may send data; you are responsible for its destination and use.

Hosting, protection and retention

The service uses alwaysdata for the website, primary database and account email, HostVDS for licensing and publication APIs, and Cloudflare for DNS, protection and private update storage. Providers process data needed for these functions. Authorized update requests use temporary links; the storage provider may process request information.

We restrict access by service role, encrypt recoverable backup content, and verify signed authorizations and packages. Active account, purchase and security-event data is retained to operate the service, resolve disputes and handle security incidents. Database backups rotate under a maximum 30-day retention policy; deleting an account from the live database does not immediately remove every backup. Signing and recovery keys have a separate retention lifecycle so that existing protected packages remain recoverable.

Session and CSRF cookies are necessary for secure sign-in and account actions. The website does not add advertising cookies or analytics trackers. Absolute security is not guaranteed. If you suspect exposed credentials or a compromised account, contact support and revoke affected sessions or installations.