Privacy Policy

Effective date: September 30, 2026 Last updated: October 5, 2026

Not yet attorney-reviewed. Written against what this codebase actually collects as of 2026-08-14. If the code changes what it stores or who it sends data to, this document changes in the same commit.

This policy explains what Duck Friends collects, why, who we share it with, and what you can do about it. It covers duckfriends.com (the "Service"), operated by Josh Ronk, doing business as Duck Friends ("we," "us"). Our Terms of Service govern your use of the Service.

The short version: we collect what we need to run a small forum and directory, we don't sell your data, and we don't run ad networks. We do use one analytics product (PostHog) to understand how the site is used.

1. What we collect

When you create an account: your email address, a password (stored only as a bcrypt hash — we never see or store the password itself), and a display name.

When you fill out your profile: an avatar image, a region (e.g. "Pacific Northwest"), and a bio — all optional, all public.

When you add a duck: name, breed, age, weight, provenance, temperament, health notes, and photos. Each duck profile has its own visibility setting.

When you post: forum threads and replies, sitter listings, cause submissions, community stories, tags, and helpful marks. Public content is public and indexable by search engines.

When you message someone: message content, who you messaged, and timestamps. See Terms §12 — messages are private from other members but readable by moderators in defined circumstances.

When you post a sitter listing or search the directories: the location text you type. We send that text to a third-party geocoding service (see §3) to convert it to coordinates, and we store the coordinates.

Automatically: we log account activity — sign-ins, sign-outs, password changes and resets, account updates — with a timestamp, so you can review it on your account's Activity page. We don't store your IP address with it. Our hosting providers keep ordinary server logs, which do include IP addresses.

Usage analytics: we use PostHog to understand how people actually use the site — pages visited, features used, buttons clicked, referring site, approximate location derived from IP (country/region, not street address), browser and device type, and a pseudonymous identifier that lets us recognize a returning browser. If something breaks in your browser, we also receive the error message and technical details (like the page and browser) so we can fix it. If you are signed in, we associate this with your account so we can tell a real usage pattern from a coincidence.

Listing view counts: separately from PostHog, we keep a simple first-party count of how many times each vet listing and city page is viewed — a daily total per page, with no cookies, no IP address and no identifier — so we can tell clinics how often their listing is seen.

If you buy an enhanced vet listing: billing is handled by Stripe. Stripe receives your card details directly; we receive and store only a customer identifier, a subscription identifier, the plan, and the subscription's status and period dates. We never receive or store your full card number. When you agree to a paid listing's automatic renewal we also keep a consent record — the date and time, the text you agreed to, your IP address, and your browser's user-agent — which California law requires us to retain.

We do not collect: precise device GPS location, biometric data, or third-party advertising identifiers. We do not run ad networks and there are no advertising trackers on the Service.

2. Why we use it

To run your account and keep you signed in; to display the content you post; to deliver messages and the notifications you opted into; to power search and distance sorting in the directories; to moderate the community and enforce our Terms; to detect and prevent abuse, spam, and fraud; to answer you when you contact us; and to comply with law.

We do not use your data to train machine-learning models, and we do not sell or share it for cross-context behavioral advertising.

3. Who we share it with

We use a small number of service providers, and only for the purposes above:

Beyond these, we share personal information only: when you make it public yourself; when required by law, subpoena, or valid legal process; when necessary to investigate a report, enforce our Terms, or protect someone's safety or rights; and in connection with a merger, acquisition, or sale of assets — in which case we will give notice before your information becomes subject to a different policy.

We do not sell personal information, and we do not share it for targeted advertising.

4. Cookies and analytics

Strictly necessary. We set one cookie, session — an HTTP-only, signed JWT that keeps you signed in. It expires after 24 hours. Clearing it signs you out.

Analytics — off until you say yes. PostHog sets its own cookies to recognize a returning browser and stitch a visit together. These are first-party and used only to measure how the Service is used — not to build an advertising profile and not to follow you to other websites.

We do not load PostHog at all until you allow it. The first time you visit, you get a banner with two real choices — "Necessary only" or "Allow analytics." Nothing analytics-related touches the network before you choose, and choosing "Necessary only" costs you nothing on this site. You can change your mind whenever you like: Cookie settings in the footer.

Session replay. We do not record your session. PostHog offers a replay feature that reconstructs a visit as a watchable recording; we have it turned off, and we will update this policy before turning it on.

Global Privacy Control. If your browser sends a GPC signal, we treat analytics as declined and never ask — you will not see the banner at all. We do not sell personal information or share it for targeted advertising, so there is nothing else for an opt-out to reach.

Signing out or deleting your account does not retroactively delete analytics already collected, but we will delete it on request (§6).

5. How long we keep it

• Account data: until you delete your account.
• Public content: see Terms §17 — forum posts may remain after account deletion, disassociated from you, so conversations other members took part in stay intact.
• Analytics events: one year, after which they are deleted automatically.
• Messages: retained for the other participant in the conversation.
• Activity logs (sign-ins and account changes, no IP addresses): until you delete your account.
• Billing consent records (paid vet listings): at least three years, or one year after the subscription ends if that is longer — a legal retention requirement, so they are not deleted on request while it applies.
• Moderation records — reports, warnings, suspensions, bans, and admin action logs: retained as long as needed for safety and legal purposes, including after account deletion.
• Backups: deleted data persists in database backups for a limited period before rolling off.

6. Your choices and rights

Anyone can: edit or delete their profile, duck profiles, and photos at any time; delete their own posts; turn off email notifications; and delete their account entirely from account settings.

Depending on your state, you may also have the right to know what personal information we hold about you, to get a copy of it, to correct it, to delete it, to opt out of sale or targeted advertising (we do neither), and not to be discriminated against for exercising these rights. Twenty US states now have comprehensive privacy laws with rights along these lines.

To exercise any of these, email [email protected] from the address on your account. We will verify it is you and respond within 45 days, and we will tell you if we need longer. There is no charge unless a request is excessive or repetitive.

If we deny a request and your state provides an appeal right, you may appeal by replying to our decision; you may also complain to your state attorney general.

7. Children

The Service is for people 13 and older. We do not knowingly collect personal information from children under 13. If we learn that we have, we delete the account and its data. Parents and guardians: contact [email protected] and we will remove it promptly.

8. Security

Passwords are hashed with bcrypt. Session tokens are signed and HTTP-only. Traffic is served over HTTPS. Database access is restricted. Admin functions are role-gated at both the page and the action level.

That said, no system is perfectly secure, and we are a small operation. Use a unique password, and tell us at [email protected] if you think your account has been accessed by someone else.

9. Where we operate, and international users

The Service is operated from and hosted in the United States, and all data is processed there. If you use the Service from outside the US, you are transferring your information to the US, which may have different data-protection law than your country.

If you are in the EU, EEA, UK, or Switzerland, the following applies to you in addition to the rest of this policy.

• Who is responsible. Josh Ronk, doing business as Duck Friends, is the controller of your personal data. Contact details are in §11.
• Our legal bases. To run your account, show your content, and deliver messages, we rely on performance of a contract (our Terms). For security, abuse prevention, and moderation, we rely on our legitimate interests in keeping a community safe. For analytics, we rely on your consent, which you give or refuse in the cookie banner and can withdraw at any time from Cookie settings in the footer. Where the law requires us to keep something, we rely on legal obligation.
• Your rights. You can ask us to access, correct, delete, restrict, or export your personal data, and to object to processing based on legitimate interests. Email us as described in §6; we respond within one month. You may also complain to your local data-protection authority.
• Transfers to the US. Your data is processed in the US by us and the providers in §3. Where required, we rely on the standard contractual clauses or equivalent safeguards in those providers' data processing terms.
• Age. Where your country sets a digital age of consent higher than 13, you must be at least that age to use the Service.

10. Changes

We will post any change here and update the "Last updated" date. For material changes, we will post a notice on the Service and, where we have your verified email, email you before the change takes effect.

11. Contact

[email protected] 13356 SW Macbeth Dr, King City, OR 97224