Privacy Policy

GitHub profile data

When you sign in via GitHub OAuth, we receive and store your GitHub username, email address, GitHub user ID, and avatar URL. This data is used for authentication and displaying your identity on the platform.

Stripe account data

If you connect a Stripe account to sell products, Stripe shares your Stripe account ID and onboarding status with DuckSubs. We do not receive or store your banking details, tax ID, or other sensitive financial information — Stripe handles that directly.

Purchase history

When a purchase is made, we store the buyer’s email address, an email hash (for matching across sessions), the product purchased, the amount paid, and the transaction date. This data is necessary to fulfill purchases and provide download access.

Download activity

We track download token generation and usage (token creation time, expiry, download count) to enforce download limits and prevent abuse. We do not track what you do with the software after download.

No tracking pixels or fingerprinting

DuckSubs does not use tracking pixels, browser fingerprinting, or any form of cross-site tracking technology.

No third-party analytics

We do not currently use any third-party analytics services (Google Analytics, Mixpanel, etc.). If this changes in the future, this policy will be updated.

No data selling

DuckSubs does not sell, rent, or trade your personal data to any third party. Period.

Authentication

Your GitHub profile data is used to sign you in and maintain your session across the platform.

Purchase fulfillment

Your email address and purchase records are used to generate download tokens, send purchase confirmations, and deliver product update notifications.

Anti-fraud

We track chargeback history and may use email hashes to detect duplicate accounts engaged in fraudulent activity. Accounts with repeated chargebacks may be suspended or banned per our Terms of Service.

Stripe

Payment processing is handled by Stripe. When you make a purchase or connect a seller account, Stripe receives the data necessary to process the transaction. Stripe’s privacy policy governs their handling of your data.

GitHub

Authentication is handled via GitHub OAuth. GitHub receives confirmation that you authorized DuckSubs to access your profile data. GitHub’s privacy policy governs their handling of your data.

Email delivery

Transactional emails (purchase confirmations, update notifications) are sent through a third-party email service. The email service receives only your email address and the email content. We do not share any other personal data with this service.

Session cookies only

DuckSubs uses session cookies exclusively for authentication. These cookies identify your logged-in session and are deleted when you sign out. We do not use advertising cookies, analytics cookies, or any other tracking cookies.

Purchase records

Purchase records are kept indefinitely. This is necessary because buyers have perpetual download access to their purchased software — deleting purchase records would break this guarantee.

Account data

Your GitHub profile data and Stripe connection data are retained as long as your account is active. If you request account deletion, we will remove your profile data. Purchase records associated with your email may be retained in anonymized form to maintain buyer access.

Access

You may request a copy of all personal data DuckSubs holds about you by emailing support@ducksubs.com.

Correction

If any of your personal data is inaccurate, you may request a correction. GitHub profile data updates automatically when you sign in.

Deletion

You may request deletion of your account and associated personal data. Note that purchase records may be retained in anonymized form to preserve buyer download access. Chargeback records may also be retained for fraud prevention.

Questions about your data

For any questions about this privacy policy or how your data is handled, contact us at support@ducksubs.com.