Privacy and Cookies

We (don't) Know What You Did Last Summer

DuckFriends is designed to collect as little information as possible while still providing personal progress and a communal festival leaderboard.

Data controller: Kestral Gaian
Privacy contact: privacy@duckfriend.online

What We Collect

Your public player name

You choose a player name when you meet your first duck. It is displayed publicly on the event leaderboard. It does not need to be, and should not be, your real name.

Your Pseudonymous Player Record

The server stores a one-way hash of a long random token placed in a necessary cookie on your browser. This allows the game to retrieve your progress without asking for an account, email address, telephone number or password.

Ducks, Scores, and Encounters

For each scoring encounter, we store your pseudonymous player ID, the duck, the festival date, the time recorded and whether this was your first friendship with that duck. This creates your permanent collection, daily progress and festival score.

Abuse Prevention

I almost didn't bother with this, but a bunch of hackers in a field might just try to break the damn thing so - to limit automated or excessive requests, the application temporarily stores a keyed, one-way fingerprint derived from technical request information. It does not store the raw IP address or full browser string in the game database. These rate-limit records expire automatically, normally within 24 hours.

Hosting Logs

The hosting provider creates ordinary web-server and security logs as part of providing the hosting service. Those logs are controlled according to the hosting provider’s own terms and retention arrangements.

Why Have a Privacy Statement?

Well, I kind of need to collect some data, and I wanted to do that in the most respectful way possible. The minimal data collected is used to operate the game, remember your progress, publish the communal leaderboard, calculate daily and whole-festival scores, prevent duplicate scoring, moderate abusive player names, investigate faults and protect the service from misuse.

The intended UK GDPR lawful basis is legitimate interests: the organiser’s limited interest in running a voluntary communal festival game securely and fairly. We minimise the information collected, encourage pseudonyms, provide direct deletion controls and do not use the information for advertising, profiling or unrelated contact.

Cookies

DuckFriends uses only first-party cookies that are necessary to provide the game or protect its administration area. There are no advertising, analytics, social-media or cross-site tracking cookies.

These cookies are treated as strictly necessary because the game cannot reliably remember progress, prevent form forgery or provide secure administration without them. You can block or delete them in your browser, but doing so will make the game create a new player or prevent some functions from working.

Sharing

Your chosen player name, score and emoji progress are visible to anyone viewing the leaderboard. The underlying player token and encounter records are not public.

Information is processed by the organiser and the hosting provider, Kestral Gaian, as needed to run the site. The organiser does not sell the information or share it with advertisers. You should review the hosting arrangement to confirm whether any international transfer safeguards need to be described here.

DuckFriends does not use automated decision-making or profiling with legal or similarly significant effects.

Retention and Deletion

The leaderboard will remain available until June 2028, at which time it will be reset for the next festival.

You can delete your own player record immediately from the My ducks page on the browser that holds your player cookie. An administrator can also delete a player or individual encounter from the protected administration area.

Your Rights

Depending on the circumstances, UK data-protection law may give you rights to access, correct, erase or restrict the use of your personal information, and to object to processing based on legitimate interests. Because DuckFriends deliberately does not collect contact details or verified identity, the organiser may only be able to locate a record using the player name and information you provide about your participation.

Please contact Kestral Gaian with a privacy request. You can also complain to the UK Information Commissioner’s Office if you believe your information has been handled improperly.

Changes To This Notice

This notice may be updated if the game, hosting arrangement or legal requirements change. The current version will remain available from the footer of every player-facing page.