Privacy Policy
Last updated: 3 November 2026
This policy explains what personal data DueDuck collects, why, who else handles it, how long we keep it, and your rights. It covers dueduck.com.
1. Who we are
DueDuck Oy (business ID 3666618-9), Mannerheimintie 152 A 40, 00270 Helsinki, Finland, runs DueDuck. We are the controller of the personal data described here: we decide why and how it's used.
Questions and requests about your data: privacy@dueduck.com.
We haven't appointed a data protection officer, because the law doesn't require one for a company of our size and kind.
Creators. Each community is run by its creator. When you join a community, its creator and the admins they choose can see some of your data (section 3). What a creator does with that data on their own, for example in their own Stripe account, is the creator's responsibility: for that, the creator is the controller, not us.
2. What we collect, why, and on what legal basis
"Contract" means we need it to give you the service you signed up for (GDPR Art. 6(1)(b)). "Legitimate interests" means Art. 6(1)(f), with the interest named. "Legal obligation" means Art. 6(1)(c).
| What | Where it comes from | Why | Legal basis |
|---|---|---|---|
| Account: email address, password (stored only as a scrambled hash), display name, profile photo if you add one | You | To create your account, sign you in, send the emails that confirm your address or reset your password, and show your name and photo | Contract |
| Time zone | Your browser, when you open a community you've joined | So your Learn streak follows your own day | Contract |
| Memberships: which communities you've joined, your plan, your role, when you joined, whether your membership is ending | Your actions | To give you what your plan includes | Contract |
| What you post: posts (text, pictures, videos, polls), comments, chat messages with their pictures, GIFs and stickers, reactions, likes and poll votes. If you run a community: trades (prices, updates, how they ended, and whether you have a position in the symbol), portfolios and lessons | You | To show it to the people you posted it for | Contract |
| Learn: lessons you've finished, your answers to questions and how many tries they took, your daily call answers (your pick and size), XP, level, streak, shields, badges and weekly points | Your actions | To show your progress and rewards, and the weekly board | Contract |
| What's new: when you last opened a community, its sections and each chat room | Your actions | To show what's new since your last visit | Contract |
| Notifications and alerts: the notifications we show you, your notification settings, and, if you turn on alerts on a device, that device's push address | Your actions | To tell you about new posts, trades, replies and tags, where you asked us to | Contract |
| TradingView username (if you add one), whether TradingView says it exists, and your indicator access requests | You; a lookup on TradingView's public site | So a creator can give you access to indicators your plan includes | Contract |
| Communities you create: name, address, description, pictures, plans and prices, rooms and Learn content | You | To run your community | Contract |
| Payments: if you subscribe to a paid plan, the plan, its status and price, renewal and trial dates, and Stripe's reference numbers. If you sell plans, your Stripe account's reference number and whether it can take payments. We never receive card numbers | Stripe | To give you access to paid plans, and to collect our fee from creators | Contract; legal obligation (bookkeeping) for our fee |
| Reports and moderation: reports you make (what, why, your explanation and a copy of the reported text), reports about what you posted and their outcome, and mutes a community's admins put on you | You, other members, admins | To deal with reports, keep communities safe, and keep a record of decisions | Legitimate interests (a safe platform; defending legal claims); legal obligation (the EU Digital Services Act) |
| Upload counts: when you uploaded a picture or video | Your actions | To limit uploads to 100 an hour per person | Legitimate interests (preventing abuse) |
| Technical data: IP address, browser and device details, request and sign-in logs | Your browser | To keep DueDuck running and secure and to look into problems | Legitimate interests (security) |
| Usage statistics: pages viewed, where visitors came from, country, device type and browser, counted without cookies and without recognising you from one day to the next | Your browser, through Vercel Web Analytics | To see which pages are used and improve them | Legitimate interests (improving DueDuck) |
| Emails with us | You | To answer you | Legitimate interests; contract |
You need to give an email address, a password and a display name to create an account; without them we can't make one. Everything else is up to you.
We don't make decisions about you by automated means that have legal or similarly significant effects. We don't collect sensitive data (health, religion and the like); please don't post it.
We don't collect your real name (unless you use it as your display name), your date of birth, your phone number, your card details, or your trading accounts or holdings.
If we contact you about DueDuck. If you run a trading community or have a trading audience, we may keep short notes from your public profiles so we can write to you about DueDuck: your name or handle, links to your public profiles, your audience size, the markets you cover, whether you trade as a company, and why we think DueDuck could suit you, and later when we wrote and what you answered. We use them only to send you a personal message, on the basis of our legitimate interests (telling creators about DueDuck). You can object at any time: reply to our message or write to privacy@dueduck.com, and we'll delete your notes and not contact you again.
If you contact us on X or Instagram. DueDuck has accounts on X (@JoinDueDuck) and Instagram (@dueduck). If you message us, comment on our posts or tag us, we see your public profile and what you wrote, and we use it to answer you and to talk with people about DueDuck (legitimate interests). X and Meta also show us statistics about who sees and follows our accounts, as totals that don't tell us who you are. For Instagram's statistics, Meta Platforms Ireland and we are joint controllers: Meta takes the main responsibility, explained in its information on Insights, and you can use your rights with Meta or with us. Otherwise X and Meta handle your data under their own policies: X, Instagram.
3. Who can see what
- Everyone, including visitors: a community's public page and free posts, and the name and photo of whoever runs a published community. Anything you post where visitors can see it shows with your name and photo.
- Members of a community you've joined: your name, photo and what you post there. If you're among the week's top Learn scorers, your name and weekly points show on the community's board.
- The community's creator and admins: also your plan and when you joined, your TradingView username if you ask for indicator access, reports about content in their community (never who made them), and mutes. If you buy a plan, the creator's Stripe account receives your email and payment details.
- DueDuck: everything above, when we need it to run DueDuck, answer you or deal with reports, including who made a report.
- Your email address is seen by nobody else, except our service providers and, if you buy a plan, the creator through Stripe.
4. Who else handles your data, and where
Our database and servers are in the United States, so your data is stored there. These companies handle it for us (they are our processors), under contracts that bind them to protect it:
| Company | What for | Where | How the transfer is protected |
|---|---|---|---|
| Supabase (Supabase Pte. Ltd., Singapore) | Database, sign-in, pictures, realtime chat. It uses Cloudflare to protect its service from bots | Amazon Web Services, US East (Virginia) | EU Standard Contractual Clauses, in Supabase's data processing addendum |
| Vercel (Vercel Inc., US) | Hosting the website, request logs, usage statistics, scheduled jobs | US East (Washington, D.C.) and Vercel's worldwide network | EU-US Data Privacy Framework |
| Resend (US) | Sending emails that confirm your address or reset your password | Sends from Ireland; keeps its records in the US | EU-US Data Privacy Framework |
| Mux (Mux, Inc., US) | Storing and playing videos | US | EU-US Data Privacy Framework |
| Stripe (Stripe Payments Europe, Ltd., Ireland, and Stripe, LLC, US) | Payments for paid plans and creators' payouts | EU and US | EU-US Data Privacy Framework. For payments to creators, Stripe also acts on its own account under its privacy policy |
| Cursor (Anysphere, Inc., US) | AI assistants that help us research and write DueDuck's marketing, including the notes about creators we contact (section 2). They have no access to our database | US | EU Standard Contractual Clauses, in Anysphere's data processing addendum |
The EU-US Data Privacy Framework is covered by the European Commission's decision that it protects data adequately. To get a copy of the Standard Contractual Clauses, write to privacy@dueduck.com.
Others that receive some data when you use a feature:
- KLIPY shows GIFs in chat. GIF pictures load from KLIPY's servers, which see your IP address and browser details. GIF searches go through our own server, so KLIPY can't tell who searched.
- YouTube (Google), only after you press play on a YouTube video. From then on Google's privacy policy applies.
- Your browser's push service (Google, Apple, Mozilla or Microsoft, depending on your browser) delivers alerts if you turn them on. Alerts are encrypted, so the push service can't read them.
- TradingView: we check on its public site whether a username exists, sending only the username.
- Creators, as described in section 3.
- Authorities, when the law requires it (for example, a valid order from a court), or to protect people from fraud or harm.
We don't sell your data, and we don't share it with advertisers.
5. How long we keep it
| Data | Kept |
|---|---|
| Account (email, name, photo, time zone, TradingView username) | Until you delete your account |
| What you post | Until you or a community's admin delete it, or your account or the community is deleted (see below) |
| Memberships | Until you leave the community |
| Learn progress and rewards, notifications, notification settings, what's new | Until you delete your account, or the community is deleted |
| Device push addresses | Until you turn alerts off on that device, or delete your account |
| Upload counts | Until you delete your account |
| Payment records | Our copy goes when you delete your account. Stripe and the creator keep payment records as their own legal duties require. Records of our fees are kept as long as Finnish bookkeeping law requires |
| Reports and their outcomes, including the copy of what was reported | 2 years after the decision. If the person who reported deletes their account, the report no longer says who made it |
| Technical logs | A short time at our providers, currently a few days at most |
| Usage statistics | Only as totals, with nothing that identifies you |
| Notes about creators we contact | 6 months after our last message to you, or deleted at once if you'd rather not hear from us |
| Messages and comments on our X and Instagram accounts | As long as they stay on X or Instagram; we don't copy them anywhere else |
When you delete your account, your comments and chat messages are deleted with it. A comment someone has replied to stays as "Comment deleted", without your name or words, so the replies still make sense. Posts and lessons you wrote as an admin of someone else's community stay in that community. A community you own is deleted with your account; if its members still have paid time, you delete the community first, and it ends when their time runs out.
6. Your rights
Under the GDPR you can:
- Get a copy of your data: Download my data on your Account page gives you most of it as a file. Write to privacy@dueduck.com for the rest.
- Correct it: change your name, photo and TradingView username on your Account page, or write to us.
- Delete it: Delete account on your Account page deletes it straight away, or write to privacy@dueduck.com from your account's email address and we'll delete it within 30 days. Any paid plans you have end at once.
- Take it with you: the Download my data file is machine-readable (JSON).
- Object to what we do on the basis of legitimate interests, including usage statistics.
- Ask us to restrict what we do with your data while a complaint is checked.
- Complain to the Finnish Data Protection Ombudsman (tietosuoja.fi) or the data protection authority where you live.
We answer within one month. We may ask you to confirm it's you.
For data a creator holds (for example in their Stripe account), contact the creator. If you can't reach them, we'll help.
7. Security
Data travels encrypted (HTTPS). Access to the database is checked row by row, so people only see what their plan and role allow. Pictures you upload are redrawn as new images, which removes location and camera details. Card details are handled only by Stripe.
8. Age
DueDuck is for people aged 18 and over. If you think someone younger has an account, tell us and we'll delete it.
9. Changes
If we change this policy in a way that matters, we'll tell you by email or in the app before the change applies.
10. Contact
DueDuck Oy, Mannerheimintie 152 A 40, 00270 Helsinki, Finland · privacy@dueduck.com