Cookie Notice
Last updated: 3 November 2026
This notice explains what DueDuck stores in your browser, why, and for how long. When we say "cookies" we also mean your browser's local storage, session storage and similar storage, which work in the same way.
In short
- We only store what DueDuck needs to work, and choices you make yourself, like the light or dark theme.
- We don't use advertising or tracking cookies, and we don't let advertisers or social networks put them on DueDuck.
- YouTube is the one other company that can store data on your device through DueDuck, and only after you press play on a YouTube video. The play button tells you so.
- That's why there's no cookie banner: nothing that needs your permission runs before you choose it.
Cookies we set
All of these are set by DueDuck itself and can only be read by DueDuck.
| Name | What it's for | Set when | How long |
|---|---|---|---|
sb-cvnqadvvqjcodcellutf-auth-token (sometimes split into .0, .1) | Keeps you signed in. It holds your sign-in session from Supabase, the company that runs our sign-in and database | You sign in | Until you sign out, or 400 days after your last visit |
sb-cvnqadvvqjcodcellutf-auth-token-code-verifier, …-flow-…-code-verifier, …-flows-code-verifier | A one-time security code, so a sign-in link only works in the browser that asked for it. It holds nothing about you | You sign up or ask to reset your password | Up to 400 days |
theme | Remembers whether you chose the light or dark theme, so pages load in it | You use the theme switch | 1 year |
preview | Lets the DueDuck team see the whole site before it opens. It holds a shared code, nothing about you | Someone on the team opens DueDuck's private preview link | 90 days |
You stay signed in on a device until you sign out. If you use a shared computer, sign out when you're done.
A cookie another company sets
| Name | Who | What it's for | How long |
|---|---|---|---|
__cf_bm | Cloudflare, for Supabase | Set when your browser loads a picture or data from Supabase, which stores DueDuck's data. It tells people apart from bots, to protect the service | 30 minutes |
Other storage in your browser
Local storage stays until you clear it; session storage goes when you close the tab. All of it is DueDuck's own, and each item is set only when you use the feature it's for.
| Name | What it's for | Set when |
|---|---|---|
theme | The same light or dark choice as the cookie | You use the theme switch |
learn-sound | Whether sounds are on in Learn | You turn them on or off |
device-alerts-prompt-hidden | That you chose "Not now" on the alerts prompt, or turned alerts off | You choose it |
room-groups:… | Which room groups you folded in a community's chat | You fold or open one |
tz-synced:… | That your time zone was saved, so your Learn streak follows your own day, and so it isn't sent again | You open a community you're a member of |
media-chrome-pref-volume, media-chrome-pref-muted, media-chrome-pref-subtitles-lang | Your volume, mute and subtitle choices in the video player | You change them |
frimousse/… (local and session storage) | A copy of the emoji list from our own site, so the emoji picker opens quickly | You open the emoji picker |
fc:back (session storage) | Where the back button in a community takes you | You move around the site |
builder-member-view | For creators: whether Learn's builder shows the member view | You switch it |
lesson-draft:… | For creators: unsaved changes to a lesson, so they aren't lost if the page closes | You edit a lesson |
Alerts. If you turn on alerts on a device, your browser installs a small script from DueDuck (/sw.js) and gets a push address from your browser's push service, so alerts can reach you. Both stay until you turn alerts off or clear DueDuck's data in your browser.
Videos
Videos uploaded to DueDuck play through Mux, our video provider. Mux's player only loads when you press play, and its viewing statistics are switched off, so it sets no cookies. It does remember your volume, mute and subtitle choices (see above).
YouTube videos show a still picture from DueDuck until you press play. Nothing from YouTube loads before that. When you press play, the video plays from youtube-nocookie.com, YouTube's privacy-enhanced mode, and YouTube stores data on your device (in its local storage and database) and may set cookies, for its own purposes. This is covered by Google's privacy policy, not this notice. If you don't want that, don't press play on YouTube videos.
Usage statistics without cookies
We count page views with Vercel Web Analytics. It sets no cookies and stores nothing in your browser. It tells visits apart with a code made from your connection that is thrown away after 24 hours, so it can't follow you from one day to the next or across other sites. We only see totals: which pages are viewed, where visitors came from, and their country, device type and browser. Vercel handles this for us as our service provider. See the Privacy Policy, section 2.
GIFs
GIFs in chat load from KLIPY's servers (static.klipy.com). They set no cookies.
Payments
When you pay for a plan you go to Stripe Checkout or Stripe's billing portal, on Stripe's own site (checkout.stripe.com, billing.stripe.com). Stripe sets its own cookies there, for fraud prevention and to make payment work. Those are covered by Stripe's cookie policy, not this notice.
Links to other sites
Links to TradingView or other sites take you to those sites, which have their own cookie rules.
Your choices
You can block or delete cookies and site data in your browser's settings. If you block the sign-in cookies, you can't sign in. If you clear DueDuck's data, you're signed out, the site goes back to the dark theme, and it forgets the other choices listed above.
If we ever add something that needs your permission, we'll ask before it runs, and we'll update this notice.
Contact
privacy@dueduck.com