Privacy Notice

Key Points

• We collect the personal data needed to operate your Account and your Labs: your email address, the Handle and name you choose, your activity in the Academy, and standard technical data.
• Your profile is public. Your email address is never made public.
• We do not sell personal data and we do not use it for advertising. duckurity.com does not use trackers.
• The Academy is hosted in Frankfurt, Germany. Some of our service providers are based in the United States. They are described in section 6 and listed on our Subprocessors page.
• You may download your personal data and correct your name and email addresses in your account settings, and exercise all of your rights by contacting privacy@duckurity.com.

01Data Controller

1.1.The controller of your personal data is Duckurity LLC, 46 Abd El-Razzak El-Sanhouri, Makram Ebeid, 6th District, Nasr City, Cairo Governorate, Arab Republic of Egypt, commercial register no. 10530-02002-85026, tax registration no. 774-109-165.

1.2.Further company details are provided in our Legal Notice.

02Personal Data We Collect

2.1 Account and Sign-In Data

You must provide an email address to create an Account, and choose a Handle and a name before you can use the Academy; without them, we cannot provide the Academy to you. All other information you provide, such as writeups and messages, is optional or depends on the features you choose to use.

Before sending a sign-in or verification code to an address, we check through public DNS that the domain of the address can receive mail, and we reject domains associated with disposable email services.

2.2 Profile Data

When a link to your profile is shared, for example on social media, we generate a preview image showing your name, Handle, avatar, student number and the month you joined. Our hosting provider keeps a copy of that image to serve it quickly, and the sites where the link is posted may keep their own copy.

Public information may be viewed, copied and indexed by anyone.

2.3 Lab Activity

2.4 Organization Data

If you create or join an Organization, we record your membership, your role (owner, administrator, instructor or member), your cohorts, the dates on which you joined and left, and who ended your membership. If you create an Organization, we also record that you created it and when. Each Organization keeps a history of changes made to it, with who made each change and when. Once domain verification is available, when an Organization verifies its domain, we will record the domain, the verification result and the badge type.

2.5 Payment Data

2.5.1.Payments in Egypt are processed by Geidea, a licensed payment service provider. Payments from all other countries are processed by Polar, which acts as our merchant of record and sells plans on our behalf. You enter your card details on the secure payment page of Geidea or Polar, and each processes them in accordance with its own obligations under payment regulations. Polar also collects your billing address and tax information to calculate and collect taxes. We do not receive your full card number. We receive and keep the transaction reference, the card type and last four digits, the amount, currency and tax charged, the payment status, your plan and your pricing country, together with the billing details required to issue tax receipts and invoices. For automatic renewals, Geidea or Polar stores a secure token for your card. See our Payment and Refund Policy.

2.5.2.To apply the correct regional price, we determine the country of your IP address and whether it belongs to a known VPN or proxy range. This check does not store your IP address.

2.5.3.For Academic Clearance, we verify that you control a university email address and re-verify it annually.

2.6 AI Features

When it launches, Nester, our AI mentor, will answer questions about your Lab. The questions you submit, together with the Session context Nester needs to respond, are sent to an AI model provider to generate the response. We use Anthropic (Claude), OpenAI, and models accessed through OpenRouter, each listed on our Subprocessors page. These providers are not permitted to use your data to train their models. Nester is always identified as AI. Please do not submit passwords, secrets or the personal data of others to Nester.

2.7 Communications

If you contact us, report a security issue or apply for a position, we retain your message, your contact details and any attachments.

If you choose to receive news and offers from us, by ticking the box when you claim your Handle or with the switch in Settings, we keep a record of each choice: whether you said yes or no, the wording you were shown, where you chose and when. Your most recent choice is the one we follow, and you can change it at any time in Settings. We do not send news or offers yet.

2.8 duckurity.com and the Waitlist

2.8.1.duckurity.com does not set cookies or use trackers. Our hosting provider, Cloudflare, logs each request, including the IP address, approximate location, the page requested and request headers such as browser type. To display the correct regional prices, we also determine the country of each visitor's IP address and whether it belongs to a known VPN or proxy range. This check does not store your IP address.

2.8.2.If you join our waitlist, we retain your email address and a record of your consent, including its date and the wording you accepted, in order to send you a single email at launch. If you withdraw your consent, we erase your email address and retain only the record of your consent and its withdrawal for three years from our last communication to you, as required by law.

2.9 Technical Data

2.9.1.Our hosting providers log requests to operate and protect the Service, including the IP address, time, page or action, response status and browser type. The Academy's own log entries identify you only by your Account identifier or a keyed hash of your IP address, never by your email address.

2.9.2.When it launches, we will use PostHog, hosted in the European Union, for product analytics and error logging. Events sent to PostHog contain identifiers and hashed values only, never your email address, flags or markers. Our Cookie Policy lists everything we store on your device.

2.10 Data We Do Not Collect

We do not request your date of birth, identity documents, gender, religion, health information or any other sensitive data. Please do not include sensitive data in your name, writeups or messages to Nester.

03Purposes and Legal Bases

We process personal data only where we have a legal basis to do so under applicable data protection law.

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You may object to such processing at any time, as described in section 8.

04Who Has Access to Your Personal Data

4.1.The public. Anyone may view your public profile, as described in section 2.2.

4.2.Your Organizations. In an Organization you belong to, every member sees the owner and the administrators. Instructors see the members of the cohorts they teach and the Organization's other instructors, and the owner and administrators see every member. An administrator may let all members see each other, and the instructors of a cohort may let its members see each other. Nobody in an Organization sees your email address. Only for the period of your membership, the instructors of your cohorts, and the owner and administrators for every cohort, may view the assigned Labs you completed, the flags you solved and when, and your quacks. Instructors may also view the writeups you submit for their assignments. Nobody in an Organization sees your invalid flag attempts. The owner and administrators may read the Organization's history, which records changes such as members joining and leaving, and instructors may read the part that concerns their cohorts. When you leave an Organization, it retains the information it already had access to, but no new information becomes available to it.

4.3.Integrity checks. If a writeup contains markers from another student's Session, this is visible only to the instructors of the relevant assignment. These checks are performed by exact comparison, not by an AI model.

4.4.Our staff. Our staff access personal data only as needed to operate the Service, provide support and prevent abuse.

4.5.Service providers. Our service providers process personal data on our behalf under contract, as described in section 6.

4.6.Authorities. We disclose personal data to public authorities where required by law in response to a valid request. We will notify you unless prohibited by law.

4.7.Corporate transactions. If Duckurity is sold or merged, personal data may be transferred to the acquirer, subject to this Notice. We will notify you in advance.

4.8.We do not sell personal data or share it for advertising purposes.

05Automated Processing

5.1.Flags are verified automatically against a stored hash, and each submission is either verified or rejected. A flag from another user's Session is treated as invalid. Writeups containing another student's markers are identified by exact comparison and shown only to the relevant instructors. No Account is suspended without a decision by a member of our staff.

5.2.When they launch, adaptive challenges will adjust which challenges you receive and their difficulty, and score your performance, based on your activity. They are not used to make decisions that produce legal or similarly significant effects for you. Any grade awarded by an Organization is the decision of its instructor.

06Service Providers and International Transfers

6.1.Our database and application servers are located in Frankfurt, Germany. The following categories of service providers process personal data on our behalf, under contract and only on our instructions:

6.2.Each provider, the data it processes and its location are listed on our Subprocessors page. We update that page before a new provider begins processing personal data, and you may ask to be notified of changes.

6.3.Transfers from the European Union. Where a provider in the United States has access to personal data from the European Union, we rely on the EU-U.S. Data Privacy Framework for certified providers and on the European Commission's Standard Contractual Clauses for all others. You may request a copy of these safeguards by contacting privacy@duckurity.com.

6.4.Transfers from Egypt. Personal data collected in Egypt is stored in Germany and processed by the providers listed on our Subprocessors page. Under Egyptian law, such transfers require a licence or permit from Egypt's Personal Data Protection Center (the "PDPC") naming each destination country, and your consent. We request this consent when you create your Account and keep a record of it. We have applied to the PDPC for a cross-border transfer licence covering each destination country, and we will update it before transferring data to any country not named in it.

07Retention

As a general rule, we keep your personal data for as long as you use the Service and for 30 days after you delete your Account, after which it is erased. The shorter periods above apply where data is needed only briefly. We may retain personal data for longer where required by law or to establish or defend legal claims, and only for that purpose.

08Your Rights

8.1.Subject to applicable law, you have the right to:

• Access: obtain confirmation of whether we process your personal data and a copy of it. You can download a copy yourself in your account settings;
• Rectification: have inaccurate or incomplete data corrected. You can change your name and your email addresses yourself in your account settings;
• Erasure: have your personal data erased. Deleting your Account achieves this after the 30-day grace period. Until deletion is available in your account settings, you may request it at privacy@duckurity.com;
• Restriction: require us to limit the processing of your data in certain circumstances;
• Portability: receive the data you have provided to us in a structured, commonly used, machine-readable format. The download in your account settings is a JSON file;
• Objection: object to processing based on legitimate interests, and to direct marketing at any time;
• Withdrawal of consent: withdraw any consent you have given, without affecting the lawfulness of prior processing;
• Breach notification: be informed of any personal data breach affecting your data; and
• Complaint: lodge a complaint with a supervisory authority.

8.2.How to exercise your rights. Please contact privacy@duckurity.com from an email address associated with your Account. You can also download your data and change your name and email addresses in your account settings. We verify your identity, normally with a sign-in code, and do not request more information than necessary. We respond within 6 working days. We keep a record of each request and its outcome. There is no charge for making a request.

8.3.Certain limits apply. We cannot disclose another person's personal data, and we may retain records that the law requires us to keep. If we decline a request, we will explain why.

8.4.Supervisory authorities. In Egypt, you may complain to the PDPC, which decides complaints within 30 working days. In the European Union, you may complain to the data protection authority of the country in which you live or work, or in which the alleged infringement occurred. We would welcome the opportunity to address your concern first, but you are not required to contact us before complaining.

09Security

9.1.We apply technical and organizational measures appropriate to the risk, including:

• passwordless sign-in using single-use codes that expire quickly and are rate-limited, and the option to sign in with a passkey;
• a further check before any change to how you sign in, and a security alert to every email address on your Account when it is signed in from a new browser or when the way you sign in changes;
• encryption of data in transit, including connections to our database;
• the use of keyed hashes, rather than email addresses or IP addresses, in our rate-limiting systems, and the limitation of data shared with each provider to what its function requires;
• the isolation of Lab Sessions on separate infrastructure that cannot reach the Academy application or its database; and
• access controls that limit staff access to what their role requires.

9.2.Personal data breaches. If we become aware of a personal data breach, we will notify the PDPC within 72 hours and, where required by law, the competent EU supervisory authority within 72 hours. If the breach affects you, we will notify you by email within 3 working days of notifying the PDPC, describing the breach and the measures taken.

9.3.To report a security vulnerability, please see our Vulnerability Disclosure Policy.

10Children

10.1.The Academy is intended for individuals aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe that a person under 18 has created an Account, please contact privacy@duckurity.com and we will delete it.

10.2.Under Egyptian law, all personal data relating to children is sensitive data, requiring a PDPC licence and the explicit written consent of a guardian, and children taking part in competitions must not be profiled or tracked. Because rankings and adaptive challenges involve both, the Academy is not offered to children.

11Changes to This Notice

11.1.We will update the date at the top of this Notice whenever we change it. For material changes, such as a new purpose of processing or a new destination country, we will notify you by email before the change takes effect.

12Contact