Website & Project Participation Privacy Notice

Conduck

Last Updated: 2026-09-05

Data Controller: GigaDuck OÜ Tornimäe tn 5, 10145 Tallinn, Estonia Registry code: 17501858 (Estonian Business Register) Email: privacy@gigaduck.ai · General: info@gigaduck.ai

1. What This Notice Covers

The Conduck app sends no conversation content or telemetry to us: it has no Conduck-operated backend, no Conduck accounts, and no analytics. Apple separately provides developers with aggregate App Store, crash, and CloudKit statistics as described in our Privacy Policy. That policy also explains how the app handles data on your device and with the providers you configure. This notice covers everything around the app: the ways you might choose to interact with us, GigaDuck OÜ (“we,” “us,” “our”), the company behind Conduck. Specifically:

• the conduck.com website (including the gigaduck.ai domain, which serves no content of its own and only redirects there);
• participating in Conduck’s public open-source projects — issues, pull requests, and code contributions on GitHub;
• emailing us — support, privacy, legal, and security reports;
• our community channels, currently a Discord server.

This notice describes how data is handled in those channels. It is a notice, not a contract — it does not create contractual terms, and our Terms of Service do not change what it says.

2. The Website

conduck.com is a static site with no advertising tracking. We do not add a tag manager, advertising or tracking cookies, fingerprinting, forms, or third-party embeds. Fonts and our own site scripts are served from conduck.com.

Privacy-first traffic measurement. We use Cloudflare Web Analytics, a cookieless measurement tool from our hosting provider, to see how many people visit which pages and how fast the pages load. Cloudflare counts page requests at its own edge as it serves them, and may insert a small measurement script (loaded from static.cloudflareinsights.com) into the pages it serves; that script sends the page address, referrer, approximate load timings, and general browser and country information to Cloudflare. It sets no cookies, stores nothing in your browser, and does not build a profile of you: Cloudflare does not use your IP address, browser details, or any other data to identify or fingerprint individual visitors, and it processes this data for us as our processor under the same data-processing agreement as the hosting itself. We see only aggregate figures. Blocking scripts, or a content blocker, stops the measurement without affecting the site.

Hosting. The site is served by Cloudflare (Cloudflare, Inc.), our hosting and content-delivery provider, acting as our processor. Cloudflare processes your IP address and technical request data to deliver and secure the site. Cloudflare provides us with aggregate edge analytics and sampled request and security analytics for a limited rolling period. On our current plan, sampled request analytics may be available for up to seven days and mitigated security events for up to 24 hours; records can include the requested URL, IP address, browser or user-agent details, timestamp, and Cloudflare security action. Cloudflare may set a strictly necessary security cookie when it challenges a request and may receive browser network-error reports through its response headers. We do not maintain a separate copy of this website traffic data.

The gigaduck.ai website serves no content of its own; web requests are permanently redirected into conduck.com. The domain’s email service is covered separately below.

Outbound links (the App Store, GitHub, Discord, social networks) are plain links. Nothing loads from those services until you click, and once you do, their privacy policies apply.

3. Emailing Us

When you email us — info@, privacy@, legal@, or security@gigaduck.ai — we receive whatever you choose to send: your email address, your message, and any attachments. We use it to answer you and to handle whatever the message is about, and for nothing else. No marketing lists, no newsletters, no selling of your data — and no disclosure to anyone beyond the processors named in this notice, unless the law requires it.

Our email runs on Google Workspace (Google), acting as our processor: Google’s servers store and transmit the mail on our behalf under Google’s data-processing terms.

A small ask: please don’t include sensitive personal data (health, beliefs, and similar), credentials, or personal data about other people unless it is genuinely needed for your message. If we receive third-party or sensitive data we don’t need, we minimize or delete it rather than keep it — and where the GDPR requires us to inform a person whose data reached us this way, we do. We do not intentionally process special categories of personal data (GDPR Art. 9); if such data is genuinely needed to handle a specific matter — for example, as evidence in a legal claim — we keep it only under an applicable Art. 9 condition and delete it as soon as that need ends.

4. Security Reports

Vulnerability reports submitted through GitHub’s private vulnerability reporting or sent to security@gigaduck.ai are handled as described in our Vulnerability Disclosure Policy. When you use GitHub, GitHub separately processes your account and platform data under its own privacy statement. We use your report solely to triage, fix, and document the issue — including, where the law requires it, evidencing our handling to authorities — and we treat it confidentially. We do not share your details without your permission, except where disclosure is required by law or by security authorities, and even then we keep your identity out of it wherever possible.

Public credit is opt-in. We name you as the discoverer of a vulnerability only with your consent, which you can decline or withdraw at any time without affecting how your report is handled.

5. Participating in Conduck’s Projects on GitHub

Conduck’s application source and optional conduck-connect setup tool live in public repositories on GitHub. If you open an issue, comment, submit a pull request, star, or fork either repository, that activity is public — visible to anyone, on a platform operated by GitHub.

Two distinct roles. We are the controller for what we do with project content: reviewing, accepting, publishing, and moderating contributions, issues, and comments in our repositories. GitHub is a separate, independent controller for the platform itself — your GitHub account, platform logs, and everything its Privacy Statement covers. For your account and GitHub’s own processing, exercise your rights with GitHub.

Code contributions and the DCO — read this before your first commit. Every commit in a contribution must carry a Signed-off-by: Name <email> line certifying the Developer Certificate of Origin. If your contribution is accepted, that name and email — along with the git author metadata of the commit — become part of the repository’s published version history, where they are normally retained for as long as the project is maintained. You should understand what that means before contributing:

• Git history is distributed by design: anyone in the world may clone, fork, or mirror the repository, and every copy carries the full history, including your sign-off. Copies made by others are outside our control.
• Published git history is not ordinarily rewritten: rewriting it changes every subsequent commit identifier, breaks signatures and references, and disrupts every fork and clone — and still cannot recall copies already made.
• You choose the identifier. You control which name and which email address you embed. You may use a GitHub-provided noreply address or another address you are comfortable seeing published permanently — we ask only that the sign-off genuinely identifies you as the accountable contributor. Before a contribution is merged, you can freely amend the name or email on your commits; ask in the pull request if you need help.
• Providing a sign-off is required to contribute. Without it we cannot accept the contribution — that is the only consequence of not providing it.

We retain the author and sign-off metadata of accepted commits for as long as the project and its licensing history are maintained, because it is what proves who wrote the code and under what right it was contributed — the project’s authorship and license provenance. Section 9 explains how erasure requests are handled against this backdrop, honestly.

6. Community Channels

We run one community Discord server (linked from conduck.com). Discord is an independent controller for the platform — your account, your messages, and everything its Privacy Policy covers. We are the controller for what we do as the server’s operator: like any member, we see the usernames, messages, attachments, and reports posted there, and use them only to operate, moderate, and answer questions in the community. We may keep minimal moderation records (for example, the reason for a removal or ban) for as long as they are needed to keep the community usable and fair.

7. Why We May Process Your Data (Legal Bases)

Your right to object. Where we rely on legitimate interest, you have the right to object at any time, on grounds relating to your particular situation (GDPR Art. 21) — email privacy@gigaduck.ai. We then stop the processing unless compelling legitimate grounds override, or the data is needed for legal claims. We highlight this here, separately, because most of the processing above rests on legitimate interest.

We do no profiling and make no automated decisions about anyone.

8. How Long We Keep Things (Retention)

• Website technical data: we do not maintain a separate copy. Cloudflare’s processing and current rolling access periods are described in Section 2.
• General email: kept while the conversation and whatever it concerns are live, then reviewed periodically and deleted once no longer needed — unless the thread became part of a contract, a dispute, or a statutory record (accounting records are kept seven years under Estonian law).
• Security reports: correspondence is kept only as long as needed to triage, fix, and document the issue — including any legally required evidencing to authorities — then deleted, as our Vulnerability Disclosure Policy says. A minimal case record (what was wrong, what we fixed) may be kept longer; your identity is removed from it where not needed.
• Privacy-rights and legal correspondence: a minimal record is kept for as long as needed to demonstrate compliance or while a claim could still arise, then deleted.
• Commit and DCO metadata: for as long as the project and its licensing history are maintained (Section 5). Copies held by third parties who cloned or forked the repository persist independently of us.
• Issues, PRs, comments: for as long as they remain relevant to the project’s operation, security, or history; subject to the rights below.
• Moderation records: for as long as the moderation action is relevant (for an active ban, its duration), then deleted.

9. Your Rights

You have the rights the GDPR provides, subject to its conditions: access to the personal data we hold about you, rectification, erasure, restriction of processing, objection (see Section 7 — highlighted there because it applies to most of this notice), and data portability where applicable. Email privacy@gigaduck.ai; we respond within a month. Exercising your rights is free.

Honesty about git history. Erasure has real limits in a public, distributed version history, and we would rather tell you now than surprise you later:

• We assess every erasure or objection request individually — there is no blanket refusal.
• We can edit, anonymize, or remove content under our control — issue and PR text, comments, and moderation records — and where a request is justified, we do. Accidentally published secrets, private information, or unlawful content we remove even where doing so is disruptive.
• The author and sign-off metadata of accepted commits, however, we normally retain in the published history. That retention rests on our legitimate interest in preserving the code’s authorship and license provenance (Section 7), weighed against your rights in each individual assessment; where the metadata is additionally needed to establish, exercise, or defend a legal claim about the code, the GDPR’s own exception for legal claims (Art. 17(3)(e)) applies to that extent.
• Where erasure is legally required despite that, we take reasonable steps in the repositories we control and inform recipients where the GDPR requires it — but rewriting our repository cannot recall the copies independent forks, mirrors, and clones have already made, and those copies are held by parties who are not us. For data held by GitHub itself (your account, platform records), contact GitHub.

The practical advice worth repeating: choose the name and email you contribute under with the permanence of public git history in mind (Section 5).

10. International Transfers

We are an Estonian company, and the services we use are operated by U.S.-based providers:

• Cloudflare (hosting, processor) and Google (email, processor) process data for us under their data-processing agreements, with transfers safeguarded by the EU–U.S. Data Privacy Framework and, where that does not apply, the European Commission’s Standard Contractual Clauses, as set out in each provider’s data-processing terms.
• GitHub and Discord are independent controllers (Sections 5 and 6); their own transfer safeguards are described in their privacy documents.
• Public project content — including git history — is, by its open-source nature, published to the world and may be copied and processed anywhere. No transfer mechanism can recall data you have chosen to make public through a contribution; Section 5 is our way of making sure you know that before it happens.

Details of the safeguards each processor relies on are available in that provider’s published data-processing terms, or from us at privacy@gigaduck.ai.

11. Complaints

If you think we have handled your personal data wrongly, please contact us first at privacy@gigaduck.ai — we read and answer. You also have the right to lodge a complaint with a supervisory authority at any time. Our lead authority is the Estonian Data Protection Inspectorate:

Andmekaitse Inspektsioon — Tatari 39, 10134 Tallinn, Estonia · info@aki.ee · +372 627 4135 · aki.ee

If you live or work in another EU/EEA country, you may instead complain to the supervisory authority there.

12. Changes to This Notice

We may update this notice as our website, project, or channels change. We will update the “Last Updated” date and publish the current version at conduck.com. Material changes will be announced on the website.

13. Contact

Privacy: privacy@gigaduck.ai Data Controller: GigaDuck OÜ, Tornimäe tn 5, 10145 Tallinn, Estonia · Registry code 17501858 · General: info@gigaduck.ai