Legal
Privacy Policy
The short version
- We only collect what each service needs to work.
- We never sell your data, never show ads and never use your Google data for advertising.
- Where a service saves your data, it saves it in your own Google Drive, in a private app folder that we can't use to see your other files.
- Google user data is handled under Google's Limited Use requirements.
- You can ask us to delete your data at any time.
1. Who we are
DuckIn Labs ("we", "us") is an independent, non-commercial project run by an individual developer based in Indonesia. We build small, free tools. Our website is duckinlabs.com.
2. What this policy covers
This policy applies to:
- the DuckIn Labs website at duckinlabs.com;
- every app and service built by DuckIn Labs that uses "Sign in with Google" through the DuckIn Labs Google consent screen (the "services"), including services we launch in the future.
If a DuckIn Labs app publishes its own privacy policy, for example because it asks for additional Google permissions beyond those listed in section 3, that policy applies to the app and takes precedence over this one.
3. Sign in with Google
When you choose "Sign in with Google" on a DuckIn Labs service, every service asks for these basic scopes:
openid: to confirm your identity;email: your Google account email address;profile: your name and profile picture.
We use this information only to create and identify your account, sign you in, show your name and picture inside the service, and contact you about your account.
Services that save your data in your own Google Drive also ask for one more scope:
https://www.googleapis.com/auth/drive.appdata: access to a private, app-specific folder in your Google Drive. The service uses it to save and load the data you create in it, so you can use it on any device. This folder is separate from your own files: the service cannot see, list, open or change any other file or folder in your Drive, and the folder doesn't appear in your Drive's normal file view.
We don't request access to your Gmail, Contacts, Calendar, or the files and folders you see in Drive, and we never receive your Google password.
You can remove our access at any time from your Google Account at myaccount.google.com/permissions. See Retention and deletion for how to delete data stored in your Drive.
4. What we collect
When you visit duckinlabs.com
- No account, no tracking. The website has no sign-up, no analytics and no advertising trackers.
- Server logs. Our hosting provider records standard technical data such as IP address, browser type and the pages requested, to keep the site running and secure.
- Suggestion form. The "Got an idea" form does not send anything to our servers. It opens your own email app with a pre-filled message. If you send it, we receive your email address and whatever you write.
When you use a DuckIn Labs service
- Account details from Google: your name, email address and profile picture.
- What you enter into the service, such as records, amounts, categories and notes. Where a service uses
drive.appdata, this data is saved in your Google Drive and is not stored on our servers. Services that don't use Drive keep it with our hosting providers. - A session cookie that keeps you signed in, and in some services a copy of your data kept in your browser so the service works offline.
5. How we use your data
- To provide the service you asked for, such as showing your transactions and reports.
- To sign you in and keep your account secure.
- To answer messages and support requests you send us.
- To fix bugs and protect against abuse.
We do not sell your data, use it for advertising, or build profiles about you.
6. Google API Services: Limited Use
DuckIn Labs' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In particular, we:
- only use Google user data to provide or improve the user-facing features of the service it was requested for;
- do not transfer it to others except to provide those features, to comply with the law, or as part of a merger or sale with your consent;
- do not use it for advertising, and do not sell it;
- do not use it to train general-purpose AI or machine-learning models;
- do not let people read it unless you give permission, it is needed for security or to comply with the law, or it is aggregated and anonymised.
8. Storage and security
Data that a service keeps in your Drive is stored in your Google account and protected by Google's security. Any other data is stored with our hosting providers and may be processed outside Indonesia. All traffic uses HTTPS. Access to production systems is limited to the developer, and sign-in sessions use secure, HTTP-only cookies. No system is perfectly secure, but we take reasonable steps to protect your data and will tell you if a breach affects you.
9. Retention and deletion
- Data in your Google Drive stays there until you delete it. We don't keep a copy on our servers.
- To delete it, remove the service's access at myaccount.google.com/permissions, then in Google Drive go to Settings → Manage apps and choose Delete hidden app data for that service. A copy stored in your browser is removed when you sign out of the service.
- You can delete individual records inside a service at any time.
- To delete any account data that we hold, email us from the address linked to your account. We will delete it within 30 days and confirm when it's done.
- Emails you send us are kept only as long as needed to reply and follow up.
- Server logs are kept by our hosting provider for a limited period under its own retention policy.
10. Your rights
Depending on where you live, including under Indonesia's Personal Data Protection Law (UU No. 27 Tahun 2022) and the GDPR, you may have the right to access, correct, delete or export your data, and to withdraw consent. To use any of these rights, contact us. We'll reply within 30 days.
12. Children
Our services are not directed at children under 13, and we don't knowingly collect their data. If you believe a child has given us personal data, contact us and we'll delete it.
13. Changes to this policy
If we change this policy, we'll update the date at the top. For significant changes, we'll also let signed-in users know inside the service before the change takes effect.
This policy is available in English and Indonesian. If the two versions differ, the Indonesian version prevails.
14. Contact
Questions, requests or concerns: hello@duckinlabs.com