Sea Ducks

Effective Date: March 6, 2026  |  Last Updated: March 6, 2026

Sea Ducks ("we," "us," or "our") operates the Sea Ducks mobile application (the "App"), available on iOS and Android. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our App. Please read this policy carefully. By using the App, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

1.1 Information You Provide Directly

Data Type	Details
Account Information	Email address, display name, and password (hashed) when you create an account via email, or profile information provided by Apple/Google Sign-In.
Profile Photos	Optional profile photos you upload.
Duck Photos	Photos of rubber ducks you upload when hiding or finding ducks.
Chat Messages	Messages sent through in-app support chat with moderators.
User-Generated Content	Duck names, descriptions, and other gameplay content you create.

1.2 Information Collected Automatically

Data Type	Details
Device Identifiers	A stable device ID is generated and stored to support account security and anti-cheating measures. We do not collect your device's hardware serial number or IMEI.
Device Information	Device model, operating system version, and app version for compatibility and troubleshooting.
Usage Data	Gameplay statistics such as ducks hidden, ducks found, cruise participation, and leaderboard scores.
Log Data	Login/logout timestamps, gameplay actions (hiding/finding ducks), and administrative actions for audit and safety purposes.
Push Notification Tokens	Firebase Cloud Messaging (FCM) tokens to deliver push notifications you have opted into.

1.3 Information from Third-Party Services

• Apple Sign-In / Google Sign-In: If you authenticate using a third-party provider, we receive your name, email address, and a unique provider identifier. We do not access your password from these services.
• RevenueCat: We use RevenueCat to manage in-app purchases. RevenueCat processes purchase transactions and provides us with purchase status, product identifiers, and transaction IDs. We do not store your credit card or payment details.
• Stripe: For donations and merchandise purchases, payment processing is handled by Stripe. We receive only transaction confirmations; Stripe handles all payment card data directly under their own privacy policy.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Provide & Improve the App: To operate the core gameplay (hiding, finding, and tracking rubber ducks on cruise ships), display leaderboards, and enhance features.
• Account Management: To create and manage your account, authenticate your identity, and support account recovery.
• Communications: To send push notifications about duck activity, cruise events, giveaways, and administrative messages (with your consent).
• Safety & Moderation: To detect cheating, enforce community rules, review reported content, moderate user-uploaded images for inappropriate content, and maintain a safe environment for all players, including children.
• Anti-Cheating: To detect suspicious activity patterns such as device swapping, rapid finds, and collusion using anonymized gameplay data and device identifiers.
• Customer Support: To respond to support requests via in-app chat.
• Purchases & Donations: To process in-app purchases (avatar generation credits) and voluntary donations.
• AI Avatar Generation: To generate personalized AI-created avatars using Google Gemini when you purchase this feature. Your uploaded reference photo is processed solely for avatar generation and is not used for any other purpose.
• Analytics: To understand feature usage, improve app performance, and fix bugs.

3. How We Share Your Information

We do not sell, rent, or trade your personal information. We may share information only in the following limited circumstances:

Recipient	Purpose	Data Shared
Firebase (Google)	Authentication, database, cloud functions, storage, and push notifications	Account data, gameplay data, photos, FCM tokens
RevenueCat	In-app purchase management	User ID, purchase transactions
Stripe	Donation and merchandise payment processing	Transaction data (Stripe handles payment card data directly)
Google Gemini	AI avatar image generation	User-submitted reference photos (processed, not stored by Google beyond generation)
Moderators	Community safety and rules enforcement	Display name, gameplay data, reported content, chat messages
Law Enforcement	Legal obligations or safety emergencies	As required by law

4. Data Retention

• Account Data: We retain your account information for as long as your account is active. If you delete your account, we will delete or anonymize your personal data within 30 days, except where we are required to retain it for legal, safety, or audit purposes.
• Gameplay Data: Leaderboard scores, duck records, and cruise participation history are retained to maintain historical records and leaderboard integrity.
• Chat Messages: Support chat messages are retained for moderation and safety review purposes.
• Audit Logs: Login/logout and gameplay action logs are retained for security and anti-cheating purposes.
• Photos: Duck photos and profile photos are stored in Firebase Storage and deleted when you delete your account or remove the photos.

5. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

• Encrypted data transmission (HTTPS/TLS) for all communications between the App and our servers.
• Firebase Authentication with secure token-based sessions.
• Firestore Security Rules that restrict data access to authorized users and moderators.
• Server-side validation of all sensitive operations through Cloud Functions.
• Moderator access is restricted and audited.

While we strive to protect your data, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

6. Children's Privacy

• We do not knowingly collect personal information from children under 13 (or the applicable age of consent in your jurisdiction) without verifiable parental consent.
• Children under 13 should use the App only under the supervision of a parent or legal guardian.
• The App includes content moderation (automated image scanning and human moderation) to maintain a safe environment.
• We prohibit users from sharing URLs, links, or external contact information in any user-generated content to protect children.
• If you believe a child under 13 has provided personal information without parental consent, please contact us immediately at seaducks@bluelineiq.com and we will promptly delete the information.

7. Your Rights & Choices

7.1 Access & Portability

You may request a copy of the personal data we hold about you by contacting us at seaducks@bluelineiq.com.

7.2 Correction

You can update your display name and profile photo directly within the App. For other corrections, contact us.

7.3 Deletion

You may delete your account at any time through the App's settings. Account deletion will remove your personal data from our active systems within 30 days. You may also request account deletion by emailing seaducks@bluelineiq.com.

7.4 Push Notifications

You can opt out of push notifications at any time through the App's notification settings or your device's system settings.

7.5 Data Processing Consent Withdrawal

Where we rely on your consent to process personal data, you may withdraw consent at any time by contacting us. Withdrawal of consent does not affect the lawfulness of processing performed prior to withdrawal.

7.6 Rights for EU/EEA Residents (GDPR)

If you are located in the European Union or European Economic Area, you have additional rights under the General Data Protection Regulation (GDPR), including the right to:

• Access, correct, or erase your personal data.
• Restrict or object to processing.
• Data portability.
• Lodge a complaint with a supervisory authority.

7.7 Rights for California Residents (CCPA)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, and disclose.
• Request deletion of your personal information.
• Opt out of the sale of personal information. We do not sell your personal information.
• Non-discrimination for exercising your privacy rights.

8. Third-Party Services & Links

The App may contain links to third-party services (such as app store pages or payment processors). We are not responsible for the privacy practices of these external services. We encourage you to review their privacy policies:

• Google Privacy Policy (Firebase, Google Sign-In, Google Gemini)
• Apple Privacy Policy (Sign in with Apple)
• RevenueCat Privacy Policy
• Stripe Privacy Policy

9. International Data Transfers

Our servers and service providers (Firebase/Google) are located in the United States. If you access the App from outside the United States, your information may be transferred to, stored, and processed in the United States. By using the App, you consent to the transfer of your information to the United States, which may have different data protection laws than your country of residence.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy with a new "Last Updated" date.
• Sending an in-app notification for significant changes.

Your continued use of the App after changes are posted constitutes your acceptance of the updated policy.

11. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us via our support form or email us at seaducks@bluelineiq.com.