Two policies. The first covers the Duckin app. The second covers this website and its waitlist. We never sell your data. Questions go to duckinapp1@gmail.com.
Part one
EFFECTIVE 11 OCTOBER 2026
Duckin ("we", "us", "the app") is a boxing and combat-sports training app developed by Harry Howarth, the data controller responsible for your information. If you have any questions about this policy or how your data is handled, contact duckinapp1@gmail.com.
Creating a Duckin account requires an email address and password, or a Google or Apple sign-in. We store your email address, your display name, and your chosen username. Passwords are never visible to us - they are hashed by our authentication provider (Supabase). If you sign in with Google or Apple, we receive your email address and name from them; we never see your Google or Apple password. Account data is hosted for us by Supabase.
Your day-to-day training data - sessions, XP, streaks, badges, chosen coach, and onboarding answers - is saved locally on your device and is the working copy the app runs on. We only ask for what the app uses. Your discipline picks the drills, combinations and report you get; your goal shapes the combinations called and what your monthly report prioritises; your weekly training frequency is the target your monthly report measures you against; how long you have trained and what you have trained set the combination difficulty we recommend; and your sex, height, body weight and birth year, which are optional and which some laws treat as health related data, are used only to estimate the calories you burn and, for sex, to choose the body figure shown in your monthly report. When you are signed in, these onboarding answers are also saved to your account on our servers (hosted by Supabase) as soon as you finish onboarding, whether or not you subscribe, so they follow you to a new phone and are ready if you later use Advanced. Only your account can read them, and they are erased with your account.
When you are signed in, the app periodically uploads a snapshot of the training data described in Section 3 to our servers (hosted by Supabase), linked to your account. This exists so your progress survives a lost phone or reinstall, and it is only readable by your account. It is deleted along with everything else when your account is erased. Combinations you make in the combo builder are saved to your account the same way: the moves, the order, any name you give them, and when they were made or changed. Only your account can read them, and they are erased with your account.
If you use the Arena, the app sends statistics about each training session to our servers so we can calculate your points, league position, and records. These are: the type of session, when it ended, its duration, the number of rounds, the difficulty, the coach and bag type you chose, your per-round ratings, the total strikes thrown, and a breakdown of which combinations were called and for how long. No audio is ever included. Your username, display name, tier, current streak, weekly scores, and country (if you set one) are visible to other Duckin users on leaderboards and in your league. Your email and the rest of your training data are never public. If you prefer not to appear, simply don't log sessions while signed in to the Arena features, or contact us to discuss removal.
When you create a Duckin account and choose a username, that username may be shown in Duckin promotional content, including live streams on platforms such as TikTok, to acknowledge new members. Only the username you chose is used. Your email address, your training data, and every other detail of your account are never shown. If you would prefer your username not to be used this way, contact us at the address in Section 23 and we will exclude it.
Duckin offers an optional Streamer Mode that pairs the app with a separate device so events can be displayed during a live stream. If you use it, we store a pairing code, which account created it, which account claimed it, and when it was claimed or revoked. You can revoke a pairing at any time in Settings, and revoked pairings stop working immediately. When you claim a username for the first time, we record that event together with the username so it can be acknowledged on a stream. Only the username is recorded for this purpose. Your email address and your training data are never included. Section 5a explains how to opt out of promotional use of your username.
Duckin no longer offers user-to-user messaging. There is no chat and there are no direct messages: the Arena carries a Message Board that only Duckin can post to, and you read it. Any messages you sent before this change are no longer readable by anyone in the app and are deleted on our normal retention schedule. You can block any user, which hides you from each other permanently on leaderboards and in your league. To report a user or a username, email us at the address in Section 23.
We use Sentry to detect and diagnose crashes so we can fix them. When the app errors, Sentry receives technical diagnostic data: the app version, your device model and operating-system version, a timestamp, the error and its stack trace, and a short trail of the in-app actions leading up to it. As part of delivering this report over the internet, Sentry also processes your IP address. We do not enable Sentry's "send default personally identifiable information" setting, so we do not attach your name or account details to these reports. Learn more at sentry.io/privacy.
We use PostHog to understand how the app is used so we can improve it. PostHog records usage events - for example which screens you open, when you start or finish a session, and when you view the upgrade screen - along with technical context such as device type, OS, app version, and an approximate location (country or city) derived from your IP address. Each event also carries your training discipline, your goal, and whether you have Advanced, so we can see which features matter to which kind of training. Events are keyed to a random install identifier, not to your name, your email, or your Duckin account.
Duckin does not record your screen and does not replay your sessions. The usage events described in Section 8 are the only record we keep of how the app is used.
If you would prefer not to share usage data, turn off analytics at any time in Settings → Preferences → Share anonymous usage data. Opting out stops PostHog event capture for your install; crash reporting via Sentry continues as it is necessary for app stability.
We do not collect your phone number, contacts, photos, precise GPS location, camera data, or audio from your microphone. We do not track you across other apps or websites and we do not use advertising identifiers. We never see your payment card details.
Duckin Advanced (an auto-renewing subscription) and individual coaches (one-time purchases) are sold through the Apple App Store or Google Play. Apple or Google take the payment and hold your card details under their own privacy policies. We never receive your card details. We use RevenueCat to check purchases and unlock what you have bought. When you are signed in, the app links your purchases to your Duckin account identifier so they follow you to a new phone. RevenueCat receives that identifier, the purchase and subscription records the store reports (which product, when it was bought, when it renews or expires, whether it was a free trial, whether it is set to renew, the store, and the store's transaction identifiers), and technical details such as your device platform, app version, country, and IP address. We see the same purchase records so we can support you. Subscriptions are managed by Apple or Google. Deleting the app or your Duckin account does not cancel a subscription. If yours is set to renew, the app asks you to cancel it before deleting your account, and you can cancel at any time in Settings, then Manage plan, or in your App Store or Google Play settings. If you redeem a promo code, we record which code your account redeemed and when, so the access it gives can be applied and ended on time. If a code you enter is not accepted, we record only the time of that attempt, not what you typed, so repeated guessing can be limited. Older failed attempts are cleared the next time you enter a code. Both records are linked to your account and erased with it.
Where UK or EU data protection law applies, we rely on: performance of our contract with you (your account, cloud backup, Arena features, and delivering what you have bought, which are the things you signed up for); our legitimate interests (crash reporting, usage analytics, and keeping the community safe through the username filter, blocks, and reports made to us by email, balanced against your privacy); and legal obligation (where we must retain or disclose information by law). You may object to processing based on legitimate interests - see Section 17.
We do not sell your personal information and we do not share it for advertising. We share data only with the service providers that run the app for us: • Supabase, Inc. - account authentication, database hosting (accounts, backups, Arena data, Streamer Mode pairings). • Sentry (Functional Software, Inc.) - crash and error reporting. • PostHog, Inc. - usage analytics. • Cloudflare, Inc. - the security check shown when you sign up, log in, or reset a password with an email address, which confirms the request comes from a person and not a script. Cloudflare receives your IP address and technical details about your device and connection to do this. • RevenueCat, Inc. - checking in-app purchases and subscriptions, as described in Section 12. Each acts as our processor under a data processing agreement and may only use the data to provide their service to us. We may also disclose information if required by law or to protect our legal rights. Remember that leaderboard data (Section 5) is visible to other users by design. Technique videos open on YouTube, which is run by Google. We send YouTube nothing about you, but what you watch there is covered by Google's own terms and privacy policy.
Our providers process data on servers that may be outside your country, including the United States. If you use Duckin from the United Kingdom or European Economic Area, these transfers are protected by the providers' Standard Contractual Clauses and equivalent safeguards required under UK and EU law.
Account data, cloud backups, and Arena statistics are kept while your account is active. Data stored only on your device is kept until you delete it or uninstall the app. Sentry retains crash events around 90 days; PostHog retains analytics events per our project configuration. Purchase records held by RevenueCat are kept so purchases can be restored and so we can meet the stores' and tax authorities' record-keeping requirements; they are deleted on request, subject to those requirements. Promo code redemptions are kept while your account is active. Reports sent to us are kept up to 180 days for safety review.
You can delete your account at any time in Settings → Delete account. Your profile immediately disappears from leaderboards and leagues. We then hold your account data (including your email and training history) for 30 days so you can change your mind - signing back in within that window restores everything. After 30 days, your account and all associated data are permanently and irreversibly erased from our systems. If you want deletion faster than 30 days, email duckinapp1@gmail.com. Deleting your account does not stop billing, because only Apple or Google can cancel a subscription. If yours is set to renew, the app shows you where to cancel before you confirm. Your purchase records at RevenueCat are not erased automatically when your account is erased; email duckinapp1@gmail.com to have them deleted.
Depending on where you live, you may have the right to access, correct, delete, restrict, or object to our processing of your personal data, and the right to data portability. Deletion is self-service (Section 17). For access, correction, portability, or objection requests, contact duckinapp1@gmail.com and we will respond within the time required by law. If you are in the UK or EEA, you also have the right to lodge a complaint with your local data protection authority (in the UK, the Information Commissioner's Office).
If you are a California resident, we do not sell or share your personal information as those terms are defined under the California Consumer Privacy Act, and you have the right to know what personal information we process and to request its deletion. The same contact email applies to all such requests.
Duckin is operated from Australia. Where the Privacy Act 1988 (Cth) and the Australian Privacy Principles apply, you have the right to request access to the personal information we hold about you and to ask us to correct it. Use the contact address in Section 23. To make a privacy complaint, write to the same address: we will acknowledge it within 7 days and aim to resolve it within 30 days. If you are not satisfied with how we handle it, you may refer it to the Office of the Australian Information Commissioner. Section 15 explains that some of our providers process data overseas.
If you are in Washington State or Nevada, our Consumer Health Data Privacy Policy explains what consumer health data we collect, why, and the rights you have over it. It is in the app under Settings, then Consumer Health Data, and at duckinapp.com/consumer-health-data.
Data in transit is encrypted, sign-in tokens are stored in your device's secure keystore, and access to server data is restricted by per-account security rules. We rely on the security controls of Apple, Google, Supabase, Sentry, and PostHog for their respective systems. No method of transmission or storage is completely secure, but we take reasonable steps to protect your information.
Duckin is not directed at children under 13, and we do not knowingly collect personal data from them. The app asks your age before an account can be created or the app used, and does not let anyone who answers under 13 continue. That answer is read once on your device: we keep only whether the check was passed, and the age itself is not stored or sent to us. The Arena requires an account and is likewise limited to users 13 and over, or the higher minimum age that applies in some countries. If you believe a child has provided us with personal data, contact duckinapp1@gmail.com and we will take appropriate steps to remove it.
We may update this policy as the app evolves. When we make material changes, we will update the effective date shown at the top of this screen and, where appropriate, notify you in the app. Continuing to use Duckin after an update means you accept the revised policy.
For any privacy question, concern, or request, contact Harry Howarth at duckinapp1@gmail.com.
Part two
EFFECTIVE 14 SEPTEMBER 2026
This website does one thing with your data: it collects the email address you choose to give us so we can tell you when Duckin launches. We do not sell your data, we do not run advertising or tracking cookies, and the only analytics we use is cookieless and anonymous. You can ask us to delete your email at any time by emailing duckinapp1@gmail.com. The full detail is below.
Duckin ('we', 'us', 'the site') is a boxing and combat-sports training app developed by Harry Howarth, who is the data controller responsible for the information collected through this website. For any question about this policy or your data, contact duckinapp1@gmail.com.
Only what you give us, plus the minimum a website needs to run: - The email address you enter to join the waitlist. - Basic technical data your browser sends with any web request (such as your IP address, timestamp and browser type), which our hosting and database providers process to deliver and protect the site. That is all. We do not collect your name, phone number, payment details, location, contacts, photos, or anything from your device.
We use your email to send you a launch or beta invite and occasional updates about Duckin. Where UK or EU data protection law applies, our legal basis is your consent, which you give by ticking the consent box and submitting the form. You can withdraw that consent at any time by emailing duckinapp1@gmail.com, and we will remove you from the list.
This website does not use advertising cookies or third-party tracking and analytics cookies, and it shows no cookie banner because none is required. We use only the minimal, essential storage a modern web app needs to function correctly. To understand how many people visit, we use Vercel Web Analytics, which is cookieless and privacy-friendly: it counts page views in aggregate, sets no cookies, stores no personal data, and never follows you across other websites. We do not build advertising profiles and we do not track you across other sites.
Waitlist emails are stored in our database, hosted by Supabase. Launch and confirmation emails are delivered through our email provider, Resend. The site itself is hosted by Vercel, which also provides the cookieless, aggregate visit analytics described above. These providers act only as our processors under their own data-processing terms and may use the data solely to provide their service to us. We never sell or rent your information and we never share it for advertising.
Our providers may process data on servers outside your country, including in the United States. Where your information is transferred out of the UK or European Economic Area, those transfers are covered by Standard Contractual Clauses or equivalent safeguards required under UK and EU law.
We keep your email only as long as we need it for the waitlist: until Duckin launches plus a reasonable period afterwards, or until you ask us to remove you, whichever comes first. When it is no longer needed, or on your request, we delete it. Until 14 September 2026 this site also ran a referral competition and could record a friend's email you typed in as a referral. The competition has ended and no new referral emails are collected. Any referral emails already recorded are kept under the same terms and deleted on request.
Depending on where you live, you may have the right to access, correct, delete, or object to our use of your data, and the right to data portability. Because all we hold is your email, you can exercise these rights simply by emailing duckinapp1@gmail.com and asking us to remove or send you your data, and we will action it within the time required by law. If you are in the UK or EEA you also have the right to complain to your local data protection authority (in the UK, the Information Commissioner's Office).
We take reasonable, industry-standard steps to protect the small amount of data we hold, and we rely on the security of established providers (Supabase and Resend) for storage and delivery. However, no website or transmission of data over the internet is ever completely secure. You provide your email voluntarily and at your own risk. To the fullest extent permitted by law, Duckin and Harry Howarth accept no liability for any loss or damage arising from your use of this website, from any email you choose to submit, or from any unauthorised access to data that occurs outside our reasonable control. This website and the waitlist are provided on an 'as is' and 'as available' basis, with no warranties of any kind, express or implied.
This website is not directed at children under 13, and we do not knowingly collect their data. Please do not submit your email if you are under 13. If you believe a child has given us their email, contact duckinapp1@gmail.com and we will remove it.
We may update this policy as the site and the app evolve. When we make material changes we will update the effective date shown at the top of this page. Continuing to use the website after an update means you accept the revised policy.
For any privacy question, concern, or request, contact Harry Howarth at duckinapp1@gmail.com.