Privacy Policy

1. Roles and contact details

The owners of mitchyduck control the service and determine why and how personal information is used. They act as the controller for the personal information described in this policy. Vluxon, Inc. operates the infrastructure on behalf of the owners and acts as the data holder and infrastructure provider, processing stored information under their direction.

Email: [email protected]
Postal address for privacy correspondence: c/o Vluxon, Inc., 2261 Market Street, STE 74184, San Francisco, CA 94114, United States.

You may also contact Mitch or Duck privately through the official mitchyduck Discord community. Please do not send passwords, access tokens, or unnecessary sensitive information.

2. Scope

This policy applies to personal information processed through the mitchyduck website, authentication system, administration tools, personal sheets, collector infrastructure, and related support or security communications. Third party services have their own privacy policies.

3. Information we collect

Depending on how you use the service, we may process:

• Discord identity information: Discord user ID, display name, username, avatar, server membership, and relevant role IDs.
• Account and access information: application role, permissions, suspension state, sign in events, session status, and access validation results.
• User content: sheet names, selected players, share codes, administrative settings, and requests sent to us.
• Technical information: IP address, request metadata, timestamps, browser or device information made available through requests, errors, and security signals.
• Operational records: audit, collector, controller, authentication, and system logs used to operate and protect the service.
• Usage information: interactions reasonably necessary to deliver features, diagnose faults, prevent abuse, and understand service performance.

4. Sources of information

We receive information directly from you, automatically from your browser or use of the service, from Discord when you authenticate, and from service providers that support hosting, security, and operation of mitchyduck.

5. Purposes and legal bases

Where the GDPR or UK GDPR applies, we process personal information under the following legal bases:

• Performance of a contract: to authenticate you, provide authorised features, maintain sheets, and respond to service requests.
• Legitimate interests: to secure the service, enforce permissions, prevent abuse, diagnose problems, maintain audit trails, improve reliability, and protect Vluxon, users, and third parties. We consider the effect of this processing on individual rights.
• Legal obligations: to comply with valid legal requirements, preserve required records, and respond to lawful requests.
• Consent: where we specifically request consent. You may withdraw consent at any time, without affecting earlier lawful processing.

We do not use personal information for unrelated purposes without an appropriate legal basis and any notice required by law.

6. Discord authentication

Discord is used to confirm identity, server membership, and required roles. We may periodically revalidate access. Discord processes information under its own terms and privacy policy. Removing a required role, leaving the relevant Discord community, revoking Discord authorisation, or account suspension may end access to mitchyduck.

7. Cookies and sessions

mitchyduck uses essential session and security technologies needed to keep users signed in, protect requests, and maintain account state. We do not sell personal information or use this policy to authorise advertising cookies. If optional cookies are introduced, any consent required by law will be requested before they are used.

8. How information is disclosed

We may disclose information:

• to Vluxon as the data holder and infrastructure provider acting on behalf of the owners;
• to other database, authentication, monitoring, and security providers needed to support the service;
• to Discord as needed for authentication and access validation;
• to professional advisers under duties of confidentiality;
• when required by law or a valid legal process;
• when reasonably necessary to protect rights, safety, users, or systems; or
• as part of a merger, financing, reorganisation, acquisition, or transfer of the service, subject to appropriate safeguards.

We do not sell personal information. We do not share personal information for cross context behavioural advertising.

9. International transfers

Vluxon provides infrastructure from the United States, and information may be processed in the United States or other countries where supporting providers operate. Those countries may have different data protection laws. Where the GDPR or UK GDPR requires a transfer safeguard, the controller will use an applicable lawful mechanism, such as an adequacy decision, approved contractual protections, or another mechanism permitted by law. You may contact us for information about safeguards relevant to your information.

10. Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this policy. The period depends on the type of information, account status, operational configuration, security needs, legal obligations, and the need to resolve disputes.

• Session information is retained for the life of the session and any short period needed for security.
• Account, permission, and sheet information may remain while the account or service is active and for a reasonable period afterward.
• Share codes expire after their configured lifetime, although related security or audit records may remain for a limited period.
• Operational and detailed logs are retained according to configured diagnostic and security schedules.
• Records relevant to fraud, abuse, disputes, security incidents, or legal duties may be retained longer where necessary.
• Protected backups may retain information until the relevant backup cycle completes.

When information is no longer needed, we delete it, anonymise it, or isolate it until deletion is possible.

11. Security and vulnerability reporting

We use reasonable technical and organisational measures designed to protect personal information. These include authentication, permission checks, request validation, access logging, restricted administrative controls, and separation of service responsibilities. No service can guarantee absolute security.

Report suspected vulnerabilities privately to [email protected] using the subject “mitchyduck Security Report,” or direct message Mitch or Duck through the official mitchyduck Discord community. Include the affected page, reproduction steps, expected and observed behaviour, and relevant screenshots or request IDs with secrets removed. Do not publish the report or access information that is not yours.

12. Rights under the GDPR and UK GDPR

If the GDPR or UK GDPR applies to you, you may have the right to:

• request access to your personal information and a copy of it;
• request correction of inaccurate or incomplete information;
• request deletion in applicable circumstances;
• request restriction of processing;
• object to processing based on legitimate interests;
• receive certain information in a portable format;
• withdraw consent where processing relies on consent; and
• complain to the data protection authority where you live or work, or where an alleged infringement occurred.

These rights may be subject to legal exceptions. We may need to verify your identity before completing a request. You will not be discriminated against for exercising a privacy right.

13. California privacy rights

California residents may have rights to know, access, correct, or delete personal information and to receive information about categories of collection and disclosure, subject to applicable exceptions. The mitchyduck owners and Vluxon do not sell personal information or share it for cross context behavioural advertising. We will not discriminate against you for exercising an applicable privacy right.

14. Automated decisions

Discord membership, Discord roles, configured permissions, suspension status, and security rules may automatically allow or deny access. These checks are used to enforce access rules and protect the service. Where applicable law gives you a right to request human review of a significant automated decision, contact us using the details above.

15. Children

The service is not directed to anyone below the minimum age required to use Discord or consent to data processing in their jurisdiction. Do not use mitchyduck if you do not meet those requirements. Contact us if you believe a child has provided personal information contrary to this policy.

16. Requests and complaints

Send privacy requests to [email protected] with the subject “mitchyduck Privacy Request,” or contact Mitch or Duck privately through the official Discord community. Describe the request and identify the Discord account concerned. We may request reasonable identity verification. We aim to respond within the period required by applicable law.

17. Changes

We may update this policy as the service, our practices, or applicable requirements change. The date above identifies the latest version. Where required, we will provide additional notice of a material change.