made by nt.

Duck City / Privacy

Duck City
Privacy Policy

Effective date:

Duck City is a cosy village game for iPhone and iPad. This policy explains what information the game uses, why, who helps us handle it, and what you can do about it. We've tried to keep it short and clear.

The short version

  • Your village is saved on your device. We don't get a copy of it.
  • No accounts. The game never asks for your name, email address, age, photos, contacts or location, and it has no chat and no way to type messages to other players.
  • No ads and no tracking. There are no adverts in Duck City, and we don't follow you across other apps or websites.
  • Crash reports. If the game crashes or hits an error, it sends us a technical report so we can fix it.
  • How the game is played. The game sends us simple notes such as "opened the Shop" or "finished a goal", tagged with a random number instead of anything about you, so we can see which parts work and which need improving.
  • Pearls are bought through Apple. We never see your name, Apple Account or payment details.
  • We never sell your information.

Contact us via madebynt.com.

1. Who we are

Duck City is made by Liam Gooding, an independent game developer (madebynt.com). In this policy "we", "us" and "our" mean Liam Gooding. For the purposes of UK and EU data protection law, Liam Gooding is the controller of the personal data described here.

Contact: madebynt.com

2. What stays on your device

Duck City saves your game on your iPhone or iPad. The save holds your village (buildings, businesses, homes, decorations and ducks), your coins, pearls and feathers, your progress and achievements, in-game mail you've received, your settings, and a record of each App Store purchase of pearls (Apple's transaction ID and whether it was a real or a test purchase), so a purchase is only ever added once and an Apple refund is handled correctly. The game also keeps a protected copy of the save, so it can recover if the save is damaged, and the random analytics ID described in section 3.2.

This save is not sent to us or to anyone else. In-game mail is written by us and ships inside the app; it isn't sent to you over the internet and no other player can send you anything.

Your device's own backups (iCloud Backup or a backup to your computer) may include the save. Those backups are controlled by you and Apple, not by us. Deleting Duck City from your device deletes the save.

3. What the game sends us

The game sends two kinds of technical information over the internet, both over an encrypted (HTTPS) connection. Neither includes your name, email address, Apple Account, contacts, photos, precise location, or your village save. The game has no text entry, so it can't send anything you've typed.

3.1 Crash and error reports (Sentry)

When Duck City crashes or runs into an error, it sends a report to Sentry, a crash-reporting service. A report contains:

  • what went wrong: the error message, the technical "stack trace" of where in the game's code it happened, and the game's most recent log lines (in-game events, not personal information);
  • the app's version and build number;
  • your device model (for example "iPhone 15 Pro"), its iOS version, and technical details such as free memory and storage, screen size, language and time-zone settings;
  • whether the app crashed or froze, and a count of sessions so we can see how often it crashes;
  • a random installation ID that Sentry creates, so repeated reports from the same install can be grouped.

3.2 Gameplay analytics (PostHog)

To understand how people play and where the game could be better, Duck City sends short gameplay events to PostHog, an analytics service, using PostHog's EU cloud. The events cover things like:

  • finishing the opening goals and reaching new stages of the village;
  • opening the Shop and the Boutique, tapping an offer or a pearl pack, and items bought in the Boutique;
  • when a session starts, how long it lasts, and when the game is left idle.

Each event includes the time, the app version, your device model and iOS version, and a random ID that the game creates the first time it runs and keeps in your save. This ID isn't your device's advertising identifier (IDFA) or any other device or Apple identifier, and it isn't linked to your name or Apple Account. If you delete and reinstall the game, it creates a new one.

Events are sent in small batches. If your device is offline, they are discarded rather than stored up.

Analytics and crash reports are turned off in development versions of the game.

3.3 Internet addresses

Like any internet connection, sending a report reveals your device's IP address to the service receiving it. We have set up Sentry and PostHog not to store IP addresses and not to work out your location from them.

4. Buying pearls

Pearls are bought as in-app purchases through Apple's App Store. Apple handles the payment, your Apple Account and your billing details; we never receive them. When you buy pearls, Apple's StoreKit tells the game on your device which pack was bought and gives it a signed transaction record, which the game checks on the device before adding your pearls. The transaction ID is kept in your save (section 2). Refunds are handled by Apple (reportaproblem.apple.com).

Parents can control purchases with Apple's Screen Time and Ask to Buy settings.

Apple's handling of your information is covered by Apple's Privacy Policy. If you've chosen to share analytics with app developers in your device's settings, Apple may also share anonymous crash and usage statistics with us through App Store Connect.

5. What we don't do

  • We don't show adverts or include any advertising software.
  • We don't track you across other companies' apps or websites, and we don't use your device's advertising identifier, which is why the game never asks for permission to track you.
  • We don't sell, rent or trade your information, or share it for advertising.
  • We don't build profiles of players, and no decision about you is made automatically.
  • We don't use Game Center, iCloud sync, sign-in, or any player account.
  • We don't access your camera, microphone, photos, contacts or location.

6. Why we use this information

What information we use, why we use it, and the legal basis under UK and EU GDPR
What Why Legal basis (UK and EU GDPR)
Crash and error reports To find and fix crashes and bugs and keep the game running smoothly Our legitimate interest in providing a working game
Gameplay analytics To understand which parts of the game people enjoy, where players get stuck, and whether the Shop works, so we can improve the game Our legitimate interest in improving the game, using a random ID and the minimum of information
Purchase records on your device To give you the pearls you bought, once, and handle refunds Performing our contract with you
Emails you send us To answer you Our legitimate interest in replying, or performing our contract with you

We have weighed our interests against your privacy. We collect as little as we can, never link it to who you are, and don't use it for advertising or profiling.

7. Who helps us

We use these service providers ("processors"). Each may only use the information to provide its service to us, under a data processing agreement:

  • Sentry (Functional Software, Inc., USA): crash and error reports, stored in Sentry's EU data region (Germany). Privacy policy
  • PostHog (PostHog, Inc., USA): gameplay analytics, stored on PostHog's EU cloud (Germany). Privacy policy
  • Apple (Apple Inc., USA, and Apple Distribution International Ltd., Ireland): distributes the game and handles in-app purchases, under Apple's own privacy policy.
  • Our email provider, if you email us.

We may also disclose information if the law requires it.

8. International transfers

We're based in the United Kingdom. Crash reports and analytics are stored in the European Union. Sentry and PostHog are US companies, so their staff or systems may access data from outside the UK and EU. Where that happens, the transfer is protected by the safeguards the law requires, such as the EU Standard Contractual Clauses with the UK Addendum, or the EU-US Data Privacy Framework and its UK Extension where the provider is certified.

9. How long we keep it

  • Your save: on your device until you delete the game. We never hold a copy.
  • Crash and error reports: up to 90 days, then deleted.
  • Gameplay analytics: up to 12 months, then deleted.
  • Emails: until your question is dealt with, and no longer than 2 years after we last hear from you.

10. Children

Duck City is a gentle game suitable for all ages, and we know children play it. We've designed it to collect as little as possible from everyone, children included:

  • We don't ask for, or knowingly collect, a child's name, email address, contact details, photos, location or any other information that identifies them.
  • There are no ads, no behavioural advertising, no chat and no way for players to contact each other.
  • The only information sent from the game is the crash reports and gameplay analytics described in section 3. They use random IDs, are used only to keep the game working and to improve it (what the US Children's Online Privacy Protection Act, COPPA, calls "support for internal operations"), and are never used to contact a child, to build a profile of them, or for advertising.
  • Purchases go through Apple, where parents can require approval with Ask to Buy.

We follow the spirit of the UK Information Commissioner's Children's Code: high privacy by default, no profiling, no location, and explanations children can understand (see "The short version" above).

If you're a parent or guardian and have a question, or would like us to delete information relating to your child, please contact us.

11. Your rights

Depending on where you live, you have rights over your personal data. In the UK and EU these include the right to ask for a copy of it, to have it corrected or deleted, to restrict or object to how we use it, and to receive it in a portable form. You can also complain to a data protection authority: in the UK that's the Information Commissioner's Office (ico.org.uk); in the EU, the authority in your country. We'd appreciate the chance to help first.

If you live in a US state with a privacy law, such as California: we don't sell or "share" personal information (as those laws define it), we don't use it for targeted advertising, and we don't collect sensitive personal information. You can ask to know, correct or delete what we hold, and we won't treat you differently for asking.

How to use your rights. Contact us via madebynt.com. We'll reply within one month.

Because we deliberately don't know who you are, we usually can't find your information from your name or email address. The simplest way to remove everything is to delete Duck City from your device: that deletes your save and its random ID, nothing more is sent, and what we already received can no longer be connected to you and is deleted on the schedule in section 9. If you'd like us to look further, tell us roughly when you played and on which device, and we'll do what we reasonably can.

12. Security

Information sent from the game travels over encrypted connections. Access to our Sentry and PostHog accounts is limited to us and protected by strong passwords and two-factor authentication. No system is perfectly secure, but collecting as little as possible is the best protection we can offer.

13. Changes to this policy

If we change how Duck City handles information, we'll update this page and the effective date above. If a change is significant, we'll also let you know in the game, for example in its mail.