Privacy Policy

This Privacy Policy explains how DuckSurfer, operated by Magnus Turner, a Michigan sole proprietor ("DuckSurfer," "we," "us," or "our"), collects, uses, discloses, and protects personal information when you visit ducksurfer.com, create an account, or use our hosting, website, domain, DNS, email, backup, AI-enabled, and related services (the "Services").

This policy does not govern websites operated by DuckSurfer customers. Those customers are responsible for their own privacy practices and notices.

Depending on how you use the Services, we collect:

• Account information: email address, user ID, verification status, account role, and authentication records. Passwords are stored in hashed form rather than readable text.
• Customer Content: website files, code, images, site names, domain and DNS settings, backups, mailbox and alias configuration, support messages, and other content you choose to provide.
• AI feature data: prompts, instructions, uploaded content, generated output, and related usage information when you use an AI-enabled feature.
• Billing information: subscription status, plan, transaction identifiers, and limited payment details. If paid checkout is enabled, payment card data is collected and processed by our payment processor; DuckSurfer does not store complete card numbers.
• Device and usage information: IP address, browser and device type, pages and features used, timestamps, referring URLs, cookie identifiers, error data, and security logs.
• Domain and network information: domain search queries, public registration and DNS information, nameservers, certificate status, and network diagnostic results.

We collect information directly from you, automatically when you use the Services, from public domain and DNS sources, and from service providers that help us operate the Services. We may also receive information from a workspace administrator if they create or manage access for you.

We use personal information to:

• create and secure accounts, authenticate users, and provide customer support;
• host websites, store files and backups, manage domains and DNS, issue SSL certificates, and operate email features;
• process authorized payments and administer subscriptions if paid services are enabled;
• provide AI-enabled features and return requested output;
• monitor performance, diagnose errors, prevent fraud and abuse, and protect users and infrastructure;
• communicate service, security, account, and policy updates;
• improve and develop the Services; and
• comply with law and enforce our Terms of Service.

DuckSurfer uses cookies and browser storage that are necessary for authentication, session continuity, security, account preferences, and service operation. Authentication tokens may be stored in secure cookies or browser storage so you can remain signed in.

We do not currently use personal information for cross-context behavioral advertising. You can control cookies through your browser, but blocking necessary cookies may prevent account and portal features from working.

We may disclose personal information to:

• Infrastructure and hosting providers that store data, route traffic, provide DNS, issue certificates, or protect the Services;
• Operational providers that support email delivery, domain services, payment processing, monitoring, customer support, and AI-powered features;
• Professional advisers and authorities when reasonably necessary to comply with law, protect rights and safety, investigate abuse, or establish legal claims;
• A successor organization in connection with a merger, financing, reorganization, bankruptcy, or sale of all or part of the business; and
• Other parties at your direction or with your consent.

Service providers may process information only to perform services for us or as otherwise permitted by their contracts and applicable law. We do not sell personal information for money, and we do not share personal information for cross-context behavioral advertising.

Content you publish to a website, DNS record, or other public feature becomes available to internet users and may be indexed, copied, or cached by third parties. Domain registration data may also be publicly available through registration-data services unless privacy protection applies.

If a DuckSurfer customer uses the Services to process personal information about its own visitors, the customer controls that information and is responsible for responding to visitor requests. Direct those requests to the website owner first.

We retain account information and Customer Content while your account is active and for as long as reasonably necessary to provide the Services. After account closure or deletion, we may retain limited information when required for security, fraud prevention, dispute resolution, tax, accounting, backup integrity, or other legal obligations.

Backup copies and logs may remain for a limited period before being overwritten or deleted. We delete or de-identify personal information when it is no longer reasonably needed for the purposes described in this policy.

We use administrative, technical, and physical safeguards designed to protect personal information, including access controls, authentication, encryption in transit, logging, and infrastructure isolation where appropriate. No online service is completely secure, so you should use a unique password, protect account credentials, and keep your own current backups of important content.

You may update certain account and website information through the portal, cancel paid Services if enabled, or request access to, correction of, or deletion of personal information by emailing us. You may also object to or request restriction of certain processing, request a portable copy, or withdraw consent where those rights apply.

Residents of jurisdictions with additional privacy rights—including California—may exercise applicable rights to know, access, correct, delete, or obtain a copy of personal information and to receive information about disclosures. Because we do not sell personal information or share it for cross-context behavioral advertising, there is no sale or advertising-sharing opt-out required for our current practices. We will not discriminate against you for exercising a privacy right.

We may verify your identity before completing a request. Authorized agents may submit requests where permitted by law, but we may require proof of authorization and identity. Some information may be exempt from a request under applicable law.

The Services are intended for adults and are not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us so we can investigate and delete it where required.

DuckSurfer operates the Services from the United States. If you access the Services from another country, your information may be transferred to and processed in the United States and other locations where our service providers operate, subject to appropriate protections required by applicable law.

We may update this policy as the Services, law, or our practices change. We will post the revised policy and update the date above. If a change materially affects registered users, we will provide reasonable notice through the Services or by email.

For privacy questions or to submit a privacy request, email support@ducksurfer.com or write to DuckSurfer, Attn: Privacy, 32750 Haggerty Drive, Roseville, MI 48066, United States. Please use the subject line "Privacy Request" and identify the account email associated with your request.