MODULE D.U.C.K.← Back to the siteMODULE D.U.C.K.← Back to the siteModule D.U.C.K. · Effective and last updated: 7 October 2026
Module D.U.C.K. is a social app for nights out with friends that includes a drink log. This Policy explains, in plain language, exactly what the app collects, why, who else can see it, how long we keep it, and what you can do about it. It covers the Module D.U.C.K. app and the services behind it (together, the "Service").
This Policy works together with our Terms of Use.
This summary is here to help you get oriented. The full text below is what actually applies.
The controller of your personal data (the party responsible for the decisions described in this Policy) is:
Nariman Mammadov (Məmmədov Nəriman Bəxtiyar oğlu), a sole trader registered with the State Tax Service of the Republic of Azerbaijan, taxpayer number (VÖEN) 1310036412
General Akim Abbasov St. 16, apt. 58, Yasamal District, Baku AZ1141, Azerbaijan
Email: ocag.bynm@gmail.com
Where we are. The operator is registered as a sole trader in Azerbaijan, at the address above, and currently lives and works in Pennsylvania, in the United States. The servers and your data are in Ireland (Supabase, eu-west-1). Our users are in the United States, the EU/EEA, the United Kingdom and Azerbaijan, and the app is available in English, Spanish, Catalan, German, French and Korean.
Everything below is grouped by the reason we need it. If a purpose does not apply to you (because you never used that feature), we do not collect the data for it.
Records of alcohol consumption are sensitive. We treat them as private to you and to the people you explicitly chose, we do not sell them, and we never use them for advertising.
Your weight and sex, read together with your drinking records, are health-adjacent information and count as special-category data under GDPR Article 9. So we will be specific: we ask for them only because you chose to open the BAC feature, the calculation itself runs on your device, and we do not use them for anything else: no research, no profiling, no sharing with anyone, no advertising, no automated decisions about you. They are removed from your device when you sign out. Earlier test versions of the app stored a default weight and sex in the profile record; those values were cleared on 16 September 2026 and the database no longer fills them in.
If, and only if, you tap "Find contacts", the app reads your device address book and sends the phone numbers to one of our Supabase functions. That function checks which numbers belong to existing Module D.U.C.K. accounts and returns the username and avatar of each match. It never returns the phone number another user stored, and people who have blocked each other are never matched. To stop the lookup being used to test long lists of numbers, each account can run at most 10 lookups a day, with up to 2,000 numbers each; we record only the time of each lookup, not the numbers. Numbers that do not match an existing user are discarded during the lookup and never stored. We do not keep your address book, we do not keep names, and we never use any of it to send invitations or marketing. Nothing happens unless you press the button.
These notifications are transactional only. We do not send marketing push notifications. You can turn notifications off in your device settings at any time, and the token stops being useful.
Location is significant enough to get its own section. See Section 4, which covers all three flows separately.
document.cookie. See Section 3 for what it does keep locally.Module D.U.C.K. uses localStorage only. No cookies at all. What it keeps there:
| What | Why |
|---|---|
| Your Supabase authentication session token | So you stay signed in. Strictly necessary. |
Your own logs, profile and preferences, cached under keys prefixed duck_ | So the app works when you have no signal. Strictly necessary for the offline feature you asked for. |
| Language and currency preference | Your choice, remembered. |
| Map check-ins | To draw your check-ins without re-fetching them. |
| A 15-minute cache of nearby venues | So the app does not re-query the venue service every time you open the map. |
| Your last known coarse position | So the map opens somewhere sensible instead of blank. |
All of it is either strictly necessary to deliver a feature you asked for, or a preference you set. None of it is used for tracking or advertising and none of it is shared with a third party. Everything is cleared when you sign out, except your language preference, which stays, so the app does not suddenly come back in a language you cannot read.
If you choose to, Module D.U.C.K. can copy your drink logs into Apple Health on your iPhone. It is a switch you turn on yourself in Settings → Sync drinks to Apple Health, and iOS asks for your permission the first time. While that switch is on, each drink is written as you log it; while it is off, nothing is written at all. There is also a Send past drinks button for everything you logged before you turned it on.
Each entry carries the log's own identifier, which is how we avoid writing the same drink to your health record twice, and how deleting a drink in this app also deletes it from Apple Health. The identifier is meaningless outside your phone.
When you use it, we write two kinds of entry to Apple Health: the number of alcoholic drinks you logged, and the dietary calories from those drinks, each dated to when you logged it.
We do not read anything from Apple Health. The app asks only for permission to write. It cannot see your steps, heart rate, weight, sleep, or any other health information, and it requests no read access at all. The one exception is mechanical and limited to our own entries: to avoid duplicates, the app checks which drinks it has already written itself. iOS allows that without any read permission, and it cannot see anything written by you or by another app.
Anything written to Apple Health lives on your device under Apple's control, not ours. Turning the switch off stops new entries but does not remove the ones already there: to delete those, use the Health app, or delete the drinks here one by one, which removes each from Health as it goes.
Data written to Apple Health is stored on your device by Apple, under Apple’s own privacy terms. It is not sent to us and we cannot see it. Deleting your Module D.U.C.K. account does not remove entries already written to Apple Health; you control those in the Health app, and you can revoke our access at any time in iOS Settings → Privacy & Security → Health.
There are four distinct location features in this app and they behave very differently. Read all four, because the third one is not like the others.
When you open the map, look for nearby venues, or open the place picker while logging a drink, the app takes a single approximate position fix so it can centre the map and search for places near you. It is a snapshot, not a trail, and it is not written to any shared table. The most recent one is cached on your device (see Section 3) so the map has somewhere to open.
The app publishes an approximate position to a live_locations record when it comes to the foreground, and then on a schedule that follows what you are doing:
Who can see it: your accepted friends, and nobody else. Only your latest position is kept, so this is a current position rather than a history. When you close the app and you are not in a session, the record is cleared.
The Ghost Mode toggle switches this flow off entirely. If you do not want friends seeing roughly where you are, Ghost Mode is the control to use.
Exactly what happens:
safe_sessions record roughly every 10 seconds.Precise geolocation is sensitive personal information under California law and requires your consent under the GDPR. We rely on the fact that you opened Safe Mode and deliberately started a session. You can withdraw that at any time by ending the session, and you can refuse or revoke the location permission in your device settings, which disables all three flows above.
When you log a drink or start a session you can attach a place. This is a deliberate act: the picker opens with No location selected, and nothing is stored about where you were unless you choose otherwise.
Who sees it: exactly whoever sees the post. A log marked Only me is yours alone, a log marked Friends goes to your accepted friends minus anyone you hid it from, and a log marked Public is visible to every signed-in user. Deleting the log deletes the place with it. Your CSV and JSON export includes the place name and the coordinates so you can see precisely what is stored.
While a session is running, the server checks every five minutes whether any member is more than 300 m from the middle of the group. If somebody is, on two checks in a row, we tell that person and the friends they already have in that session, and nobody else. It is a safety feature, and it was built to give away as little as possible:
If you are in the EU/EEA or the UK, this is the lawful basis we rely on for each thing we do:
| Purpose | Data | Legal basis |
|---|---|---|
| Creating your account, signing you in, keeping you signed in | Email, password hash, username, avatar, Google or Apple account identifier | Contract under Art. 6(1)(b). We cannot give you an account without it. |
| Showing an optional bio and age on your profile and on requests to join a public session; showing a Verified mark | Bio, year of birth, Verified mark | Contract under Art. 6(1)(b): profiles and join requests are part of the service, and these fields exist only if you fill them in. Clear them at any time. |
| Showing your gender on your profile and on requests to join a public session | Gender, and when you chose to show it | Consent under Art. 6(1)(a), given by ticking "Show my gender on my profile". Withdraw it by unticking the box, which erases the value. |
| Storing your phone number on your profile | Phone number | Contract under Art. 6(1)(b): finding friends from their contacts is part of the service, and the number is required to create an account. Erased when you delete your account. |
| Recording, storing, syncing and displaying your drink logs, goals, reactions, comments, check-ins, sessions and friendships | Log contents, photos, visibility settings, hide-from list, goals, friendships, shared session drinks and photos | Contract under Art. 6(1)(b), to provide the service you signed up for; and, because drink logs can reveal information about your health, your explicit consent under Art. 9(2)(a), which you give with a separate checkbox. Withdraw it by deleting your account. |
| Keeping a record of your age confirmation and consents | Country, confirmed minimum age, accepted document version, timestamps | Legal obligation under Art. 6(1)(c), and Art. 7(1), which requires us to be able to show that consent was given. |
| Estimating blood alcohol | Body weight, sex, and your consumption records | Explicit consent under Art. 6(1)(a) and Art. 9(2)(a), because this is health-adjacent special-category data. Optional, used only for the BAC feature you chose to open. Weight and sex are entered, stored and used on your device only. |
| Coarse one-shot location for the map and nearby venues | Approximate position | Consent under Art. 6(1)(a), given through the device location permission. |
| Sharing coarse live location with accepted friends | Approximate position, every 15 to 60 minutes depending on whether a session is running (Section 4, flow 2) | Consent under Art. 6(1)(a). Withdraw it with Ghost Mode or by revoking the device permission. |
| Telling you and your friends in a session that somebody is far from the group | The distance from the group's middle, and who it belongs to | Legitimate interests under Art. 6(1)(f): the safety of people who are out drinking together, which is why the feature exists and why the alert carries no position. Turn it off by leaving the session or using Ghost Mode. |
| Attaching a place to a drink or a session | The venue name and coordinates you picked, or your own position rounded to about 110 m | Consent under Art. 6(1)(a), given by choosing a place instead of "No location"; and explicit consent under Art. 9(2)(a), because it sits on a record of drinking. Withdraw it by deleting the log. |
| Safe Mode precise location and share link | High-accuracy GPS, roughly every 10 seconds while the screen is open | Consent under Art. 6(1)(a), and explicit consent under Art. 9(2)(a) to the extent it is read alongside your drinking records. Withdraw it by ending the session. |
| Matching your contacts against existing users | Phone numbers from your address book | Consent under Art. 6(1)(a), given by tapping "Find contacts". Non-matches are discarded. |
| Push notifications for tags, comments and reactions | Device push token | Contract under Art. 6(1)(b), to deliver the notification feature. Withdraw at the operating-system level. |
| Global public chat | Your messages and your username | Contract under Art. 6(1)(b) for delivering the chat; legitimate interests under Art. 6(1)(f) for the word filter and moderation, to keep the room usable and lawful. |
| Keeping the Service secure, debugging it, preventing abuse and enforcing our Terms | Account identifiers, IP address, server-side records of activity | Legitimate interests under Art. 6(1)(f). |
| Complying with law and responding to lawful requests | Whatever the law requires | Legal obligation under Art. 6(1)(c). |
Where we rely on consent you can withdraw it at any time: clear the field, toggle Ghost Mode, end the Safe Mode session, revoke a device permission, or delete your account. Withdrawing consent does not undo processing that already happened lawfully, and it does not affect the parts of the Service we run on a contract or legitimate-interests basis. Refusing consent for an optional feature never blocks the rest of the app.
| Category | Kept for |
|---|---|
| Account record: email, username, avatar, phone number | As long as your account exists. Erased when you delete the account. |
| Body weight and sex | Kept on your device only, until you change them or sign out. Not held on our servers. |
| Bio, year of birth, gender and when you chose to show it, Verified mark | Until you clear them under Edit profile (clearing gender also clears when you chose to show it), or delete your account. |
| Requests to join a public session, and the note you wrote | Until the session is deleted, or you delete your account. |
| Age confirmation and consent records | As long as your account exists. Erased when you delete the account. |
| Drink logs, including attached photos and the place attached to them | Until you delete the individual log, or delete your account. A photo kept on your phone (Only me logs) is deleted with the log or the account; signing out leaves it on the phone, filed under your account, so it is there when you sign back in, and nobody else who signs in on that phone can see it. Deleting the app removes it. |
| Goals and targets | Until you change them, or until account deletion. |
| Friendships, reactions, comments, check-ins, sessions, and the drinks and photos in shared sessions | Until you remove them or delete your account. Deleting a session removes its drinks and photos, including the uploaded photo files. A comment you left on someone else's log is removed with your account. |
| Global chat messages | Held in the chat room as part of the record of that room. Deleting your account removes your messages from our systems. |
Coarse live location (live_locations) | Cleared as soon as the app goes to the background, unless a session is running, in which case it keeps updating on the schedule in Section 4 until the session ends. The record holds your latest position only; it is not a history. |
Safe Mode precise location (safe_sessions) | Held for the duration of the session so the share link can show your track. The link stops returning coordinates when the session ends or expires. Session records are deleted with your account. |
"Somebody wandered off" alerts (session_alerts) | Deleted after 14 days, or as soon as you delete your account. |
| Contact phone numbers sent for matching | Not retained. Non-matching numbers are discarded during the lookup. We keep only the time of each lookup, for two days, to enforce the daily limit. |
| Device push token | Until the token is replaced, you disable notifications, or the account is deleted. |
| Server-side request records including IP address | Kept only as long as we need them to run and secure the Service, then discarded in the ordinary course by our hosting provider. |
Data cached in localStorage on your device | Cleared on sign-out, except your language preference. |
| Backups | Backups held by our hosting provider may keep a copy for a short period after deletion, until they are overwritten in the ordinary rotation. |
When you use in-app account deletion, the deletion cascades through the database and erases your data from our active systems. We hold nothing back except where the law requires it, or where we genuinely need it to resolve a live dispute or a report of abuse.
This is the complete list, including the ones that only ever see an IP address:
| Recipient | What they get | Why |
|---|---|---|
| Supabase | Everything stored server-side: your account and profile, logs, photos from logs others can see and from sessions, friendships, chat messages, coarse live locations, Safe Mode locations, push tokens, and the phone numbers sent during a contacts lookup | Our database, authentication, storage and edge functions. Our Supabase project runs on Amazon Web Services in the EU (Ireland) region. |
| Amazon Web Services (AWS) | The same data, as the underlying infrastructure | Sub-processor of Supabase. |
| Apple | Push tokens and notification payloads via APNs; App Store account data if you download from the App Store; your Apple account identifier if you use Sign in with Apple | Push delivery, distribution, and sign-in. Governed by Apple's own privacy policy. |
| Your Google account identifier and email address, if you use Sign in with Google | Sign-in only. We do not use Google Analytics, Firebase Analytics, or Google Ads. | |
| OpenStreetMap / Overpass API | Your IP address and your device’s coordinates, which are included in the search request when you look for nearby venues. The main server, overpass-api.de, is operated in Germany. If it does not answer, the app asks a second public Overpass server, overpass.kumi.systems, run by Kumi Systems in Austria, which receives the same information. | Venue search data. |
| Esri (ArcGIS Online) | Your IP address and which map tiles your device requests | Map tile imagery. |
The app and the Safe Mode page load all of their code from the app itself and from our own web pages. No code is fetched from a third-party content delivery network, so none receives your IP address.
Your data is stored in the EU, in our Supabase project's AWS region in Ireland. We run the Service from the United States, so when we operate or support it, the data is accessed from the United States, which does not have an equivalent general data-protection regime. If you are in the United States or Azerbaijan, your data is transferred to and stored in the EU.
For transfers of EEA and UK personal data we rely on the European Commission's Standard Contractual Clauses (and, for the UK, the UK International Data Transfer Addendum) together with our providers' own transfer commitments and supplementary technical measures such as encryption in transit. You can ask us for details of the safeguards that apply to a specific provider using the contact details in Section 1.
If you are in the EU/EEA or the UK you have all of the following rights. Several you can exercise yourself, in the app, right now: those are marked in italics.
To exercise anything you cannot do in the app, email ocag.bynm@gmail.com. We will respond within one month, and will tell you if we need longer (up to two further months) for a genuinely complex request. There is no charge, and we will not treat you any differently for asking.
Module D.U.C.K. is offered only in the United States and Azerbaijan. It is not available from the App Store in the European Union, the European Economic Area or the United Kingdom, so we have not appointed a representative there under Article 27 of the GDPR or the UK GDPR. If that ever changes, we will appoint one before the app is offered there, and name them here.
This section is for California residents. If you are elsewhere in the US, see the note at the end of it.
| CCPA category | What that is, here |
|---|---|
| Identifiers | Email address, username, account ID, phone number, device push token, IP address |
| Personal information under Cal. Civ. Code §1798.80 | Phone number |
| Characteristics of protected classifications | Your age and gender, only if you choose to add them to your profile. If you enter your sex for the BAC estimate, it stays on your device and is not sent to us. |
| Commercial information | What you paid for a drink, as you recorded it yourself |
| Internet or network activity | Which features you used, as a consequence of the app talking to our database. No analytics SDK, no ad tech, no cross-site tracking. |
| Geolocation data | Coarse location for the map and for friends; precise location in Safe Mode |
| Audio, electronic, visual information | Photos you attach to a log others can see, or post into a session. Photos on Only me logs stay on your phone and are not collected by us. |
| Health-adjacent information | Your alcohol consumption records. (Body weight and sex, if you enter them, stay on your device.) |
| Inferences | Your own statistics and streaks, derived from your logs and shown only to you and the people you share with. We build no advertising or behavioural profile. |
We collect each of these for the purposes set out in Section 2, we get them from you and from your device, and we disclose them only to the recipients named in Section 7.
We have not sold personal information, and we have not shared it for cross-context behavioural advertising, in the preceding 12 months, and we do not do either now. We also do not knowingly sell or share the personal information of anyone under 16. There is no advertising business here to sell it to.
Under the CPRA, precise geolocation is sensitive personal information, and so is health information. Module D.U.C.K. collects precise geolocation in Safe Mode, and stores drinking records, which are health-adjacent, to run the drink log.
We use both only for the feature you opened them for: showing your live position to the people you sent your Safe Mode link to, and keeping your drink log for you and the people you share it with. We do not use sensitive personal information to infer characteristics about you and we do not use it for advertising, so the CPRA exemption for use limited to providing the service you requested applies. Even so, you can limit it yourself and immediately: end the Safe Mode session, turn on Ghost Mode, revoke the location permission, or delete logs you no longer want kept. You can also email ocag.bynm@gmail.com and ask us to limit use.
You may use an authorised agent. We will verify a request against your account before acting on it, because acting on an unverified deletion request would itself be a privacy failure.
Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and other states with comprehensive privacy laws have broadly similar rights: access, correction, deletion, a portable copy, and opting out of targeted advertising, sale, and profiling with significant effects. We do not engage in targeted advertising, sale, or that kind of profiling at all. Use the contact details in Section 1 to exercise your rights, including any right to appeal a decision we make.
Age is currently enforced by self-declaration: when you sign up, or the first time you sign in with Google or Apple, you confirm you meet the requirement for the country you live in, and we record when you did. The app does not check it against a document or a third-party age-verification service. We are telling you that plainly rather than implying a check that does not exist.
We do not direct the Service to children and we do not knowingly collect personal information from anyone under 18. If we learn that an account belongs to someone under 18 we will delete the account and the data with it. If you believe a minor has an account, contact ocag.bynm@gmail.com and we will act on it.
In the app: Profile → Settings → Delete Account. This is a real deletion, not a deactivation. It cascades through the database and erases your profile, consent records, logs and photos, goals, friendships, reactions, comments, check-ins, sessions and their drinks and photos, chat messages, push token, and location records. The backup note in Section 6 is the only caveat. Deletion cannot be undone, so export first if you want your logs.
In the app you can export your drink logs as a CSV file. For anything the export does not cover, email ocag.bynm@gmail.com and we will provide it.
What we actually do:
Two honest caveats. First, an unguessable link is only as private as the person you send it to: anyone holding a live Safe Mode link can see your precise location, so send it deliberately. Second, your phone number is stored in plain text in the profile table (see Section 2(a)); it is required to hold an account, so if that bothers you, do not create one.
No system is perfectly secure and we cannot promise absolute security. Please use a strong, unique password and keep it to yourself. If we become aware of a personal-data breach likely to create a risk to you, we will notify the relevant supervisory authority and the affected users without undue delay, and within 72 hours where the GDPR requires it.
We will update this Policy when the app changes. How you will find out:
| Privacy questions and rights requests | ocag.bynm@gmail.com |
|---|---|
| Controller and postal address | Nariman Mammadov (Məmmədov Nəriman Bəxtiyar oğlu), a sole trader registered with the State Tax Service of the Republic of Azerbaijan, taxpayer number (VÖEN) 1310036412, General Akim Abbasov St. 16, apt. 58, Yasamal District, Baku AZ1141, Azerbaijan |
| Supervisory authority | Your national data-protection authority. |
| An emergency | Do not email us. Call your local emergency number: 911 (US), 112 (EU), 999 (UK), 103 (Azerbaijan). |