This Privacy Policy explains how INDARRA LIMITED ("we", "us", the "Company") collects and processes personal data in connection with the DuckWise mobile application (the "App") and related services.
The data controller is:
For any question about this policy or to exercise your rights, write to the address above. We have not appointed a Data Protection Officer; the contact above handles all data protection matters.
DuckWise gives access to investment research ideas produced by DuckWise Research, operated by INDARRA LIMITED, presented as a model portfolio. Access to analytical content requires a paid subscription after the free trial. The App does not execute trades, does not hold client funds or securities, and does not provide personalised investment advice.
| Category | Examples | Why | Legal basis (GDPR Art. 6) |
|---|---|---|---|
| Account identifier | An anonymous identifier created automatically on first launch. We do not require your name, postal address or phone number. | To link your subscription and settings to your installation | Contract — Art. 6(1)(b) |
| Device & technical data | Device model, operating system and version, app version, language, time zone, the technical user-agent string the App sends with each request, IP address and the approximate region derived from it, crash and performance diagnostics | To operate the App, keep it secure and fix faults | Contract — Art. 6(1)(b); legitimate interests — Art. 6(1)(f) |
| Push token | A notification token issued by Apple/Google | To notify you about new and closed ideas, if you allow notifications | Consent — Art. 6(1)(a) |
| Subscription data | Subscription status, product purchased, trial and renewal state, transaction identifiers | To grant access to paid content and handle restores | Contract — Art. 6(1)(b) |
| Advertising attribution | If you installed the App after tapping one of our advertisements on the App Store, Apple issues a one-time attribution token that tells us the campaign and keyword the tap came from. It is collected through Apple's AdServices framework and does not identify you or track you across other apps or sites; we do not ask for tracking permission and do not use the advertising identifier (IDFA). | To measure whether our advertising brings people who find the App useful, and how much it costs | Legitimate interests — Art. 6(1)(f) |
| Usage data | Ideas opened, items you add to favourites, read/unread state, feature usage, and the steps you go through in the App (for example onboarding screens, the subscription offer, a purchase started or cancelled, a notification opened), each with its time | To provide the service and improve it | Contract — Art. 6(1)(b); legitimate interests — Art. 6(1)(f) |
| Website: Android waiting list | The email address you enter on tradeasduck.com to be told when an Android version ships, the date you entered it and your browser type | To send you one message when the Android version is available. We do not use it for any other mailing. | Consent — Art. 6(1)(a); you can withdraw it at any time by writing to us |
| Website: visit statistics | Page viewed, referring site, browser and device type, screen size, country derived from the IP address. The IP address itself is not stored and no cookies or persistent identifiers are set; visits cannot be tied to you. | To understand how many people visit the site and from where | Legitimate interests — Art. 6(1)(f) |
Subscriptions are sold through the Apple App Store. We never receive your card number or bank details. Apple processes the payment and shares with us only the information needed to confirm your entitlement, such as subscription status and transaction identifiers.
| Provider | Purpose |
|---|---|
| Google Firebase (Authentication, Firestore, Cloud Messaging, Performance Monitoring, Cloud Functions) — privacy | Anonymous account identifiers, content delivery, push notifications, performance diagnostics |
| RevenueCat — privacy | Validating App Store subscriptions, managing entitlements, and matching subscriptions to the Apple Ads attribution token described in section 3 |
| Apple Ads — privacy | Reporting installs and subscriptions back to our advertising campaigns on the App Store, at campaign and keyword level only |
| Apple — privacy | App distribution, payments, subscription management |
Our own servers at api.tradeasduck.com, hosted on DigitalOcean infrastructure in the United States | Delivering research content and verifying subscription entitlement |
We may also disclose data where we are legally required to, to establish or defend legal claims, or to detect and prevent fraud and abuse. Beyond this, we do not share your personal data.
Our own servers are located in the United States, and some providers listed above may also process data outside the European Economic Area. Where a transfer is not covered by an adequacy decision, it rely on the European Commission's Standard Contractual Clauses under Art. 46 GDPR, together with technical measures such as encryption in transit and access controls.
We keep personal data for as long as you use the App, and afterwards only where necessary: subscription and transaction records for as long as required by tax and accounting law, and limited records needed to resolve disputes or prevent abuse. Diagnostic data is kept for a short period and then deleted or aggregated. Android waiting-list addresses are deleted once the Android version has shipped and the notice has been sent, or earlier on request.
Subject to the conditions in the GDPR, you have the right to: access your data; have it corrected; have it erased; restrict processing; object to processing based on legitimate interests; receive your data in a portable format; and withdraw consent at any time (for example by turning off notifications in your device settings), without affecting processing already carried out.
To exercise any of these rights, email developer@tradeasduck.com. We reply within one month.
You also have the right to lodge a complaint with a supervisory authority — in Cyprus, the Office of the Commissioner for Personal Data Protection (dataprotection.gov.cy) — or with the authority where you live.
The App is intended for adults and is rated accordingly. It is not directed to children, and we do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, contact us and we will delete it.
We use encryption in transit, access controls and monitoring to protect personal data against loss, misuse and unauthorised access. No system is completely secure; if a personal data breach occurs we will notify the competent authority and affected users where the law requires it.
We may update this policy. The current version is always published at tradeasduck.com/privacy/ and takes effect when published. The effective date appears at the top of this page. Only the English version has legal effect.
INDARRA LIMITED, Floor 2, 82 Akropoleos, Strovolos 2012, Nicosia, Cyprus — developer@tradeasduck.com