Privacy Policy

1. Who we are

This Privacy Policy explains how personal information may be processed when you visit kittenducks.com.

The data controller responsible for the processing described in this Privacy Policy is:

Because the controller is established in Iceland, processing carried out in the context of this website is subject, where applicable, to the General Data Protection Regulation (GDPR) and Iceland's Act No. 90/2018 on Data Protection and the Processing of Personal Data (lög nr. 90/2018 um persónuvernd og vinnslu persónuupplýsinga).

This Privacy Policy applies to the kittenducks.com website. If Kitten & Ducks later becomes available as a game, application, online service, account system or other product that processes additional personal information, this Privacy Policy will be updated or replaced as appropriate before that processing begins.

2. Our approach to privacy

This website is intentionally designed to collect as little information about visitors as reasonably possible.

The website currently has no user accounts, registration system, contact form, newsletter, payment system, advertising, behavioral profiling or personalized content.

We do not operate our own visitor database and do not maintain individual visitor profiles.

We do not sell personal information, rent personal information, use personal information for targeted advertising, or share personal information for cross-context behavioral advertising.

The website uses Cloudflare for website delivery, security and privacy-preserving web analytics.

3. Information processed when you visit the website

When you visit kittenducks.com, some technical information must necessarily be processed in order to deliver the website over the Internet, protect it from abuse and understand its basic performance.

Some of this information, particularly an IP address and request metadata, constitutes personal data under the GDPR where it relates to an identified or identifiable person.

Cloudflare processes visitors' interactions with websites using its network and states that this may include IP addresses, traffic-routing data, system configuration information and other traffic information. Information Cloudflare makes available to customers through its dashboard or interfaces is referred to as “Customer Logs.”

We do not maintain our own separate web-server access-log database.

Cloudflare security tools may nevertheless make limited information about particular requests or security events available to us. Depending on the Cloudflare service involved, this can include information such as an IP address, requested URL, country, user agent or security action. We use such information only when reasonably necessary to investigate abuse, attacks, security incidents or technical problems.

4. Cloudflare Web Analytics

We use Cloudflare Web Analytics to understand, at an aggregate level, whether the website is being used and whether it performs correctly.

Cloudflare states that Web Analytics does not collect or use visitors' personal data. Its analytics system provides metrics such as page views, visits, paths, referrers, country, browser, operating system, device type and performance information.

Cloudflare Web Analytics does not use cookies or localStorage to collect usage metrics, and Cloudflare states that it does not fingerprint visitors using IP addresses, user-agent strings or other data.

Cloudflare Web Analytics does not provide us with a visitor-by-visitor list of IP addresses, and we do not use analytics information to identify individual visitors.

This should be distinguished from Cloudflare's underlying network and security services. Cloudflare necessarily processes network information, including IP addresses, when a request passes through its infrastructure, even though those IP addresses are not used by us as individual Web Analytics identifiers.

5. Why we process this information

Where the GDPR or equivalent EEA data-protection law applies and the information constitutes personal data, we rely primarily on Article 6(1)(f) GDPR — legitimate interests.

Our legitimate interests are:

• making the website reliably available;
• protecting the website and its infrastructure against attacks, malicious traffic and abuse;
• diagnosing technical or availability problems; and
• understanding, at an aggregated and privacy-preserving level, whether the website is being used and functioning properly.

We have considered these interests against the privacy interests, fundamental rights and reasonable expectations of visitors. We consider the processing proportionate because it is limited and primarily technical, the website deliberately avoids advertising trackers, analytics cookies, cross-site tracking, visitor profiles and behavioral advertising, and we use privacy-preserving analytics rather than attempting to identify individual visitors.

The GDPR specifically recognizes processing that is strictly necessary and proportionate for network and information security, including preventing unauthorized access, malicious activity and denial-of-service attacks, as a legitimate interest.

Where we process information in order to comply with a legal obligation, Article 6(1)(c) GDPR may instead apply.

We do not rely on consent as the GDPR legal basis for the website-delivery, security and analytics processing described above.

6. Cookies, advertising and tracking

We do not set our own cookies on this website.

Cloudflare Web Analytics does not use cookies or localStorage to collect analytics information.

Cloudflare's security services may, however, set strictly necessary security cookies if a Cloudflare security feature or challenge requires them. For example, Cloudflare documents cookies such as cf_clearance for challenge clearance and, where relevant bot-protection features are enabled, __cf_bm for bot detection. These cookies are used for security and traffic-protection purposes, not advertising or cross-site behavioral profiling.

We do not use advertising cookies, marketing cookies or cross-site tracking technologies.

We do not create advertising profiles, use behavioral advertising or track visitors across unrelated websites.

We do not sell or rent personal information.

We do not share personal information for cross-context behavioral advertising.

If any of these practices change in the future, this Privacy Policy will be updated before such processing is introduced.

7. Cloudflare as a service provider

We use services provided by Cloudflare, Inc. for website delivery, content delivery, caching, network security and analytics.

Under Cloudflare's Data Processing Addendum, Cloudflare acts as a processor for personal data contained in Customer Logs and processes such information on behalf of its customer in order to provide the Cloudflare services. Cloudflare's DPA also states that, where the CCPA applies, Cloudflare does not sell or share personal data that it processes on behalf of customers.

Cloudflare also generates certain network-level information and security intelligence, referred to in its Privacy Policy as “Network Data,” in connection with operating and protecting its network. Cloudflare's own processing of such information is described in Cloudflare's Privacy Policy.

8. How long information is retained

We do not maintain our own historical database of individual visitor activity or IP addresses.

For Cloudflare Web Analytics, Cloudflare currently states that it retains unsampled beacon data for 7 days. After that period, Cloudflare aggregates the data down to approximately 10% of the original volume for longer-term analytics storage. Cloudflare's Web Analytics documentation does not currently specify a fixed deletion period for that longer-term aggregated dataset. Cloudflare currently makes Web Analytics data available to customers for the previous six months.

Cloudflare may retain network, security and Customer Log information for different periods depending on the service and purpose involved. Cloudflare states that visitor-related network metadata is processed for a limited period of time.

For personal data that Cloudflare processes on our behalf under its Data Processing Addendum, the stated retention criterion is generally until the earlier of termination or expiry of the relevant Cloudflare agreement, or the point at which processing is no longer necessary to provide the relevant services, subject to applicable legal requirements.

If you contact us directly about a privacy matter or security issue, we normally retain the correspondence for up to 12 months after the matter has been resolved. We may retain it for longer where reasonably necessary to comply with a legal obligation, establish, exercise or defend legal claims, or document a significant security incident.

9. International processing and transfers

Cloudflare operates a global network.

Technical information may therefore be processed outside the country from which you access the website. Cloudflare states that metadata relating to its core services may be processed in data centers in the United States and Europe.

Where European data-protection law applies to international transfers, Cloudflare states that it uses recognized transfer mechanisms including the EU-U.S. Data Privacy Framework and, where applicable, the European Commission's Standard Contractual Clauses together with supplementary safeguards.

10. Your privacy rights

Depending on where you live and which privacy laws apply, you may have rights regarding personal information concerning you.

These may include rights to request information about processing, obtain access to or a copy of personal information, correct inaccurate information, request deletion, restrict or object to certain processing, and complain to a competent privacy authority.

Because we deliberately do not maintain user accounts or individual visitor profiles, in many cases we may have little or no information that allows us to identify a particular visitor. We will not attempt to identify you from additional information merely in order to create a record that we otherwise do not maintain.

EEA and Iceland

For individuals whose rights are governed by the GDPR and Icelandic law, rights arise under the GDPR and Act No. 90/2018 on Data Protection and the Processing of Personal Data (lög nr. 90/2018 um persónuvernd og vinnslu persónuupplýsinga).

Where the GDPR applies to a request, we will respond without undue delay and, in any event, within one month of receiving the request. Where permitted by law and necessary because of the complexity or number of requests, that period may be extended by up to two additional months. If an extension is required, we will inform you within the initial one-month period and explain the reason for the delay.

You also have the right to lodge a complaint with the Icelandic supervisory authority:

You may also have the right to complain to another competent supervisory authority where applicable.

Brazil

Where Brazil's Lei Geral de Proteção de Dados (LGPD) applies, applicable rights may include confirmation of processing, access, correction, anonymization, blocking or deletion in circumstances provided by law, portability where applicable, and information concerning sharing of personal information.

Japan

Where Japan's Act on the Protection of Personal Information (APPI) applies, applicable rights may include disclosure, correction and, where statutory conditions are met, cessation of use or deletion of retained personal data.

China

Where China's Personal Information Protection Law (PIPL) applies, individuals may have rights including the right to be informed about processing, to restrict or refuse processing, to access or copy personal information, to request correction and, in circumstances specified by law, to request deletion.

The inclusion of this section does not mean that every privacy law listed above necessarily applies to every visitor or to every processing activity. Applicability depends on the circumstances and the territorial and other requirements of the relevant law.

11. California privacy information

The California Consumer Privacy Act (“CCPA”), as amended, applies only where its statutory requirements are met.

Where the CCPA applies to us, the categories of personal information that may be processed in connection with this website are primarily identifiers, such as an IP address, and Internet or other electronic network activity information, such as browser, request and network information.

We do not sell personal information.

We do not share personal information for cross-context behavioral advertising.

We do not use personal information for targeted advertising.

We do not offer financial incentives in exchange for personal information.

We do not intentionally collect sensitive personal information through this website.

Where applicable, California residents may have rights to know, delete, correct and receive equal treatment, as well as rights relating to the sale or sharing of personal information and the use of sensitive personal information. Since we do not sell or share personal information for cross-context behavioral advertising, there is currently no sale or sharing from which a visitor needs to opt out.

12. Children

This website does not provide user accounts, chat, messaging, forms, behavioral advertising or other features designed to collect personal information from children.

We do not knowingly ask children to provide personal information.

Technical information required to deliver and protect the website may nevertheless be processed by Cloudflare in the same manner as for other website visitors.

If you are a parent or guardian and believe that a child has provided personal information directly to us, you may contact us at privacy@kittenducks.com.

13. Automated decision-making and profiling

We do not use personal information collected through this website to make automated decisions that produce legal or similarly significant effects concerning visitors.

We do not create behavioral or marketing profiles of visitors.

14. Security

We use reasonable technical measures intended to protect the website and minimize unnecessary processing of personal information.

Cloudflare provides network, availability and security services used to protect the website against malicious traffic and attacks.

Security vulnerabilities relating to this website may be reported to security@kittenducks.com.

Additional security-contact information is available at https://kittenducks.com/.well-known/security.txt.

15. Changes to this Privacy Policy

We may update this Privacy Policy if the website, our use of Cloudflare or applicable legal requirements change.

The effective date and last updated date at the top of this page indicate when the policy took effect and when it was most recently revised.

We consider a change material where it introduces a significant new category of personal information, a new purpose for using personal information, materially different sharing or disclosure, advertising or profiling, or a new feature such as accounts, newsletters, purchases, community features or a playable online game that changes the privacy impact of the website.

Where a material change affects how personal information is processed, we will update the privacy information before the new processing begins and provide any additional notice required by applicable law.

16. Language

This Privacy Policy is originally drafted and published in English and may be made available in additional languages for the convenience of our visitors.

If there is any inconsistency or difference in interpretation between the English version and a translated version, the English version will prevail to the extent permitted by applicable law.

Nothing in this provision limits any rights you may have under mandatory applicable data-protection law.