Privacy Policy

About This Policy

This Privacy Policy describes how CruisingWithAI LLC, doing business as The Original Duck Tracker (“CruisingWithAI,” “we,” “us,” or “our”), collects, uses, shares, and protects information when you visit our website at https://cruisingwithai.com, create an account, hatch or find a duck, follow a duck's journey, or otherwise interact with our service (collectively, the “Service”).

By using the Service, you agree to the collection and use of your information in accordance with this Privacy Policy. If you do not agree with our practices, please do not use the Service.

This Privacy Policy is incorporated into and forms part of our Terms of Use.

1. Information We Collect

1.1 Information You Provide Directly

When you use the Service, you may provide us with the following information:

• Account information — your email address, password (managed by our authentication provider, Clerk), and a display name you choose.
• Duck registration information — names, descriptions, and other details you provide when registering (“hatching”) ducks or custom items, including duck names, origin descriptions, and optional notes.
• Event information — narratives, comments, and location descriptions you submit when logging duck events (hatched, hidden, found, kept, released, returned).
• Photos — images you upload during hatching, hiding, or finding ducks.
• Follow information — the email address (and optionally phone number, when SMS launches) you provide to follow a duck's journey.
• Communications — any information you provide when you contact us at [email protected] or respond to our emails.

1.2 Information Collected Automatically

When you access the Service, we and our service providers automatically collect:

• Technical information — IP address, browser type and version, operating system, device type, screen size, and language preferences.
• Usage information — pages viewed, links clicked, time spent on pages, and referring URLs.
• Location information — when you choose to share your device's GPS location during a duck event (hatch, hide, or find), we collect approximate latitude and longitude. You can decline to share location, and the Service will work without it.
• Approximate location from IP — even without GPS sharing, your IP address provides an approximate location (typically city/region level) for security, fraud prevention, and analytics purposes.
• Cookies and similar technologies — see Section 9.

1.3 Information We Do Not Collect

We do not collect: financial information (we don't accept payments), Social Security numbers, government IDs, biometric data, health information, or any information about your race, religion, political views, or sexual orientation. We do not require you to upload photos of identifiable people.

2. How We Use Your Information

We use the information we collect for the following purposes:

• To provide the Service — create and maintain your account, display your hatched ducks in your Pond, track duck journeys, and process duck events.
• To send service communications — notifications when ducks you follow have new events, account-related emails (password resets, sign-in alerts), and important Service updates.
• To moderate content — automated review of submitted text and photos to detect prohibited content such as profanity, hate speech, and explicit imagery (see Section 8).
• To improve the Service — analyze how users interact with the Service to fix bugs, identify popular features, and develop new functionality.
• To enforce our Terms — investigate violations of our Terms of Use, suspend or terminate offending accounts, and respond to legal claims.
• To comply with law — respond to lawful requests from government authorities, court orders, and subpoenas.
• To protect the Service and our users — detect and prevent fraud, abuse, spam, and security threats.

3. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area, the United Kingdom, Iceland, Liechtenstein, or Norway, our legal basis for processing your personal information depends on the specific information involved and the context. We process your information on the following legal bases:

• Performance of a contract — to provide the Service you have signed up for (account creation, duck tracking, notifications).
• Consent — where you have given us specific consent (e.g., to receive marketing emails or follow a duck via email).
• Legitimate interests — to operate, improve, and secure the Service in ways that do not override your fundamental rights (e.g., fraud prevention, analytics, content moderation).
• Legal obligations — to comply with applicable laws and respond to lawful requests.

You may withdraw your consent at any time where consent is the legal basis — see Section 13 for how.

4. How We Share Your Information

We do not sell your personal information. We share information only in the following limited circumstances:

4.1 With Service Providers

We share information with trusted third-party companies that help us operate the Service. These providers are contractually limited to using your information only to provide services to us. See Section 5 for the complete list.

4.2 With Other Users (Public Information)

Certain information is intentionally public on the Service — see Section 6.

4.3 For Legal Reasons

We may disclose information if required by law, subpoena, court order, or legal process; to respond to legitimate government requests; to protect the rights, property, or safety of CruisingWithAI, our users, or others; or to investigate fraud, security, or technical issues.

4.4 In Connection with Business Changes

If CruisingWithAI is involved in a merger, acquisition, sale of assets, or bankruptcy, your information may be transferred as part of that transaction. We will provide notice before your information becomes subject to a different privacy policy.

4.5 With Your Consent

We may share information with third parties when you specifically direct us to do so (for example, when you share a duck's journey to a social media platform).

5. Service Providers We Use

To operate the Service, we use the following service providers, each of which may process personal information on our behalf:

Each of these providers maintains its own privacy policy. We have selected providers that maintain industry-standard security and privacy practices.

6. Public Information

Some information is intentionally public on the Service so that the duck-tracking community can function:

• Duck journey pages — every duck has a public page showing its journey (events such as hatch, hide, find, keep). These pages are visible to anyone with the duck's code or who finds a duck and scans its QR code.
• Display names — the display name you choose is shown alongside your duck events on public journey pages.
• Hatcher attribution — unless you choose to be a “Mystery Hatcher,” your display name is associated with ducks you have hatched.
• Event narratives — text narratives you submit with duck events appear on public journey pages.
• Photos — photos you upload with duck events appear on public journey pages and may be displayed elsewhere on the Service.
• Approximate location — if you allow location capture, an approximate location for the event may appear on the public journey.

Your email address and phone number are never displayed publicly. If you wish to be anonymous as a hatcher, select the “Mystery Hatcher” option when hatching.

7. Photos & Location Data

7.1 Photos

When you upload a photo to the Service, we automatically strip EXIF metadata (such as embedded GPS coordinates, camera model, and timestamps) before storing the image. The image itself is stored in Cloudflare R2 storage and made accessible at a public URL so that it can appear on the duck's journey page.

You are responsible for the content of photos you upload. You should not upload photos that contain identifiable images of other people without their consent, photos of minors, or photos containing sensitive personal information (such as license plates, ID cards, or addresses).

7.2 GPS Location

When you log a duck event, the Service may request access to your device's GPS location. Sharing your location is optional — you can decline, and the Service will continue to work. If you do share location, the approximate latitude and longitude is stored and may appear on the duck's public journey page.

You can revoke location permission at any time through your device or browser settings. Previously submitted location data remains in the system unless you delete the associated event or your account.

7.3 IP-Based Location

Your IP address provides an approximate location (typically at the city or region level). We use this information for security purposes (detecting suspicious sign-ins from unusual locations), analytics, and to comply with regional regulations. IP-based location is not displayed publicly.

8. Content Moderation & Automated Decision-Making

To maintain a safe community, we use automated systems to review content you submit before it is published:

• Text moderation — submitted text (duck names, narratives, locations, display names) is checked against a profanity blocklist and analyzed by an automated content classifier to detect prohibited content (hate speech, harassment, sexual content, threats, etc.).
• Image moderation — uploaded photos are analyzed by an automated image classifier to detect explicit, graphic, or otherwise prohibited imagery.

If content fails automated review, the submission may be rejected and you will see an error message. Repeated violations may result in account suspension or termination as described in our Terms of Use.

Your rights regarding automated decisions: If you believe a moderation decision was made in error, you may contact us at [email protected] and we will review the decision. If you are located in the EU, UK, or another jurisdiction with relevant rights, you have the right to request human review of significant automated decisions affecting you.

9. Cookies & Similar Technologies

We use cookies and similar technologies to operate the Service. The cookies we use are limited to the following categories:

• Strictly necessary cookies — required for the Service to function, including session cookies set by Clerk to keep you signed in.
• Functional cookies — set by Cloudflare to balance traffic, prevent abuse, and serve the website efficiently.
• Preference cookies — remember your selections (such as form data and recent activity) within the Service.

We do not use cookies for advertising, behavioral tracking, or analytics that build a profile across other sites. We do not embed third-party tracking pixels (Facebook Pixel, Google Analytics tracking, etc.).

You can control cookies through your browser settings. Blocking strictly necessary cookies will prevent the Service from working correctly — for example, you will not be able to stay signed in.

10. Data Retention

We retain different categories of information for different periods:

• Account information — retained as long as your account is active. If you delete your account, we delete or anonymize associated personal information within 30 days, except where retention is required by law.
• Duck events — because the duck-tracking model is intentionally append-only (each event becomes a permanent part of a duck's journey), event records are retained indefinitely unless you specifically request deletion. When you delete an event, your display name may be replaced with “Anonymous” and your narrative text removed, but the event record itself (date, duck code, action type) may be retained as part of the duck's journey.
• Photos — retained as long as the associated duck or event exists. Photos may also be retained in backups for up to 90 days after deletion.
• Communications — emails between you and CruisingWithAI are retained for up to 3 years for customer service and legal purposes.
• Technical logs — IP addresses, request logs, and similar information are retained for up to 90 days for security and analytics.
• Legal holds — information subject to legal hold, ongoing investigations, or regulatory requirements is retained until those obligations are resolved.

11. Data Security

We implement reasonable technical and organizational security measures to protect your information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using HTTPS/TLS.
• Encryption of data at rest in our database and photo storage.
• Password hashing (passwords are never stored in plain text).
• Access controls limiting administrative access to authorized personnel.
• Multi-factor authentication for administrative accounts.
• Regular review of security practices and our service providers' security posture.

However, no security system is impenetrable. We cannot guarantee the absolute security of your information. If we become aware of a data breach that affects your personal information, we will notify you and any required authorities in accordance with applicable law.

12. International Data Transfers

CruisingWithAI is based in the United States. Our service providers (Cloudflare, Clerk, Resend, and others) operate globally and may store and process your information in the United States or other countries.

If you are located outside the United States, your information will be transferred to, stored in, and processed in the United States, which may have data protection laws different from those of your country. By using the Service, you consent to this transfer.

For users in the EEA, UK, or Switzerland: where required, we rely on appropriate safeguards (such as Standard Contractual Clauses approved by the European Commission) for international data transfers.

13. Your Privacy Rights

Depending on where you live, you may have the following rights regarding your personal information:

• Access — request a copy of the personal information we hold about you.
• Correction — request that we correct inaccurate or incomplete information.
• Deletion — request that we delete your personal information (subject to legal retention requirements).
• Portability — receive a copy of your information in a machine-readable format.
• Objection — object to certain processing activities (such as direct marketing).
• Restriction — request that we limit how we process your information in certain circumstances.
• Withdraw consent — if processing is based on your consent, you may withdraw consent at any time.
• Lodge a complaint — file a complaint with your local data protection authority.

To exercise any of these rights, email us at [email protected]. We will respond within 30 days (or as required by applicable law). We may need to verify your identity before fulfilling your request.

You can also update your account information at any time by signing in to your account.

14. California Residents (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants you the following rights:

• Right to know — what personal information we collect, the sources of that information, the purposes for which we use it, and the categories of third parties with whom we share it.
• Right to delete — request deletion of personal information we have collected about you.
• Right to correct — request correction of inaccurate personal information.
• Right to opt out of sale or sharing — CruisingWithAI does not sell or share your personal information for cross-context behavioral advertising.
• Right to limit use of sensitive personal information — we do not use sensitive personal information for any purpose beyond what is necessary to provide the Service.
• Right to non-discrimination — we will not discriminate against you for exercising any of these rights.

To exercise your CCPA/CPRA rights, email us at [email protected]. You may also designate an authorized agent to make a request on your behalf.

If we cannot resolve your complaint, you may contact the California Privacy Protection Agency or the California Attorney General's office.

15. European & UK Residents (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, Iceland, Liechtenstein, or Norway, the General Data Protection Regulation (GDPR) and UK GDPR grant you specific rights, all of which are reflected in Section 13 above.

Data Controller: CruisingWithAI LLC is the data controller responsible for your personal information.

Right to lodge a complaint: You have the right to lodge a complaint with your local supervisory authority. A list of EU supervisory authorities is available at edpb.europa.eu. UK residents may contact the Information Commissioner's Office (ICO).

We do not currently have an EU representative as our processing of EU residents' data is limited and occasional. If our processing increases in scale or frequency such that an EU representative is required under Article 27 GDPR, we will appoint one and update this Privacy Policy accordingly.

16. Texas Residents (TDPSA)

Effective July 1, 2024, the Texas Data Privacy and Security Act (TDPSA) provides Texas residents with rights similar to those in California's CCPA, including the right to know, access, correct, delete, and opt out of certain processing activities. All Texas residents may exercise these rights by contacting us at [email protected].

We do not engage in targeted advertising, sale of personal data, or profiling that produces legal or similarly significant effects.

17. Children's Privacy

The Service is intended for users who are at least 18 years old. We do not knowingly collect personal information from children under 18. If we learn that we have collected personal information from a child under 18, we will delete that information as soon as reasonably possible.

If you are a parent or legal guardian and believe your child has provided us with personal information, please contact us at [email protected] and we will take steps to delete the information.

18. Do Not Track Signals

Some browsers offer a “Do Not Track” (DNT) signal. Because there is no industry consensus on how to interpret DNT signals, our Service does not currently respond to DNT signals. However, as described in Section 9, we do not engage in cross-site tracking or behavioral advertising in any case.

19. Third-Party Links

The Service may contain links to third-party websites or services (for example, when you share a duck's journey to Facebook, Instagram, or other social platforms; when we link to a cruise line's website; or when you click a Google Maps link). These third parties have their own privacy policies, and we are not responsible for their practices. We encourage you to read the privacy policies of any third-party websites you visit.

20. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. When we make material changes, we will:

• Update the “Last updated” date at the top of this Privacy Policy.
• Notify you by email (sent to the address associated with your account) at least 30 days before the changes take effect, when the changes are material.
• Post a notice on the Service.

Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated Privacy Policy. If you do not agree with the changes, you should stop using the Service and may request account deletion.

21. Contact Us

If you have questions, concerns, or complaints about this Privacy Policy or how we handle your personal information, please contact us:

CruisingWithAI LLC
doing business as The Original Duck Tracker
Email: [email protected]
Website: https://cruisingwithai.com

We will do our best to respond within 30 days. For complaints we cannot resolve, you may also contact your local data protection authority (see Sections 14, 15, and 16 for details depending on your jurisdiction).