Privacy Policy

• Name and email address
• Self-reported financial estimates: credit score range, savings amount, income estimate, and liability amounts
• Document checklist completion status — a true/false checkmark per item, not the documents themselves
• Professional license numbers (for Professional accounts)
• Basic account activity, such as last login time

Duck & Key never asks for or stores:

• Social Security numbers
• Bank statements or bank account credentials
• W-2s, pay stubs, or tax returns
• Any uploaded document of any kind — the document checklist tracks completion status only

• To provide the readiness tracking service — calculating and displaying S.A.I.L. progress
• To notify Professionals when their Clients make progress or reach readiness thresholds
• To send account, billing, and product emails (see “Email Communications” below)
• To maintain the security and integrity of the Service

Your data is stored in a PostgreSQL database hosted by Supabase, with infrastructure located in the United States. Access to Client financial estimates is restricted to the Client themselves and the Professional(s) they're connected to, enforced by row-level security policies at the database level.

We use Resend to deliver transactional and product emails (e.g., invite links, readiness notifications, billing receipts). Non-essential emails include an unsubscribe link, and Professionals can also turn off individual notification types from their Settings page.

We do not sell your personal information to third parties. We share data only with service providers who process it on our behalf, under contract, to run the Service:

• Supabase — database and authentication hosting
• Resend — transactional email delivery
• Stripe — subscription billing and payment processing (Duck & Key never sees or stores full card numbers)

Depending on where you live, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Request deletion of your information
• Receive a copy of your data in a portable format
• Opt out of the sale of personal information — we do not sell personal information, so this is satisfied by default

California residents have these rights under the CCPA; residents of the European Economic Area have equivalent rights under the GDPR. To exercise any of these rights, contact us at admin@duckandkey.com.

We retain account data for as long as your account is active. If you close your account or request deletion, we will delete your personal information within a reasonable period, except where we're required to retain certain records for legal, tax, or compliance purposes (for example, Professionals' compliance audit logs, which are retained for 24 months). To request deletion, email admin@duckandkey.com.

We may update this Privacy Policy from time to time. If we make material changes, we'll update the “Last updated” date above.

Questions about this policy or your data?
admin@duckandkey.com