Privacy Policy

This Privacy Policy explains how Derby Duck Races (“Derby Duck Races,” “eQuack,” “we,” “us,” or “our”) collects, uses, and protects information in connection with the eQuack platform, including the eQuack mobile application (the “App”) and our websites (collectively, the “Services”).

eQuack is used by two kinds of people. Organizers — Derby Duck Races staff, the organizations we work with, their administrators, team captains, and volunteers — use the web platform and the App to plan events, manage orders, reach supporters, and take payments in person. Supporters — donors, duck adopters, and sponsors — use the public event pages to adopt ducks, give, and buy merchandise.

By using the Services, you agree to the practices described in this policy. If you organize events on eQuack, our Terms & Conditions also apply, and they explain what your organization is responsible for.

Information We Collect

We collect the following categories of information:

• Account information. When an organizer signs in, we collect your name, email address, and authentication credentials so we can verify your identity and secure your account. Sign-in itself is handled by Clerk; we never see or store your password.
• Supporter and checkout information. When someone adopts a duck, donates, sponsors, or buys merchandise, we collect what the checkout asks for — typically name, email address, phone number, and any mailing or delivery address — along with the amount, the event, the team or referral link that sent them, any duck numbers assigned, and any message or dedication they choose to add.
• Text message information. If an event uses text-to-give, we collect the phone number that texted in and the content of those messages so we can respond and complete the donation.
• Transaction and order information. When you process a sale, we record order details such as items purchased, amounts, dates, and the event the order belongs to. Payment card data is handled directly by our payment processor (see Payments below) and is not stored on our servers.
• Device and usage information. We collect limited technical data — such as device type, operating system version, app version, and in-app activity — to operate the App, diagnose problems, and improve performance.
• Diagnostic and crash data. If the App or the website encounters an error, we collect diagnostic information to help us identify and fix the issue.

We don’t ask for information we don’t need, and we don’t collect sensitive categories of personal information such as government ID numbers, health information, or precise location.

The same list, in the categories California law uses

Some privacy laws ask us to name the statutory categories rather than the plain-English ones above. In the last twelve months we have collected:

• Identifiers — name, email address, phone number, mailing address, account identifier, IP address.
• Customer records information — the contact and order details a checkout collects.
• Commercial information — adoptions, donations, sponsorships, merchandise orders, and amounts.
• Internet or other electronic network activity — device type, app and browser version, pages and in-app activity, and diagnostic data.

We do not collect biometric information, precise geolocation, professional or education records, or sensitive personal information, and we do not use any of it to draw inferences about you.

How We Use Information

• To provide, operate, and secure the Services.
• To process in-person and online payments and fulfill orders.
• To send transactional messages — receipts, order confirmations, duck number assignments, and event updates — and, where an organization has permission to do so, its own fundraising communications.
• To give the organization running an event the records it needs to manage its supporters, thank them, and issue receipts.
• To authenticate users and protect against unauthorized access.
• To monitor, troubleshoot, and improve the reliability and performance of the App.
• To comply with legal obligations and enforce our terms.

Payments

In-person and online payments are processed by Stripe, including Stripe Terminal for card-present transactions via Tap to Pay on iPhone (the device’s built-in contactless reader) or a connected card reader. Payment card details are transmitted directly to Stripe and are handled in accordance with Stripe’s Privacy Policy. We do not collect or store full payment card numbers on our systems.

Bluetooth & Device Permissions

The App may request access to Bluetooth in order to discover and connect to a supported card reader for accepting in-person payments. Bluetooth is used solely to communicate with the payment reader; we do not use it to collect location data or to track you. You can manage these permissions at any time in your device’s settings.

Text Messages

Where an event has enabled text-to-give, messages are delivered through Twilio. Message and data rates may apply, and message frequency varies by event. You can stop messages at any time by replying STOP, or get help by replying HELP. We use phone numbers collected this way to complete and support the donation, and for the event communications you have agreed to receive — not to sell to anyone.

Cookies and Analytics

Our websites use cookies and similar technologies for things that have to work — keeping you signed in, keeping a checkout session together, and remembering which team or referral link brought you to an event so credit lands in the right place.

We also use PostHog for product analytics, to understand which pages and flows work and which ones confuse people, and Sentry for error monitoring. We use these to improve the Services — not to build advertising profiles. We do not sell personal information and we do not share it with advertising networks for cross-context behavioral advertising.

Most browsers let you block or delete cookies. Blocking essential cookies will break sign-in and checkout.

Third-Party Service Providers

We rely on a small number of trusted service providers to operate the Services. These providers process information only as needed to perform their functions:

• Stripe — payment processing and card readers.
• Clerk — user authentication and account management.
• Twilio — text messaging, including text-to-give.
• Resend — delivery of transactional and fundraising email.
• Vercel — application hosting and infrastructure.
• Neon — managed database and data storage.
• PostHog — product analytics to understand and improve how the Services are used.
• Sentry — error monitoring and crash diagnostics.

How We Share Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share it only in these situations:

• With the organization running the event. This is the important one for supporters: when you adopt a duck, donate, or sponsor, the nonprofit, school, or club hosting that event receives your information — name, contact details, amount, and order details — so it can fulfill your order, assign your duck numbers, thank you, and meet its own receipting and reporting obligations. That organization uses your information under its own privacy practices. Your public-facing display on team pages and leaderboards follows the choices offered at checkout.
• With the service providers listed above, only as needed to perform their functions for us.
• When the law requires it, or to enforce our agreements and protect the rights, safety, and security of our users and the public.
• In a business transfer, such as a merger or sale of assets — in which case this policy continues to apply to the information transferred.

Categories disclosed for a business purpose

In the last twelve months we disclosed identifiers, customer records, and commercial information to the organization running the event you supported and to the service providers listed above, and internet or other electronic network activity to our hosting, analytics, and error-monitoring providers. Each disclosure was for the business purposes described in this policy — none of it was a sale, and none of it was a share for cross-context behavioral advertising.

Data Retention

We retain information for as long as needed to provide the Services, comply with our legal and financial obligations (including tax and accounting requirements for transactions), resolve disputes, and enforce our agreements. When information is no longer needed, we take steps to delete or anonymize it.

Where Your Information Is Processed

eQuack is operated from the United States, and information collected through the Services is processed and stored on servers located in the United States by us and by the service providers listed above. If you use the Services from outside the United States, you understand that your information will be transferred to, processed in, and stored in the United States, where privacy laws may differ from those in your country. We protect that information as described in this policy regardless of where you are.

Security

We use industry-standard technical and organizational safeguards — including encryption in transit and access controls — to protect information against unauthorized access, loss, or misuse. No method of transmission or storage is completely secure, but we work continuously to protect your data.

Your Rights

Depending on where you live, you may have the right to access, correct, or delete your personal information, to receive a copy of it, or to object to or restrict certain processing. To make a request, contact us using the details below and we will respond in accordance with applicable law. We will not discriminate against you for exercising these rights.

One of those rights is the right to opt out of the sale or sharing of your personal information. We do not sell your personal information, and we do not share it for cross-context behavioral advertising — “sell” and “share” as those terms are defined by California law — so there is no Do Not Sell or Share My Personal Information opt-out for us to offer. The analytics and error-monitoring providers named above (PostHog and Sentry) process information only as service providers, on our instructions and to improve the Services; we do not disclose your information to advertising networks or ad-tech platforms, and we run no advertising on the Services.

You can also, at any time:

• Unsubscribe from an organization’s fundraising emails using the link at the bottom of any of them. Transactional messages — receipts and order confirmations — will still be sent.
• Stop text messages by replying STOP.
• Manage cookies through your browser settings.

Because much of the information we hold is held on behalf of the organization that ran your event, some requests are best directed to that organization. If you send them to us, we will pass them along and help.

How to make a request

Email info@duckrace.com with the subject line “Privacy request” and tell us what you want — a copy of your information, a correction, deletion, or to opt out of a particular use. Include the email address or phone number you used with us and, if you know it, the event or organization involved, so we can find your records. We may need to ask a question or two to confirm you are who you say you are; we use that information only to verify the request. An authorized agent may submit a request on your behalf with written permission we can verify.

We acknowledge requests within 10 business days and respond substantively within 45 days, extending once by a further 45 days if a request is complex — we will tell you if that happens. There is no charge for a reasonable request. If we cannot honor a request in full — for example, because we must keep transaction records for tax and accounting purposes, or because the information belongs to the organization that ran your event — we will explain why and tell you who to contact. Requests are free of retaliation: we will not deny you service, charge you a different price, or give you a lesser experience for making one. If you are unhappy with our response, you may appeal by replying to us, and you may contact your local data-protection or consumer-protection authority.

Children's Privacy

The Services are intended for adults and are not directed to children. eQuack accounts require you to be 18 or older, and checkout flows that involve gifting a duck to someone else require the purchaser to confirm they are 18 or older. We do not knowingly collect personal information from children under 13.

Events themselves are family-friendly, and children often attend — but any purchase or account is made by an adult. If you believe a child has provided us with personal information, contact us and we will remove it.

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above. For material changes, organizers will be asked to review and accept the updated documents the next time they sign in.

Contact Us

If you have questions about this Privacy Policy or how we handle your information, contact us at info@duckrace.com.