Privacy Policy

This Privacy Policy explains what information Rubber Ducks Development LLC (“Rubber Duck Development”, “we”, “us”) handles when you visit rubberducksdev.com (the “Site”) or use our Discord server’s bot, why, and the choices you have. We collect as little as possible: the Site has no visitor accounts, analytics, advertising, tracking cookies or third-party scripts.

01Who we are

The Site is run by Rubber Ducks Development LLC, a software studio that publishes affordable FiveM scripts and development tools. We are the controller of the personal information described in this policy. You can contact us about privacy at any time at director@mountainvalley.pro.

02Information we handle

When you visit the Site

Like every website, our server has to receive some technical information to deliver a page to you: your IP address, the page you asked for, your browser’s user agent and the address of the page that linked you (the referrer). We use this only to send you the page.

We do not keep access logs of visits to public pages.
If something goes wrong while loading a page, our application records an error message with the time and the page address so we can fix it. These messages do not include your IP address.
Our web server may include the IP address of the request in its own error messages if a request fails, for example while the Site is restarting. We use these only to fix the problem.
Our hosting provider, OVHcloud, may process network traffic information to protect its network, for example to filter denial-of-service attacks.

When you buy something

Payments are handled by Stripe on its own secure checkout page. You give your payment details to Stripe, not to us, and we never see or store your full card number. Stripe shares some details of each payment with us in our Stripe account: your email address, name, billing country or address, the card brand and last four digits, and the amount. We use them to deliver your purchase, give support and refunds, prevent fraud, and keep the records tax and accounting laws require.

On our own server we store only a record of each purchase: Stripe’s ID for the checkout, which product was bought, the amount and currency, the date, whether it was refunded, and how many times the product was downloaded. That record is how your download page works. It doesn’t contain your name, email or payment details. If you claim your buyer role in our Discord server, the record also holds your Discord user ID.

Stripe also processes payment information for its own purposes, such as fraud prevention and meeting its legal obligations, as described in the Stripe Privacy Policy.

In our Discord server

Our community runs on Discord, which handles your account and messages under its own privacy policy. Our bot in the server also processes some of that information to run and moderate it:

Welcome and verification: when you join, the bot posts a short message mentioning you in the welcome channel, deleted after a few minutes or as soon as you verify. It checks how old your Discord account is; accounts newer than 7 days are passed to a moderator to verify.
Server log: the bot records moderation events in a private channel only our staff can see: members joining and leaving (username, user ID, profile picture, account creation date and roles), edited and deleted messages including their text and the names of attached files, joining and leaving voice channels, and entries from Discord’s audit log such as bans, kicks, timeouts, role changes and changes to channels and server settings, with who made them and the reason given.
Slur filter: Discord’s AutoMod blocks slurs and other blocked words. To give timeouts for repeated attempts, the bot keeps the user ID and time of each blocked message on our server for up to 24 hours.
Buyer roles: if you use the /claim command with the code from your download page, we link your Discord user ID to that purchase so the bot can give you the buyer role, and remove it if the purchase is refunded.

The bot’s technical log on our server also notes its moderation notices, such as blocked-message strikes and claimed purchases, by user ID or username. It never stores message text on our server.

The suggestion form

What you type into the suggestion form is saved only in your own browser (in local storage) so you don’t lose your draft. It is never sent to us. If you copy or download your brief and post it on Discord, Discord handles it under its own privacy policy. You can delete the saved draft by clearing the form or your browser’s site data.

When you email us

If you email us, we receive your email address, your message and anything you attach. We use it only to reply to you and deal with your request, and we delete it once it is no longer needed for that.

Team accounts

Only members of our team have accounts on the Site, to manage its content. For them we store a username, a password hash (never the password itself), when the account was created and who created it, and a sign-in session. To stop password guessing, the Site counts failed sign-in attempts by IP address in memory for 15 minutes; this count is never written to disk.

Information we do not collect

Apart from what Stripe shares with us when you buy something, we don’t ask for your name, contact details or location. We never receive your full card number, we don’t ask for any sensitive information, and we don’t knowingly receive information about children.

03Cookies and local storage

Visitors get no cookies from the Site. The only cookie we set is a strictly necessary session cookie (__Host-rdd_session) for team members who sign in to manage the Site. It lasts up to 7 days, is sent only over HTTPS, and cannot be read by scripts or other websites.

The suggestion form uses your browser’s local storage (key rubber-duck:script-idea:v1) to keep your draft on your device, as described above. Because nothing is used for tracking or advertising, there is no cookie banner.

When you check out, you are on Stripe’s website (checkout.stripe.com), which uses its own cookies, for example to prevent fraud. Those are covered by Stripe’s privacy and cookie policies.

04Why we use information (legal bases)

To deliver and secure the Site, including error messages and sign-in protection: our legitimate interest in running a working, secure website.
To sell you a product, deliver it and handle refunds: necessary to perform our contract with you.
To keep purchase records: to comply with tax and accounting laws.
To prevent fraud and abuse of checkout: our legitimate interest in protecting the Site, our buyers and ourselves.
To reply to your email: our legitimate interest in answering you, or taking steps you asked for.
To moderate our Discord server (welcome messages, verification, the slur filter and the server log): our legitimate interest in keeping the community safe and enforcing its rules.
To give buyer roles in Discord: necessary to provide what you asked for when you use /claim.
To run team accounts: necessary to provide the account the team member uses, and our legitimate interest in protecting it.
To comply with the law: where we must keep or disclose information to meet a legal obligation.

We do not use your information for advertising, profiling or automated decision-making.

We do not sell or rent personal information and we do not share it for cross-context behavioral advertising. We only use these service providers, each for the purpose stated:

OVHcloud hosts our server in Beauharnois, Quebec, Canada.
Stripe processes payments for purchases.
Cloudflare runs our domain name system (DNS). It answers lookups for our domain name but does not carry or see the pages you load.
Cloudflare (Email Routing) forwards email sent to director@mountainvalley.pro, and Google (Gmail) receives and stores it.

We may also disclose information if the law requires it, to protect the Site or other people from harm, or as part of a transfer of the project to a new maintainer (who would have to honor this policy).

06Links to GitHub, Discord and other sites

Downloads, source code and release notes are hosted on GitHub, and our community is on Discord. When you follow a link to them, they receive your information under their own policies, not this one: see the GitHub Privacy Statement and the Discord Privacy Policy.

This policy covers the Site and our Discord bot. Our software has its own documentation; for example, Duck Studio checks GitHub for updates (you can turn this off in Help > Update settings) and does not send your projects or personal information to us.

07How long we keep information

Request information used to deliver a page: not stored.
Failed sign-in counts, and counts of checkout attempts and purchase lookups used to stop abuse: 15 minutes or less, in memory only.
Purchase records: as long as tax and accounting laws require, which is generally up to 7 years after the purchase. Stripe keeps its own records under its privacy policy.
Discord server log entries: deleted automatically after 90 days. Welcome messages: a few minutes. Slur-filter strike records: up to 24 hours.
Discord user IDs on purchase records: as long as the purchase record.
Team sign-in sessions: until sign-out, a password change, or 7 days, whichever comes first.
Emails: until your request is dealt with and we no longer need them.
Team account details: until the account is removed.

08International transfers

Our server is in Canada. Email is handled by Google, and payments by Stripe, both of which may process information in the United States and other countries. Canada is recognized by the European Commission and the UK as providing adequate protection for personal data. Google LLC and Stripe, Inc. participate in the EU-U.S. Data Privacy Framework and its UK and Swiss extensions. Where needed, transfers also rely on the providers’ standard contractual clauses.

09Security

The Site is served only over HTTPS. Payments are handled by Stripe, which is certified to PCI DSS Level 1, the highest standard for payment card security. Product downloads are only given out after Stripe confirms the payment. Passwords are stored as salted scrypt hashes, team sessions use secure, HTTP-only cookies, and the Site’s content security policy blocks third-party scripts. No system is perfectly secure, but we keep the information we hold to a minimum so there is very little to protect.

10Your rights

Depending on where you live (for example in the European Economic Area, the United Kingdom, Switzerland, Canada, Israel, or a U.S. state with a privacy law such as California), you may have the right to:

ask whether we hold information about you and get a copy of it;
have it corrected or deleted;
object to or restrict how we use it, and receive it in a portable format;
withdraw consent where we rely on consent; and
not be discriminated against for using these rights.

To make a request, email director@mountainvalley.pro. We will reply within 30 days (or sooner if your local law requires it), and we may need to ask you for information to confirm the request is yours. You can use an authorized agent where your law allows it. Because we hold so little, we often will have nothing about you at all, and we will tell you so.

If you are unhappy with how we handled your request, you can complain to your local data protection authority. We would appreciate the chance to fix it first.

11Children

The Site is not directed at children under 13 (or the minimum age in your country) and we do not knowingly collect their personal information. Purchases must be made by an adult, or with a parent’s or guardian’s permission. If you believe a child has sent us personal information, email us and we will delete it.

12Changes to this policy

If we change how we handle information, we will update this page and the “Last updated” date. Significant changes will also be announced on our News page before they take effect.

13Contact

Rubber Ducks Development LLC
Email: director@mountainvalley.pro
Discord: discord.gg/uYevy4FPAt