Get the app

Your data

Privacy Policy

Last updated: October 11, 2026 · Effective date: September 27, 2026 · Duck or Beef™ ("the Service") is operated by Cultural Intelligence Agency LLC.

The short version. We collect the minimum needed to run a rivalry: your email to sign you in, a display name and handle so your opps know who you are, your date of birth once to check you're old enough, and — if you link one — the public achievement data from your gaming profile. We never see your Xbox or PlayStation password, your Google password, or your card number. Messages you send inside a beef are screened by an automated safety check, and reported messages are reviewed. We don't sell your data, and we don't run ads or ad tracking. You can delete everything from your Profile in the app, or ask us by email.

What we collect

Account. Your email address (used to send one-time sign-in codes and important account email), your display name and handle, and your date of birth. We use your date of birth only to enforce our minimum age; we don't display it and we don't use it for anything else.

Sign in with Google. If you sign in with Google instead of an emailed code, Google tells us your email address, your name as it appears on your Google account, and an account identifier for you at Google. We use them to sign you in and to suggest your handle. We never receive your Google password.

Linked gaming profiles. If you link an Xbox gamertag or PlayStation online ID, we store the gamertag or online ID, the platform's public account identifier, whether you've verified it (and, if you verify, the code we asked you to put in your Xbox Bio or PlayStation About), and the time of your last sync. Before you link, we show you the account's public profile picture, achievement or trophy count, Gamerscore and the game it last played, so you can check it's you; on Xbox we keep that with the account identifier for up to 30 days. For Xbox, we read only information the platform makes publicly available — profile name, profile picture, Gamerscore and achievement lists with unlock times — through a third-party data service. For PlayStation, we read directly from PlayStation's own services, and only what your privacy settings let anyone see: we look up your account ID and profile picture from your online ID, read your About when you tap Verify to check for the code, and read the list of your games that have trophies and the trophy list for the game we track, with unlock times. Nothing else from PlayStation is kept. We never ask for, receive, or store your platform password or session tokens.

Activity in the app. Your manual check-offs (which are marked as self-reported), your rivalries and call-outs, the preset taunts you send, opps and feed events, receipts you generate, crews you join, players you keep eyes on, users you block, and your Hustler status. Most of this is the product: it is visible to your opps and, when you share a receipt, to whoever you share it with. Eyes on works like a follow: the player you put eyes on is told your handle, and sees you in their Watchers. Crews you put eyes on see your crew's name.

Messages. Typed messages and taunts are stored so the other player or crew can read them and so they can be reviewed if reported. Typed messages are sent to OpenAI's moderation service to check for harmful content before delivery; OpenAI does not receive your account details. When a message is reported we keep a copy of its text with the report for our review; report emails to our team do not contain the message text. You can unsend a message within 60 seconds of sending it.

Profile pictures. You choose a ready-made character as your profile picture. We don't ask for, upload, or store photos of you.

Payments. If you buy Hustler on the web, Stripe processes the payment. We receive a confirmation that you paid, the amount, and a Stripe customer reference — never your card number. Purchases inside the iPhone and Android apps are processed by Apple or Google under their own privacy terms; RevenueCat receives the purchase record from them so we can unlock what you bought. We never see your Apple or Google payment details.

Notifications. If you turn on notifications in the app, we store your device's push token and use it only to send the alerts you turned on. You can switch notifications off in the app or in your phone's settings at any time.

Waitlist. If you join the waitlist on duckorbeef.com, we store the email you gave us so we can tell you when the app launches. Unsubscribe from any email we send, or write to us, and we'll remove it.

Diagnostics. Standard server logs (IP address, browser type, timestamps, the request that was made) kept briefly to keep the Service running and secure, and error reports when something breaks, which we collect with Sentry. On duckorbeef.com we may use Cloudflare Web Analytics, which is cookie-less and doesn't build profiles of individuals.

Cookies. The app uses cookies only to keep you signed in and to protect against forgery. There are no advertising or cross-site tracking cookies, and there are no advertising or analytics SDKs in the app.

What we use it for

Who sees it

Other users. Your display name, handle, profile picture, linked-profile name, completion progress, rivalry results, and taunts are visible to your opps and can appear in feeds and receipts. Players you block don't see your profile picture. Your email, date of birth, and payment information are never shown to other users.

PUT ON boards. If you sign up with another player's @handle or link, you appear on that player's PUT ON board — to them and to the others on the same board — with your handle, your profile picture, your tier, whether a gaming profile is linked, your progress in the game we track, when you were last active, and your place on the board. If your gaming profile is private, your handle and profile picture are hidden and you appear as 'A PLAYER'. Your payments and earnings are never shown.

Service providers who process data on our behalf, under contracts that limit them to that purpose: Supabase (database and authentication), Vercel (application hosting), Cloudflare (website hosting, DNS, and security), Stripe (web payments), Apple and Google (in-app purchases, and Sign in with Google), RevenueCat (in-app purchase records), Resend (transactional email), Sentry (error reports), OpenXBL (reading public Xbox achievement data from Microsoft's services), and OpenAI (automated moderation of typed messages, and of display names, handles and crew names). These providers may store data in the United States.

Legal. We may disclose information if the law requires it, to protect the rights and safety of users or the public, or as part of a merger or acquisition (in which case this policy continues to apply to your data).

We do not sell your personal information, and we do not share it with advertisers or data brokers.

Keeping and deleting it

We keep your data while your account is active. We keep payment records for as long as tax and accounting law requires, and short-lived server logs are deleted on a rolling basis. Unlinking a gaming profile deletes the stored account identifier and synced achievement data for that profile. A short-lived lookup record that maps a typed gamertag to its public account identifier can remain for up to 30 days, and numbers already printed on receipts stay on those receipts.

Delete your account

In the app: go to Profile → Delete account and confirm. Your account is deleted straight away.

By email: write to [email protected] from the email address on your account and ask us to delete it. We'll delete it within 30 days.

What is deleted: your account and sign-in, your linked gaming profiles and their synced progress, your rivalries and their feed, your claims and blocks, your messages and taunts, and your profile picture, and you leave any crew you're in. Crew receipts other players hold keep their numbers, with your name replaced by 'A PLAYER'; a gamertag lookup record, if one exists, expires within 30 days. What is kept: payment records, with your account removed from them, because tax law requires it. Receipts you already shared may continue to exist wherever you posted them.

Security

Data is encrypted in transit and at rest, access is restricted to what each system needs, and sign-in uses one-time codes or Sign in with Google instead of stored passwords. No system is perfectly secure; if we learn of a breach affecting your data we will tell you as the law requires.

Age

Duck or Beef is for players 18 and older. It is not for anyone under 18, and we don't knowingly collect data from anyone under 18. If you believe someone under 18 has an account, contact us and we'll delete it.

Your rights

Wherever you live, you can ask us for a copy of your data, correct it, or delete it — from your Profile or by email. If you're in the EU, UK, California, or another place with specific privacy laws, you may have additional rights (such as objecting to certain processing or lodging a complaint with your regulator); we honor those requests and won't treat you differently for making them. We don't respond to browser "Do Not Track" signals because we don't track you across sites in the first place.

Changes

We may update this policy as the product evolves. Material changes will be announced in the app or by email before they take effect, and the dates above will change.

Contact

[email protected] · Duck or Beef · duckorbeef.com · Cultural Intelligence Agency LLC