YMFGS Privacy Policy

Policy version: October 4, 2026 (2026-10-04).

Darkspring Labs LLC operates this service. Your Mom's Favorite Game Studio (YMFGS) is a brand and studio operated by Darkspring Labs LLC, not a separate legal entity. DUCK YOU is published under the YMFGS brand.

For privacy, child-privacy, account-data, access, export, correction or deletion requests, contact hello@darkspringlabs.com.

Age eligibility and accounts

DUCK YOU is a general-audience service. Public browsing and guest gameplay do not require an age check. Creating a persistent YMFGS account requires a neutral age check; people under 13 may not create an account. We do not offer parental consent or an under-13 account type. Chat and social features require an account.

During signup, our server uses your birth month and year to determine eligibility, then discards those inputs. We retain the eligibility result, time and policy versions, including separate evidence of Terms agreement and Privacy acknowledgment. A small set of accounts that existed before enforcement has an explicit legacy exception; this does not represent an age determination or policy acceptance.

A random signup cookie, stored as a hash on our server, supports signup security and prevents immediately changing an ineligible answer for up to 24 hours. It does not gate guest play or use a device fingerprint. Existing accounts found ineligible may be restricted and reviewed; that does not automatically erase their records.

Supabase handles email/password and optional Google sign-in. Public profiles contain a username and optional display name. Email signup uses a short-lived hash of the email to connect the submitted eligibility result to the account. Google signup instead uses a short-lived, single-use transaction created before the Google redirect; you do not enter your Google email in our signup form.

Google and Supabase process provider identity data during OAuth, which can include your email, provider identifier, name, profile image and verification information. Supabase may temporarily create an Auth identity before our server attaches the valid signup transaction. That identity cannot access protected application features or create a public profile or game progress until signup succeeds. Rejected unfinished identities are scheduled for immediate deletion; abandoned unfinished identities are scheduled for deletion after 15 minutes. Failed deletions are retried, so removal may take longer during an outage. Providers may retain operational logs or backups according to their practices. DUCK YOU discards unused Google API tokens.

Gameplay, chat and social information

DUCK YOU processes game inputs and room connections. Completed matches between account holders retain match and round history, results, statistics, competitive records, achievements, badges, inventory and Feather transactions. Public profiles show public game records and showcased badges. Guest and mixed guest/account matches do not create persistent account progression.

Chat is available only to signed-in account holders; guests cannot read or send Global or Room Chat. We store account-holder chat text for delivery and moderation. Reports preserve message evidence and private moderation records. Blocking hides the blocked player's chat from the blocker and prevents social invitations between them; it does not exclude them from Ranked matchmaking.

Social features store friendship requests, relationships and short-lived game challenges. Friends can see limited online or in-match presence. Recent Players uses completed match history to show recent opponents. DUCK YOU does not offer direct messages.

Browser storage and service providers

Your browser stores account login sessions and control/audio preferences. Guest names, room reconnect information and spectator access tokens use session storage. The game server keeps temporary room, connection and anti-abuse state needed to operate the game. Guest play does not create a persistent public profile, chat identity or progression record. Control/audio preferences can remain until browser storage is cleared.

We use Supabase for authentication and the database, Google for optional sign-in, Resend for account email, Vercel for the website, Railway for the game server, and Cloudflare for domain and DNS services. These providers process network requests and may retain operational logs and backups according to their own practices and policies. DUCK YOU does not use a third-party analytics SDK; hosting providers may still collect operational information.

How long information is kept

Our configured retention periods are seven days for global chat, one day for room chat, 90 days for reports and message evidence, and 365 days for moderation audit records. Rejected-text filter events keep rule information, not message bodies, for 30 days. Cleanup runs periodically, so removal is not instantaneous. Separate retention applies to reported-message evidence even after a chat message leaves normal history.

Expired signup security markers and temporary signup transactions are cleaned regularly. Finished or expired game invitations and social rate-limit records are cleaned after one day. Account eligibility and policy acknowledgment records remain with the account. Match history, progression and transaction records are retained to support game records and their integrity.

Some information may be retained where reasonably necessary for security, fraud or abuse prevention, moderation, transaction or game-record integrity, dispute handling, or legal obligations. Providers may also retain temporary backups and operational logs under their own practices and policies. These provider periods are separate from the application retention periods above.

Access, export, correction and deletion requests

We currently handle these requests manually. Email hello@darkspringlabs.com with your request. Where identity verification is necessary, we prefer to verify control of the relevant account or its associated email. We do not request government identification by default. Do not send passwords or identity documents through game chat.

Self-service account deletion and data export are not currently available. Signing out does not delete your account or records. We review requests individually and do not promise absolute or instantaneous erasure. The retention reasons described above may apply after deletion. When handling account deletion, where practical we remove the association between retained records and an active public profile.

Use the same contact for child-privacy concerns, including concerns about an account belonging to someone under 13.

Policy changes

We record which policy version you acknowledge. Updates may require renewed acknowledgment or eligibility screening.