Privacy
Last updated: 2026-05-07
What we collect
Account data (name, email, password hash via Supabase). Workspace data (lists, leads, generated emails, credit ledger). Integration credentials you choose to store (Instantly API key, Stripe customer id). Server logs for the standard 14 days.
What we don't do
We don't sell your data. We don't share your prospect lists with anyone outside Rubber Ducky. We don't train any model on your generated emails. We don't email your prospects on your behalf except when you explicitly push to Instantly.
Where it lives
Supabase (Postgres, encrypted at rest, region us-east-2) for application data. A Contabo VPS in Germany for the application server. Stripe for payments. Google Gemini and Serper for the generation pipeline (per-row content sent at generation time, not retained by them per their respective contracts).
Removing your data
Email support@rbrducky.com from the address on your account and we'll delete everything within 7 days. Stale lead research data is automatically purged after 90 days regardless.