Privacy notice

The data controller for duckui.davideghiotto.it is Davide Ghiotto, acting as a private individual, reachable at [email protected]. This is a personal open-source project, not a company, so there is no VAT number or registered office to publish.

• Server access logs. Like any web server, the host records the IP address, timestamp, requested path, HTTP status, user agent and referrer for each request. An IP address is personal data under the GDPR, which is why it is disclosed here. These logs exist to keep the site up, diagnose errors and absorb abuse or denial-of-service traffic. They are not joined to anything, not used to build profiles and not used to measure you as an audience.
• Registry requests from tooling. When you run npx shadcn add @duck/…, or when an AI assistant reads llms.txt, that is an ordinary HTTP request to this domain and it lands in the same access logs. The registry is static JSON — the request carries no information about your project, your code or your machine beyond the standard headers your client sends.

• No analytics. No Google Analytics, Plausible, Umami, Vercel Analytics or equivalent. No page-view counting of any kind.
• No cookies — see the cookie notice for the two functional storage keys that exist instead.
• No accounts, sign-up, login, or password. Nothing on this site asks who you are.
• No contact form, newsletter, mailing list or email capture.
• No advertising, no remarketing pixels, no fingerprinting, no session recording, no heatmaps.
• No third-party scripts or embeds at all, and no external font CDN — typefaces are self-hosted on this domain.
• No special-category data, and nothing is knowingly collected from children. The site is documentation for a developer tool.
• No automated decision-making or profiling in the sense of Article 22 GDPR.

Anything you type into the theme editor stays in your browser. The preset is encoded into the page URL so you can share it; it is never submitted to a server.

Access logs are processed under legitimate interest (Article 6(1)(f) GDPR): keeping a public website available, secure and debuggable. Since no consent-requiring technology is used, no consent is collected — asking for it would be theatre.

The site is self-hosted on infrastructure operated by the controller. The hosting provider processes access logs as a technical necessity of routing traffic. No data is sold, rented, shared with advertisers or handed to any analytics processor, because none is engaged.

Source code and the issue tracker live on GitHub. If you choose to open an issue or pull request, that interaction happens on GitHub under GitHub’s own privacy statement, not this one.

Access logs are kept only as long as they are useful for troubleshooting and abuse handling, and are rotated on a short cycle — on the order of weeks, not years. Nothing is archived for analytical purposes because there is no analysis.

Under the GDPR you may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest. Write to [email protected] and you will get a reply within one month.

An honest caveat on what that can achieve here: the only record tied to you is a raw log line containing an IP address, with no key that links it to your identity. To act on an access or erasure request the controller would need enough detail to locate those lines, and in most cases identifying them is not possible — which is itself a consequence of collecting nothing that identifies you.

You also have the right to lodge a complaint with a supervisory authority. In Italy that is the Garante per la protezione dei dati personali.

If analytics or any third-party service is ever introduced, this notice is updated before that change ships, and the date at the top of the page moves. Material changes will also be noted in the project changelog.