Privacy Policy
Witness Panda asks you to photograph your desk during a work block, once at a random moment and once near the end, and checks each photo against a reference photo of the same desk. That is an unusual thing to ask of someone, so this policy is specific about what happens to those photos rather than hiding behind generalities.
Who is responsible
Witness Panda is operated by DuckFlock LLC, a limited liability company registered in Wyoming, USA ("we", "us"). We are the data controller for the information described here.
For anything in this policy, including any request about your data, write to luis@duckflock.com.
What we collect, and why
| What | Why | Legal basis |
|---|---|---|
| Your Google account's name, email and profile picture. Signing in with Google is the only way in. | To create your account, sign you in, and identify your account | Performance of a contract |
| A reference photo of your workspace, taken once at setup | Every later check is compared against it | Performance of a contract |
| A photo of your workspace at each check | To decide whether you were at the desk you committed to | Performance of a contract |
| Your work blocks: start time, end time, status (witnessed, missed or abandoned), and which week you last used an emergency | To run the block and show your history | Performance of a contract |
| The verdict on each check, and the short written reason for it | To decide the block, and to show you why a check failed | Performance of a contract |
| Your streak and grace tokens | The core of the product | Performance of a contract |
| Only if you connect X for all-in mode: your X access and refresh tokens, your X username, the message you wrote, and the outcome of each miss with the id of any post | To publish the all-in post if you miss a block while armed | Your explicit consent, withdrawn by revoking the app in X or deleting your account |
| Your setup and paywall steps: which setup screens you finished, the kind of work you picked, your usual sitting length, what you said derails you, whether you allowed the camera, and which plan you viewed, skipped or bought | To see where setup loses people, and to improve it | Legitimate interest |
| Your subscription status: whether Pro is active, and until when | To unlock the paid features you bought | Performance of a contract |
That is the whole list. In particular, we do not collect your location, your contacts, your other apps, your device identifiers for advertising, or the content of your work. The kind of work you picked in setup is the only thing we know about it.
Like any online service, the companies that run our servers see your IP address and basic device details when the app connects, and keep them in their logs for a limited time.
Things we deliberately do not do
- No advertising, and no advertising identifiers. We do not sell or share your data with anyone for marketing.
- No third-party analytics or tracking SDKs. There is no analytics product embedded in this app. The app records its own setup and paywall steps, listed above, in our own database, and nothing else.
- No push notification service. Check reminders are scheduled on your phone, by your phone. No push token is registered. The random check's moment is picked on your phone, so no server of ours learns it in advance.
- No selling of data. Ever, to anyone.
Your photos, specifically
This is the part that matters most, so it gets its own section.
Where they go
A photo you take in Witness Panda is uploaded to our storage, which is a private bucket: it is not public, not listable, and not reachable by URL guessing. Within the app, your photos are readable only by your own account.
Who else sees them
To decide whether a check passes, we send two images, your workspace reference photo and the check photo, to Anthropic, whose model compares them and returns a structured verdict. This is automated. No employee of ours looks at your photos as part of normal operation, and we do not use your photos to train any model.
What ends up in them is up to you
The camera points at your desk, and we cannot control what is in frame. Please do not photograph other people, screens showing confidential work, documents, or anything you would not want stored. A photo of an empty desk is exactly as good for verification as a photo of a busy one. If you upload a photo containing someone else, you are responsible for having their agreement.
How long we keep them
Your workspace reference photo is kept for as long as your account exists, because every check is compared against it. You can replace it at any time from You → Workspace → Retake. The new photo is used from then on. Earlier reference photos stay stored until you delete your account, and you can ask us to delete them sooner.
Your check photos are kept while your account exists. We do not delete them automatically yet. Automatic deletion after a fixed retention window is being built. Until it ships they remain until you delete your account, and you can ask us to delete them sooner at any time.
Early test versions of the app also took a front-camera photo at each check. If you used one of those versions, those photos are kept under the same rules and deleted with your account.
Deleting your account deletes all of it. See Your rights.
Automated decisions
The verdict on a check is made automatically, without a human involved. It decides whether the check counts, and therefore whether your streak survives.
Automated judgements are wrong sometimes. A dark room, an odd angle, or a rearranged desk can all produce a wrong answer. If you believe a check was judged unfairly, write to luis@duckflock.com and a person will look at it and correct the record. You always have the right to a human review, to state your case, and to contest the outcome.
This matters more if you have armed all-in mode, because there a wrong verdict can cause a message to be published on your X account. If you are not comfortable with an automated judgement having that consequence, leave all-in mode off. It is off by default and can be disarmed at any time.
Who processes your data for us
| Who | What they do | What they receive |
|---|---|---|
| Supabase | Database, authentication, file storage | All of it. Hosted in São Paulo, Brazil. |
| Anthropic | Compares your check photo to your reference photo | The two photos, and nothing else: no name, no email, no account identifier. The image files may carry the camera's own details, such as the time taken and the phone model. The app has no location permission, so they carry no location. |
| Sign-in, the only way in | Only what is needed to authenticate you. | |
| Google Play | Takes payment for subscriptions, and runs trials, renewals and refunds | Your payment details. We never see them. |
| RevenueCat | Checks your Google Play purchase and tells us whether Pro is active | Your account ID (a random identifier) and your Google Play purchase record, plus the technical details its software sends, such as IP address, device model, system version and app version. No name, no email, no photos. |
| X (Twitter) | Grants the app access when you connect X, and publishes the all-in post only if you armed all-in mode and missed a block | The post, published as you. |
Our database and photo storage are in Brazil. If you are outside Brazil, your data is transferred there and stored under Brazilian data protection law, alongside whatever rights your own country gives you. Anthropic, RevenueCat and X are in the United States, so what each of them receives, as listed above, goes there.
Your rights
Whatever country you are in, we will honour all of these:
- See your data. Ask, and we will send you everything we hold about you.
- Correct it, if something is wrong.
- Delete your account and everything in it: photos, blocks, verdicts, streak, the lot. Ask and it is done within 30 days, usually far sooner. Deletion is permanent and cannot be undone.
- Take your data with you, in a machine-readable form.
- Withdraw consent for all-in mode at any time. Disarming stops posts. To remove our access to your X account, revoke the app in X under Connected apps, or delete your account.
- Object to how we handle your data, and complain to your local data protection authority.
To delete your account, open the app, go to the You tab and tap Delete account at the bottom. It happens immediately and takes your photos with it. If you cannot open the app, email luis@duckflock.com from the address you signed up with and we will do it by hand. We do not charge for this and we will not ask you to justify it. More detail.
Security
Data is encrypted in transit and at rest. Photo storage is private, and access is enforced per-account at the database level, so one account cannot read another's rows or files. No system is perfect; if we ever discover a breach affecting you, we will tell you.
Children
Witness Panda is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, write to us and we will delete it.
Changes
If we change what we collect or what we do with it, we will update this page and change the effective date at the top. If the change is significant, we will tell you by email or in the app before it takes effect.
Contact
Questions, requests, complaints: luis@duckflock.com.