Privacy Policy
Witness Panda asks you to photograph your desk at a random moment during a work block, and checks that photo against a reference photo of the same desk. That is an unusual thing to ask of someone, so this policy is specific about what happens to those photos rather than hiding behind generalities.
Who is responsible
Witness Panda is operated by Duckflock LLC, a limited liability company registered in Wyoming, USA ("we", "us"). We are the data controller for the information described here.
For anything in this policy, including any request about your data, write to luis@duckflock.com.
What we collect, and why
| What | Why | Legal basis |
|---|---|---|
| Your email address | To create your account and sign you in | Performance of a contract |
| Your Google account's name, email and profile picture, if you sign in with Google | To identify your account | Performance of a contract |
| A reference photo of your workspace, taken once at setup | Every later check is compared against it | Performance of a contract |
| A photo of your workspace at each check | To decide whether you were at the desk you committed to | Performance of a contract |
| Your work blocks: start time, end time, status | To run the block and show your history | Performance of a contract |
| The verdict on each check, and the short written reason for it | To show you why a check passed or failed | Performance of a contract |
| Your streak and grace tokens | The core of the product | Performance of a contract |
| Your X (Twitter) access token and the text you wrote, only if you arm all-in mode | To publish your own message if you miss a block | Your explicit consent, withdrawn by disarming |
That is the whole list. In particular, we do not collect your location, your contacts, your other apps, your device identifiers for advertising, or anything at all about what you actually work on.
Things we deliberately do not do
- No advertising, and no advertising identifiers. We do not sell or share your data with anyone for marketing.
- No third-party analytics or tracking SDKs. There is no analytics product embedded in this app.
- No push notification service. Check reminders are scheduled on your phone, by your phone. No push token is registered, and no server of ours ever learns when your check is due — which is also why the timing stays unpredictable to everyone, including us.
- No selling of data. Ever, to anyone.
Your photos, specifically
This is the part that matters most, so it gets its own section.
Where they go
A photo you take in Witness Panda is uploaded to our storage, which is a private bucket — it is not public, not listable, and not reachable by URL guessing. Within the app, your photos are readable only by your own account.
Who else sees them
To decide whether a check passes, we send two images — your workspace reference photo and the check photo — to Anthropic, whose model compares them and returns a structured verdict. This is automated. No employee of ours looks at your photos as part of normal operation, and we do not use your photos to train any model.
What ends up in them is up to you
The camera points at your desk, and we cannot control what is in frame. Please do not photograph other people, screens showing confidential work, documents, or anything you would not want stored. A photo of an empty desk is exactly as good for verification as a photo of a busy one. If you upload a photo containing someone else, you are responsible for having their agreement.
How long we keep them
Your workspace reference photo is kept for as long as your account exists, because every check is compared against it. You can replace it at any time from You → Workspace → Retake, which supersedes the previous one.
Your check photos are kept while your account exists, so that you can open a past block and see the photo behind its verdict. We do not delete them automatically yet — automatic deletion after a fixed retention window is being built. Until it ships they remain until you delete your account, and you can ask us to delete them sooner at any time.
Deleting your account deletes all of it. See Your rights.
Automated decisions
The verdict on a check is made automatically, without a human involved. It decides whether the check counts, and therefore whether your streak survives.
Automated judgements are wrong sometimes. A dark room, an odd angle, or a rearranged desk can all produce a wrong answer. If you believe a check was judged unfairly, write to luis@duckflock.com and a person will look at it and correct the record. You always have the right to a human review, to state your case, and to contest the outcome.
This matters more if you have armed all-in mode, because there a wrong verdict can cause a message to be published on your X account. If you are not comfortable with an automated judgement having that consequence, leave all-in mode off. It is off by default and can be disarmed at any time.
Who processes your data for us
| Who | What they do | What they receive |
|---|---|---|
| Supabase | Database, authentication, file storage | All of it. Hosted in São Paulo, Brazil. |
| Anthropic | Compares your check photo to your reference photo | The two photos, and nothing else — no name, no email, no account identifier. |
| Sign-in, if you choose it | Only what is needed to authenticate you. | |
| X (Twitter) | Publishes your message, only if you armed all-in mode and missed a block | The message you wrote, posted as you. |
Our servers are in Brazil. If you are outside Brazil, your data is transferred there and stored under Brazilian data protection law, alongside whatever rights your own country gives you.
Your rights
Whatever country you are in, we will honour all of these:
- See your data. Ask, and we will send you everything we hold about you.
- Correct it, if something is wrong.
- Delete your account and everything in it — photos, blocks, verdicts, streak, the lot. Ask and it is done within 30 days, usually far sooner. Deletion is permanent and cannot be undone.
- Take your data with you, in a machine-readable form.
- Withdraw consent for all-in mode at any time by disarming it, which also revokes our access to your X account.
- Object to how we handle your data, and complain to your local data protection authority.
To delete your account, open the app, go to the You tab and tap Delete account at the bottom. It happens immediately and takes your photos with it. If you cannot open the app, email luis@duckflock.com from the address you signed up with and we will do it by hand. We do not charge for this and we will not ask you to justify it. More detail.
Security
Data is encrypted in transit and at rest. Photo storage is private, and access is enforced per-account at the database level, so one account cannot read another's rows or files. No system is perfect; if we ever discover a breach affecting you, we will tell you.
Children
Witness Panda is not for anyone under 16. We do not knowingly collect data from children. If you believe a child has given us data, write to us and we will delete it.
Changes
If we change what we collect or what we do with it, we will update this page and change the effective date at the top. If the change is significant, we will tell you in the app before it takes effect.
Contact
Questions, requests, complaints: luis@duckflock.com.