PirtDuck has no accounts and no passwords; the game only knows you by an anonymous ID issued by Unity. This page describes what we do, how you can protect yourself and how to report a vulnerability.
1. What we do
The game's connections to Unity's services are encrypted: service calls use HTTPS and game traffic through Unity Relay is encrypted with DTLS. The app does not allow unencrypted web (HTTP) connections.
There are no accounts or passwords, so there is no password to steal. Your progress stays only on your own phone and is not included in Android backups.
The game asks for no permissions and doesn't access your location, contacts, photos, camera or microphone. Only the developer reads report and support emails.
2. Protect yourself
Don't use your real name, school, phone number or social media handle in your nickname, and don't share them in chat.
PirtDuck has no passwords, so anyone asking you for a password or a code is a scammer. The same goes for sites and apps promising “free Golden Eggs” or “Feather hacks”: Feathers and Golden Eggs only come from inside the game.
Only send your player ID to pirtduckgame@gmail.com, for a deletion or privacy request. Download PirtDuck only from official sources; modified APK files shared by others may contain malware.
3. Reporting a vulnerability
If you find a security vulnerability in the game or the website, email pirtduckgame@gmail.com with the subject “Security”: describe what you found, how to reproduce it and the game version.
Please give us reasonable time to fix it and don't disclose it publicly until then.
4. Scope and rules
The scope is the PirtDuck app and www.pirtduckgame.com only. Don't test Unity's, Google's or Cloudflare's systems; report issues there through their own disclosure channels.
Don't try to access other players' devices or data, don't run attacks that disrupt rooms, and don't download or share any data you come across.
We won't take legal action over good-faith reports that follow these rules.