Privacy Policy

Duggie CMS is operated by Duggie Labs, LLC ("Duggie", "we", "us"). This policy explains what personal information the service handles and why. It covers duggiecms.com and the Duggie CMS application and API.

Two different roles

Duggie handles two kinds of information, and the difference matters because your rights differ between them.

• Your account information. We decide what to collect and why, so for this information we are the controller. This policy governs it.
• The content you store in Duggie. You decide what goes into your projects and why. If that content contains personal information about other people, such as your own clients or their customers, you are the controller and we are acting as a processor on your instructions. We do not decide what you store, we do not use it for our own purposes, and we do not share it with anyone except the providers listed below who are needed to run the service.

If you are subject to the UK or EU GDPR and you store personal information in Duggie, that second relationship normally requires a data processing agreement between us. Contact us and we will put one in place.

What we collect

Account information

• Username and email address.
• First and last name, if you provide them.
• A password, stored only as a salted hash. We never store your password in a readable form.
• A Google account identifier, if you sign in with Google. We do not receive your Google password.
• Your role, account status, display preferences, and the dates your account was created and last changed.

Content you store

The text, HTML, JSON, images and documents you upload to your projects, along with their version history, publication state, and the record of which account made each change.

Billing information

If you subscribe to a paid plan, payment is handled by Stripe. Card numbers go directly to Stripe and never reach our servers. We keep your subscription status, plan, and the customer and subscription identifiers Stripe gives us.

Technical information

Server logs and audit records, which include IP address, timestamps, the actions taken in your projects, and API usage counts used to enforce plan limits. If an error occurs, a diagnostic report is sent to Sentry, which may include the URL and the account identifier involved.

What we do not do

• We do not sell or rent your personal information, and we never have.
• We do not use your content to train machine learning models.
• We do not serve advertising and we do not share information with ad networks.
• We do not use advertising analytics, and there is no Google Analytics or tracking pixel on this site.
• We do not track you across other websites.

Scripts this site loads

Three pieces of software from other companies run in your browser on this site. None of them advertise to you or follow you elsewhere.

• Cloudflare Web Analytics counts page views so we know which pages are read. It sets no cookies, and it does not build a profile of you or track you across other sites.
• Cloudflare Turnstile checks that sign-in and contact form submissions come from a person rather than a bot.
• Google Identity Services powers the Sign in with Google button. It loads on pages where signing in is possible, whether or not you use it.

Cookies and browser storage

We use no advertising or analytics cookies. What we do use is limited to running the service:

• A refresh token, stored in a secure cookie that expires after 7 days. It keeps you signed in without asking for your password on every visit.
• A short lived access token and your interface preferences, such as light or dark theme, stored in your browser's local storage. Signing out clears them.

Service providers

We use a small number of providers to run Duggie. Each receives only what it needs.

Uploaded files are scanned for malware by software we run ourselves. Your files are not sent to a third party scanning service.

We may also disclose information if the law requires it, or to protect the rights and safety of our users. If Duggie is ever acquired, account information would transfer with the business, and we would tell you before that happened.

Where your information is held

Duggie is operated from the United States, and the providers above process information in the United States and other countries. If you are located elsewhere, using Duggie means your information is transferred to the United States.

How long we keep it

• Account information is kept while your account is open. When you ask us to delete your account we schedule it and give you 30 days to change your mind, after which the account and its content are permanently removed.
• Content is kept until you delete it. Older versions of an asset are kept up to the version limit for your plan and are then removed automatically. A file deleted from Duggie may stay in a content delivery network cache at the edge for a period afterwards.
• Audit and billing records are kept longer where we need them for security or to meet tax and accounting obligations.

Your rights

Whatever your location, you can ask us to give you a copy of your information, correct it, or delete it. You can change most of it yourself in your account settings, and you can delete your account from there at any time.

If you are in the UK, the EU, or a US state with its own privacy law, you may also have the right to object to or restrict certain processing, to receive your information in a portable format, and to complain to your local data protection authority. We do not charge for these requests and we will not treat you differently for making one.

Security

Traffic is encrypted in transit. Passwords are stored as salted hashes and are never recoverable in readable form. Project API keys are stored so that you can view them again in your project settings, and you can revoke or rotate any key at any time. Access to production systems is limited to people who need it. No service can promise perfect security, but if a breach affects your information we will tell you.

Children

Duggie is a tool for professional developers and is not directed at children. We do not knowingly collect information from anyone under 16. If you believe a child has given us information, contact us and we will remove it.

Changes to this policy

If we make a material change we will update the effective date above and tell account holders by email before it takes effect.

Contact

For any privacy question or request, including a data processing agreement, reach us through the contact page.