HammerDuck logo

Privacy Policy

All governing documents: Terms of Service · Privacy Policy · Homeowner/Customer Terms · Contractor Agreement · Billing/Refund Terms · Founding Contractor Agreement · Non-Discrimination Policy

Effective Date: October 14, 2026  |  Version 1.0  |  Updated: October 22, 2026 (reports and blocks, and app push notifications). Earlier update: October 18, 2026 (homeowners now choose what each Pro sees)

This Privacy Policy explains what personal information HammerDuck LLC ("HammerDuck," "we," "us") collects through the HammerDuck website and iOS and Android apps (together, the "Platform"), why we collect it, where it is stored, who can see it, and the choices and rights available to you. This Privacy Policy is incorporated into, and should be read together with, the HammerDuck Terms of Service.

1. Information We Collect

1.1 Everyone with an account

Full name, e-mail address, a password (stored as a hash, never in plain text), and your account role (Customer or Contractor).

1.2 Contractors

A required mobile phone number, business profile information (business name, trades, counties served, years in business, website, bio, tagline, self-reported license status and, if you choose to provide it, license number, self-reported insurance status, and two self-certifications), optional portfolio photos and references (a third party’s name, project description, phone, and e-mail), an optional Google Business Profile link, and weekly availability and a "taking new work from" date.

1.3 Customers

Project information (title, category, job type, city/area, county, budget range, description, dimensions, timeline), project photos, and a private block containing your street address, contact name, phone number, and e-mail, which is stored separately from public project fields and is disclosed to a Contractor only as described in Section 3.

1.4 Everyone — activity data

Bids, messages, visit proposals, the contact details you choose to share with each Contractor (and when that choice last changed), reviews and replies, and notifications, including your e-mail notification settings and, for each notification, whether and when it was read in the app and whether it was e-mailed to you; your mobile push token and language preference if you enable notifications; reports you file and the people you block (and reports and blocks about you, without the reporter’s identity being shown to you), together with a copy of what was reported, which HammerDuck uses only to review the report, enforce the community standards in the Terms of Service, and keep the Platform safe; and, if you contact us, the name, e-mail, and message you submit through our contact form.

1.5 Billing information

Contractor billing is handled by Stripe, our payment processor. HammerDuck never sees or stores your card number. HammerDuck’s systems store your Stripe customer and subscription identifiers, status, and trial and period dates; a hashed ("fingerprinted") version of your card, e-mail, phone number, business name, and Google Place ID, used solely to detect and prevent repeated free-trial abuse across accounts; and your IP address at signup, used as a soft signal in that same trial-abuse check. Stripe Checkout also collects the billing address you enter there in order to determine the state to which your payment should be attributed for sales-tax purposes; HammerDuck does not receive or store that address.

1.6 Information we do not collect

HammerDuck does not collect card numbers, Social Security numbers, dates of birth, government-issued identification, or precise geolocation, and does not use advertising trackers. The website uses Google Analytics only to count visits and a few actions, without your name or contact details, as described in Section 11; the iOS and Android apps use no analytics. HammerDuck does not knowingly collect personal information from anyone under 18; the Platform is for adults and is not directed to children.

2. How We Use Information

We use the information described above to: operate the marketplace (create and display profiles and project listings, process bids, enable messaging and scheduling, and display reviews); match a newly posted project to the Contractors whose trades and counties on their profile cover it, so we can notify them, as described in Section 6; apply the contact-release rule described in Section 3; process membership payments through Stripe and prevent trial and payment abuse; provide the optional AI assistant described in Section 9; send the transactional communications described in Section 6; generate an internal e-mail to HammerDuck’s owner when a billing event occurs — a failed payment, a recovered payment, a membership ending, or a grace period ending unpaid — or when an e-mail to a user fails to deliver, naming the Contractor, the amount, and any deadline, as an internal operating record rather than a message to you; respond to inquiries sent to customerservice@hammerduck.com; and maintain the security of the Platform, including the row-level access controls, encryption, and abuse-detection measures described in Section 7.

3. Who Sees Your Information — the Contact-Release Rule

Every signed-in user can see an open project’s public fields; Contractors additionally see project photos. A Contractor’s business profile, self-reported license and insurance status, and, if linked, public Google rating, are visible to any signed-in user; a Contractor’s phone number is never made public. A Customer’s street address, phone, and e-mail are disclosed to a specific Contractor only when the Customer chooses to share them with that Contractor, one item at a time, and the Customer can stop sharing any of them at any time (stopping does not withdraw what the Contractor already saw). A Contractor the Customer has messaged, hired, or confirmed a visit with sees the Customer’s first name. Nothing is disclosed merely because the Contractor viewed or bid on the project. Bids, messages, visit proposals, and reviews are visible, in real time, to the two parties to that exchange (reviews are visible to any signed-in user, as described in the Terms of Service). A notification or e-mail about a project carries only its public fields; the private block described above never appears in any notification or e-mail.

Sharing a finished job. When a project is marked completed, the Customer, and separately the Contractor who did the work, may choose to share it. Sharing creates a public page at an unlisted hammerduck.com/done/ address that anyone with the link can open, and that Facebook and other services may read to build a link preview. A page shared by the Customer shows the job type, the town (only when it matches a known CSRA town name) or the county, the Contractor’s business name and Founding Contractor badge, and the month the job was finished, and, only if the Customer ticks “Include my star rating and review,” that Customer’s own rating and review. A page shared by the Contractor shows the same job details and the Contractor’s business name, and never shows the Customer’s rating, review, or any other information about the Customer. A shared page never shows a name, street address, phone number, e-mail address, photo, or the project’s own description. HammerDuck never posts to Facebook or any other service for you: you make the post yourself, through that service, under its terms. Either party may stop sharing at any time from the same screen, and the page then stops loading; a copy or preview that another service has already saved is outside HammerDuck’s control. Shared pages ask search engines not to index them and load no analytics.

4. Service Providers

HammerDuck shares information with the following service providers, each acting on HammerDuck’s behalf and solely to provide the Platform:

We do not sell your personal information, and we do not share it with advertisers or data brokers.

5. Data Location and Retention

Platform data is hosted with Supabase in its Canada (ca-central-1) region. We retain your account and profile information for as long as your account is active. If you request deletion under Section 8, we will delete your personal information within 30 days, except that we retain: billing records through Stripe for as long as required by Stripe’s own retention practices and applicable tax and accounting law (typically several years); the trial-abuse hashes described in Section 1.5, to prevent renewed free-trial abuse, even after account deletion; messages and reviews that remain part of the other party’s own record of a project (deleting your account does not delete a message or review from the other party’s view); and any information we must keep to comply with a legal obligation, resolve a dispute, or enforce our agreements. Notifications are deleted when your account is deleted. The trades-and-counties matching described in Section 2 runs at the moment a project is posted and stores nothing beyond the notification itself.

6. Communications

HammerDuck communicates with you through in-app notifications, which are always on, and through e-mail. In the iPhone and Android apps, if you allow notifications on your device, HammerDuck also sends a push notification for each in-app notification; it carries the notification’s title and short text, and you can turn push notifications off in your device settings at any time. Signing out of the app stops push notifications to that device. In-app notifications cover the events listed in the Terms of Service: new jobs matching a Contractor’s trades and counties, bids, messages, visit proposals and changes, bid outcomes, project cancellations and closings, and billing events.

If a notification is still unread in the app three minutes after it was created, HammerDuck e-mails you a copy of it; several notifications may be combined into one e-mail, no more than one such e-mail is sent to you every five minutes, and a new-job alert is never e-mailed once the project has stopped accepting bids or is more than a day old. These notification e-mails are service messages about your own account activity, not marketing e-mail, and each one carries a one-click unsubscribe link, the List-Unsubscribe headers used by major e-mail providers, and HammerDuck’s postal address.

Your Account card has two notification e-mail switches, both on by default: one for a new job posted in a Contractor’s trades and counties, and one for bids, messages, visits, and other job updates. Turning either off stops only the e-mail copy, not the in-app notification, and you can turn it back on at any time from the Account card.

Separately, HammerDuck always sends certain account and billing e-mail that cannot be turned off, because it is necessary to operate your account: account confirmation, password reset, e-mail-change confirmation, the Founding Contractor welcome e-mail, the renewal notice required by Georgia law, the failed-payment and grace-period notices, account-deletion confirmation, and Stripe’s own billing e-mail. These, and the notification e-mails above, are sent as part of operating your account and are not marketing e-mail; HammerDuck does not send marketing e-mail or SMS today, and if it does in the future, it will ask for your separate, affirmative consent before sending marketing e-mail or SMS and will honor an opt-out.

7. Security

HammerDuck uses row-level access rules on every database table, so that, for example, an anonymous visitor can read only the trade and county lists and nothing else. Photos are stored in private buckets and served through short-lived signed links. The Platform is served over HTTPS with HSTS and a content-security policy, and new passwords are checked against known-breach password lists at signup. Stripe webhook signatures are verified before any billing event is processed. Multi-factor authentication for user accounts is not yet available. No system is completely secure, and we cannot guarantee absolute security of your information.

8. Your Rights and Choices

Georgia and South Carolina do not currently have a comprehensive consumer data-privacy statute comparable to California’s; the rights described in this Section are offered by HammerDuck as a voluntary practice, applied to all users regardless of location, not as a claim of legal obligation under Georgia or South Carolina law. You may request access to, correction of, deletion of, or a portable copy of your personal information by e-mailing customerservice@hammerduck.com from the e-mail address on your account. We will verify your identity using the e-mail address and, where relevant, phone number on file, and will respond within 45 days. If we decline a request in whole or in part, we will explain why, and you may appeal by replying to that response within 30 days for review by HammerDuck’s founder. In-app self-service account deletion is built and available from the Account card and at hammerduck.com/delete-account. A self-service data-export tool is planned but not yet built; until it is built, use the e-mail process described in this Section for an export request. You may turn notification e-mail off at any time from the Account card or from the link in any such e-mail, and turn it back on from the Account card.

9. AI Assistant Disclosure

If you use the optional AI assistant to help describe a project, the text you type and the relevant project category are sent to a third-party AI provider as described in Section 4. The assistant is available to Customers only. The assistant’s suggestions are not reviewed by HammerDuck before you decide whether to use them, and you are responsible for what you ultimately submit.

10. Children

The Platform is intended for users who are 18 or older and is not directed to children. HammerDuck does not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact customerservice@hammerduck.com and we will delete it.

11. Cookies and Analytics

The Platform keeps a small amount of information in your browser: your sign-in session; your chosen language; a cached copy of the public trade and county lists, for faster loading; a project draft you write before signing up, until it is posted; and, in the one browser tab where it happens, the page you were headed to when you were asked to sign in (for example, a job opened from an e-mail), which is cleared once you arrive there. HammerDuck sets no advertising cookies.

The hammerduck.com website, including its public pages and the signed-in Customer and Contractor pages, uses Google Analytics 4 to count visits and a few actions: an account being created (recording only whether it is a Customer or a Contractor account), a sign-in, a project being posted (recording only its category), a bid being submitted (recording only whether it asks for a site visit), and which sign-up button was tapped. Before anything is sent, HammerDuck removes everything from the page address except the page itself and any campaign tags from an ad or promotional link (for example, a tag showing that a visit came from a Facebook or Nextdoor ad), so sign-in codes, project identifiers, and e-mail addresses in an address are never sent. Google Analytics never receives your name, e-mail, phone, street address, messages, project text, or account identifier. Like any website, it does receive your IP address and browser and device details, and it sets a first-party cookie (named _ga) that lets it recognize a returning browser. Google signals and advertising features are turned off, and HammerDuck does not share analytics data with advertisers. The password-reset, account-deletion, and administration pages load no analytics.

Your choices: analytics does not load at all if your browser sends a Global Privacy Control signal. You can also block it with Google’s Analytics opt-out browser add-on (tools.google.com/dlpage/gaoptout) or by blocking cookies in your browser; the Platform works the same either way. No analytics cookie is set for a visitor in the United Kingdom, the European Economic Area, or Switzerland. The iOS and Android apps use no analytics.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We record the version and date you accepted and will ask you to re-accept when we make a material change. Continued use of the Platform after a new version takes effect is your acceptance of it.

13. Contact Us

Questions about this Privacy Policy, or requests under Section 8, may be sent to customerservice@hammerduck.com.