Manage privacy and data handling
Quackback is self-hosted, so your feedback data stays on your infrastructure. You control storage, encryption, and what (if anything) leaves your network.
Data ownership
You own all data in your Quackback instance. Nothing is sent to external servers by default. Your database, your rules.
Self-hosting means you are both the data controller and data processor. This simplifies compliance because no third party touches your data.
The only exception is AI features. When enabled, specific data is sent to your configured AI provider for processing. See AI data handling below.
What Quackback stores
| Category | Data stored |
|---|---|
| Users | Email address, display name, avatar URL |
| Posts | Title, content, board, status, tags |
| Votes | User ID, post ID, timestamp |
| Comments | Author, content, parent post |
| Sessions | Session token, user ID, expiry |
| Integrations | OAuth tokens, webhook URLs, channel mappings |
Encryption
Tokens and secrets
Integration OAuth tokens (Slack, Discord, GitHub, Linear) are encrypted with AES-256-GCM, using a key derived from your SECRET_KEY environment variable.
Set a strong, unique SECRET_KEY (at least 32 characters) before connecting any integrations. Changing this key later invalidates all stored tokens and sessions.
Passwords
Team member passwords are hashed with bcrypt. Plain-text passwords are never stored or logged.
Sessions
Session tokens are cryptographically random. Sessions expire after 7 days of inactivity.
AI data handling
When you enable AI features, Quackback sends data to the AI provider you configure via OPENAI_BASE_URL: OpenAI, OpenRouter, a gateway, or a local server. See Use AI-powered features for configuration.
What is sent
| Feature | Data sent to your AI provider |
|---|---|
| Post summaries | Post title and content |
| Comment summaries | Comment text for the target post |
| Semantic search | Post content for embedding generation |
| Duplicate detection | Candidate post pairs, for LLM verification |
What is not sent
User emails, passwords, session data, and integration tokens are never sent to your AI provider.
Disable AI features
AI features stay off unless you configure them. Remove the OPENAI_API_KEY environment variable and restart Quackback to disable AI entirely. To disable a single feature while keeping the rest, set its model override to off:
AI_SUMMARY_MODEL="off"Disabling AI removes summary generation, semantic search, and duplicate detection. Existing embeddings remain in your database but are no longer used.
AI assistant data
Quinn, the AI assistant that answers customers and helps teammates, only sees the knowledge sources an admin explicitly enables for it: help center articles, public posts, past conversations, internal notes, tickets, and changelog entries. A source that isn't enabled for an agent doesn't exist to that agent, it's never queried, let alone sent to your AI provider.
Telemetry
Self-hosted Quackback sends one anonymous snapshot a day: a random instance ID, the version and platform, which modules and integrations are switched on, and usage counts reported only in bands (such as 11-50). It never contains names, emails, URLs, hostnames, or content, and the server's IP address is not stored. See Telemetry for the full field list.
Disable telemetry with:
DISABLE_TELEMETRY=trueVisitor analytics
Visitor analytics is always on. The tracker honors Do Not Track and Global Privacy Control browser signals and stops collecting for any visitor who has either one set. See Visitor analytics for what's tracked and how to configure it.
User data deletion
Delete a user and their associated data. Go to Admin → Settings → Users → select the user → Delete User.
| Data | Behavior |
|---|---|
| User record | Permanently deleted |
| Posts | Attributed to "Deleted User" |
| Votes | Removed and counts recalculated |
| Comments | Attributed to "Deleted User" |
| Sessions | Immediately invalidated |
Posts and comments are preserved but anonymized. This maintains thread continuity and accurate vote history for your team.
Data retention
| Data | Retention |
|---|---|
| Active posts | Kept until manually deleted |
| Soft-deleted posts | Permanently removed after 30 days |
| Sessions | Expire after 7 days of inactivity |
| Webhook failure logs | Cleared after 7 days |
| Audit logs | Kept indefinitely |
GDPR considerations
As a self-hosted deployment, you are the data controller. Quackback is the software, not a data processor.
Your responsibilities include:
- Maintain a record of processing activities
- Respond to data subject access requests within 30 days
- Notify authorities of breaches within 72 hours
- Provide a lawful basis for processing feedback data
Use the user deletion flow to fulfill right-to-erasure requests. For data portability, export a board's posts as CSV from its Data tab in Admin → Settings → Boards, or the whole workspace from Admin → Settings → Imports & exports. See Import and export data for details.
For GDPR subject access requests, export board data as CSV and filter by the user's email address.
Security best practices
Protect your instance and your users' data:
- Use TLS: Run Quackback behind a reverse proxy (Nginx, Caddy) with HTTPS enabled
- Rotate secrets: Change your
SECRET_KEYperiodically - Back up regularly: Schedule automated database backups
- Restrict access: Limit dashboard access to trusted team members
- Keep updated: Pull the latest Docker image for security patches
See Configure team security for authentication and sign-in settings.
Next steps
- Configure team security: Set up team authentication and sign-in methods
- Deploy with Docker: Run Quackback on your own infrastructure
- Import and export data: Back up or migrate your feedback data