Duck.ai demonstrates exceptionally strong privacy practices with explicit user ownership of inputs/outputs, no training data usage, comprehensive agreements with model providers to protect user privacy, and robust data minimization practices. The service is designed with privacy-by-design principles including metadata removal and optional encrypted backup with client-side keys.

AI Transparency Facts

Input Data Ownership

Low Risk

Users retain full intellectual property rights in their prompts. Duck.ai only receives a limited license to process prompts for generating outputs, with no ownership claims.

Confidence

95%

Output Data Ownership

Low Risk

Users retain full intellectual property rights in AI-generated outputs. Duck.ai makes no ownership claims to the generated content.

Confidence

95%

Training Data Usage

Low Risk

Duck.ai has explicit agreements with model providers preventing the use of user prompts and outputs for model training or improvement. This is a contractual guarantee beyond typical AI service offerings.

Confidence

90%

Data Retention & Deletion

Low Risk

Very strong data retention practices with clear deletion mechanisms. Model providers must delete data within 30 days, users can delete individual chats or all chats via Fire Button, and optional encrypted backup gives users full control.

Confidence

90%

Third-Party Data Sharing

Low Risk

Excellent third-party data protection. Personal information is stripped before sending to model providers, and contractual agreements prevent misuse. No data sharing beyond the core service functionality.

Confidence

95%

Opt-Out Rights

Low Risk

Multiple opt-out mechanisms available including opting out of local chat saving, voice chat features, and Sync & Backup. Users have granular control over data storage preferences.

Confidence

85%

Compliance & Certifications

Moderate Risk

While the policy mentions compliance with legal obligations and references EU Digital Services Act procedures, specific regulatory certifications or frameworks are not explicitly detailed in the Duck.ai policy.

Confidence

60%

Model Explainability & Auditability

Moderate Risk

The policy acknowledges that AI outputs may be inaccurate and provides transparency about model providers used, but does not detail specific explainability features or enterprise auditing capabilities.

Confidence

70%

Security Practices & Breach History

Moderate Risk

Strong encryption practices are mentioned for the Sync & Backup feature and voice chat relay connections, but comprehensive security controls and incident response procedures are not detailed in this policy.

Confidence

65%

Enterprise vs. Consumer Risk Delta

Low Risk

The policy indicates consistent privacy protection across usage levels, with subscription users having additional privacy policy protections. No indication of different data handling based on account tiers.

Confidence

80%

Human Review of User Inputs

Low Risk

The policy does not indicate human review of user inputs. The privacy-by-design approach with metadata removal suggests minimal human access to user content.

Confidence

75%

Regulatory & Litigation Exposure

Moderate Risk

Policy includes standard indemnification clauses and mentions cooperation with legal compliance including CSAM reporting. References EU Digital Services Act compliance procedures for EEA users.

Confidence

75%

PII & SPI Data Inventory

Low Risk

Minimal PII collection with explicit mention that IP addresses and personal metadata are removed before processing. Optional encrypted backup requires minimal device information. No indication of SPI collection beyond user-submitted content.

Confidence

85%

You've read all 15 risk ratings for Duck.ai. Create a free account to see the exact policy wording behind each rating.