AI assistants
Duck.ai privacy rating
AI chat from DuckDuckGo that relays prompts to third-party models without identifying the user, with no account needed and recent chats saved only on the device.
Summary
Duck.ai scores 60 out of 100 (grade C) on the AI assistants criteria. It meets 5 of 12 criteria: no trackers or telemetry, tells users about requests, no training on your data, limited chat retention and no account needed. It partly meets open source, no ads or data sales, transparency report and TLS configuration. It does not meet independent audit, security headers and runs locally. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A- and Mozilla HTTP Observatory grade B-.
Score 60 out of 100. How scoring works
Criteria
-
Partial
Open source Weight 3 of 3
Is all the source code needed to run the product public?
DuckDuckGo's apps, which include Duck.ai, are open source under Apache-2.0. The Duck.ai service is not.
-
Yes
No trackers or telemetry Weight 3 of 3
Are the website and apps free of third-party trackers, with any analytics anonymous and any telemetry off by default?
No third-party trackers or tracking cookies, and the Android app has no known trackers in its Exodus report.
-
Partial
No ads or data sales Weight 2 of 3
Is the product funded without advertising, ad targeting or selling user data?
DuckDuckGo is funded by search ads based only on the current search, not a profile, and by subscriptions.
-
No
Independent audit Weight 2 of 3
Has an independent security or privacy audit been published within the last three years?
No independent audit is published.
-
Partial
Transparency report Weight 2 of 3
Does the provider regularly publish how many government and legal requests it receives and how it responds?
The privacy policy states how legal requests are handled, but no request counts are published.
-
Yes
Tells users about requests Weight 1 of 3
Does the provider promise to tell users about requests for their data, unless a court forbids it?
Users with an email address on file are notified of legal disclosures by email unless legally forbidden.
-
Yes
No training on your data Weight 3 of 3
Are prompts, chats and files kept out of model training by default?
Agreements with model providers prohibit using prompts and outputs to train or improve models.
-
No
Runs locally Weight 2 of 3
Can the assistant run on your own device or server, so prompts never leave it?
Hosted only.
-
Yes
Limited chat retention Weight 2 of 3
Are chats deleted by default or on request, with no long-term server copy?
Recent chats are saved only on the device, and model providers delete data within 30 days, with limited exceptions for safety and legal compliance.
-
Yes
No account needed Weight 1 of 3
Can it be used without an account or personal details?
No account is needed. Requests are sent without identifying metadata such as the IP address.
Automated tests
-
Partial
TLS configuration Weight 2 of 3
Does the website pass the Qualys SSL Labs test with a grade of A or better?
Grade A-
-
No
Security headers Weight 1 of 3
Does the website pass the Mozilla HTTP Observatory test with a grade of A or better?
Grade B- (65/100+)
-
Not tested yet
Modern web standards Weight 1 of 3
Does the website score 90% or higher on the Internet.nl website test?
Not tested yet.