Privacy policy

Last updated October 24, 2026

Ducky helps you learn by talking through your work. Here is what we collect to make that possible, who can see it, and what we never do with it.

What we collect

  • Your name and email, from Google or from the email you sign up with, and whether you are a student or a teacher.
  • Your classes and the problem sets you work on.
  • What you say or type in a session, plus any sketches you draw. We keep the transcript so you can reopen a past problem set and read it back.
  • What Ducky notices in your reasoning: the misconceptions it spots (with the quote it used) and rubric scores, including any score a teacher changes.
  • Problem sets that teachers upload.

What we never do

  • We don’t store your voice. Audio becomes text, and the audio is discarded.
  • Your work is never used to train AI models.
  • We don’t sell your data or show ads.

Signing in and staying signed in

  • You can sign in with Google, or with an email and password or a one-time email link. Passwords are handled by Supabase Auth. We never see them.
  • Every account uses a second step: a code from an authenticator app.
  • If you choose “Stay signed in,” your sign-in lasts up to 30 days on that device. Without it, you’re signed out when the browser closes.
  • Even while you stay signed in, Ducky asks for a fresh authenticator code about every 3 hours.

Who can see it

  • Only you can see your saved chat history.
  • Teachers see sessions from their own classes, and nothing else.
  • Students never see answer keys or solutions.
  • Study-buddy matching is opt-in and shows first names only.
  • Teacher actions, like changing a score, go into an audit log.

Services we use

  • Supabase stores accounts and session data. Google handles Google sign-in.
  • An AI model provider writes Ducky’s replies, under terms that forbid training on your data.
  • SerpApi searches the web for study resources and for leaked copies of problems. It gets the problem’s topic and step, or the words a student types into resource search. It never gets the chat itself.
  • In Chrome and Edge, voice input uses the browser’s built-in speech recognition, which may send audio to the browser maker for transcription.

What stays in your browser

  • A half-finished sign-in form (never the password) is kept for a day, so you don’t lose it if you switch to your email.
  • Class lists, problem sets, and the teacher dashboard still run on sample data stored in this browser. They never reach our servers.
  • Clear them any time with Reset demo on the teacher page, or by clearing this site’s data in your browser.

Schools and younger students

  • Ducky hasn’t been reviewed under FERPA or COPPA, so it isn’t ready for K-12 classrooms or for students under 13.

Your choices

  • To see or delete your data, ask your teacher or school.
  • If this policy changes, we’ll update the date at the top of this page.