Policies and security

Privacy policy

Scope

This policy applies to Ducklet's official website, iOS and Android apps, Chrome extension, and related services. It explains how we handle account, saved-content, device, and AI-feature data.

Information we process

Account information: Email address, account identifier, display name, sign-in session, and an avatar that you choose to add in settings.

Content you save: Web URLs, titles, sources, preview information, note text, images, folders, tags, sort order, and creation or update times that you choose to save. Do not save sensitive, confidential, or another person's personal information that you are not authorized to submit for processing.

Device and local data: The apps and extension may store sign-in sessions, language, theme, search engine, reminders, and interface preferences on your device. The Chrome extension reads current tabs, tab groups, page titles, and site icons to display your workspace and carry out actions you explicitly request, such as saving, organizing, focusing, or closing tabs. It does not upload your complete browsing history to our servers.

AI content processing: The current default for new accounts is enabled, and you can turn it off in app or extension settings. When enabled, Ducklet generates retrieval embeddings for saved text inside Supabase. When you use personal context, references, or @folders in Chat Mode, relevant note, webpage, and other saved-content excerpts are sent through Ducklet's server to Z.AI to answer the request. A link URL may also be sent to Z.AI Web Reader when normal extraction is insufficient; an image may be sent through a short-lived signed URL for OCR, a retrieval caption, or a visual answer. The extension and mobile apps do not hold the Z.AI API key. When this setting is off, Chat Mode does not send your saved content or references.

Library search: The current library search sends your query to Ducklet's Supabase server and combines keyword search with Supabase's built-in gte-small text embeddings. The current implementation does not call Z.AI's Web Search API for every library search and does not upload your complete browsing history for search; results remain subject to account-level access controls.

Network and diagnostic information: When you connect to Ducklet, Supabase, Z.AI, page-preview, or favicon services, those services may receive an IP address, browser or device type, request time, error information, and other ordinary network metadata. We do not sell this information or build advertising profiles from your complete browsing history.

How we use information

• Create accounts, verify identity, and keep you signed in;
• Save, sync, display, and manage your bookmarks, notes, images, folders, and reading content;
• Retrieve page titles, images, site icons, and public content for link previews;
• When AI processing is enabled, create retrieval embeddings and, when necessary, retrieve webpage text, OCR text, or one image retrieval caption;
• Generate text embeddings and combine them with keyword search to help you find your own library content;
• Protect the service, prevent abuse, troubleshoot issues, control AI request rate and usage, and improve the product;
• Meet legal obligations and respond to privacy requests.

Third-party services and sharing

We share limited information with service providers only when needed to provide a feature or comply with law:

• Supabase: Provides email authentication, PostgreSQL storage, private file storage, realtime sync, text embeddings, and server functions. Your account content, retrieval chunks, OCR or image retrieval captions, text embeddings, AI job status, and necessary usage or error metadata are stored in Ducklet's Supabase project.
• Z.AI: When AI content processing is enabled and a task requires it, Z.AI processes relevant saved-content excerpts retrieved or explicitly referenced in Chat Mode, plus any link URL or image needed for web reading, OCR, a retrieval caption, or a visual answer. When AI content processing is off, Ducklet does not send your saved content or references to Z.AI. Read the Z.AI Privacy Policy and Z.AI Terms of Use.
• Subscription and payment services: Website Duck Pro checkout is provided by Dodo Payments. Dodo may process the email, name, plan, billing, payment, tax, refund, and transaction information needed for checkout. Ducklet receives subscription status, plan, interval, expiry, amount, currency, and provider transaction or subscription identifiers from webhooks to grant access, synchronize entitlement, and provide support. iOS purchases are processed by Apple App Store, while RevenueCat helps synchronize subscription entitlements and restore purchases. Complete payment-card data is handled by the relevant payment platform and is not stored in Ducklet website code. Read the Dodo Payments Privacy Policy, Dodo Buyer Terms, and RevenueCat Privacy Policy.
• Page and icon services: Retrieve public page metadata, preview images, or favicons for URLs that you choose to save. Those websites process requests under their own policies.
• Hosting: The official website is hosted and published through Netlify. The website itself does not receive your account content; hosting and network infrastructure may process ordinary access logs.

In its current API Data Processing Addendum, Z.AI says that text and other input content submitted by customers or end users through API services is processed in real time and not stored as content on its servers. Z.AI's terms still allow it to process model versions, inferences, upload times, diagnostic information, and other technical or usage metrics. This may vary by account type, region, product, or updated terms, so we do not treat a third-party policy as an absolute guarantee. Service providers may process data outside your country or region; Z.AI's current documentation says its services are generally provided from Singapore.

We do not sell, rent, or exchange personal information, and we do not make private bookmarks public to other users. Unless required by law, needed to protect users or the service, or selected by you, we do not provide your content to unrelated third parties.

Storage, retention, and security

Supabase stores your account details, saved content, notes, image assets, retrieval chunks, OCR or image retrieval captions, text embeddings, processing status, model provider, and necessary usage metadata. For subscribers, Ducklet also stores the plan, subscription status, billing interval, amount, currency, expiry or renewal state, and provider customer, transaction, or event identifiers needed to grant access. We retain these data while your account is active or as needed to provide the service. Deleted content may first remain in a recycle area or short-lived backup, and legal, security, anti-fraud, accounting, or dispute requirements may require longer retention. Turning off AI content processing does not automatically delete an existing search index, but account deletion requests deletion of Ducklet-side account and related records; payment providers may retain transaction records under their legal and business obligations.

PostgreSQL Row Level Security (RLS) uses the account ID to restrict access to profiles, library_items, content_parts, content_embeddings, ai_jobs, and related data. Clients use only the public Supabase anon key; the Service Role Key and Z.AI API Key are kept in controlled server environments and are never shipped in the app, extension, or public repository. Client-to-cloud traffic uses HTTPS/TLS. No internet transmission or storage method is completely secure, but we use technical and organizational measures appropriate to the risk.

Your rights and choices

Depending on the laws where you live, you may have rights to access, correct, export, delete, or restrict processing of personal information, withdraw consent, or object. You can turn off AI content processing, delete individual content, or sign out in the app or extension; see Account deletion for account-level requests. Turning off AI processing prevents subsequent new tasks but does not automatically remove an existing retrieval index; you can delete the related content or request account deletion. Withdrawing a permission may make the related feature unavailable.

AI output, sensitive information, and children

OCR, image retrieval captions, and search-related results may be incomplete, inaccurate, or misleading. They are not medical, legal, financial, educational, journalistic, or other professional advice; independently verify them before taking important action. Do not save and submit passwords, verification codes, payment-card information, medical records, confidential material, or another person's personal information without authorization. Ducklet is not designed for children under 13, and we do not knowingly collect personal information from children.

International processing and updates

Supabase, Z.AI, Dodo Payments, Apple App Store, RevenueCat, page-preview, icon, and hosting providers may process data outside your country or region. We use reasonable safeguards for international transfers as required by applicable law. We may update this policy as the product, AI providers, payment services, law, or services change. We will communicate material changes through the app, website, or other reasonable means, and show the latest date at the top of this page.

Contact

For privacy questions, data access, AI processing, account deletion, or security concerns, contact jazzlin559@gmail.com. Operator and individual developer: Jiaze Lin (Ducklet).

Terms of use

By using Ducklet, you agree to these rules. Ducklet provides link saving, note and image storage, tab organization, cross-device sync, content previews, keyword and semantic library search, optional AI content processing, and related features. The service may change, pause, or end as the product evolves; we will give reasonable notice of material changes when practical.

You must provide accurate information, protect your sign-in credentials, and are responsible for activity on your account. You retain rights to links, notes, images, and other content you submit, and grant Ducklet and the providers that support us the limited permission needed to sync, preview, search, process with AI, store, back up, and secure that content. You must own or obtain the rights, permissions, and consents required to submit it.

Subscriptions, payments, and renewal

Ducklet offers a Free plan and Duck Pro monthly or yearly plans. Website Duck Pro monthly and yearly plans currently include a 14-day free trial; after the trial, the selected plan renews automatically unless you cancel it through Dodo Payments before the next charge. The applicable price, currency, taxes, benefits, trial eligibility, and availability are those shown at Dodo checkout or in the relevant app store. Website subscriptions use Dodo Payments for checkout. iOS subscriptions are purchased through Apple App Store, with RevenueCat helping synchronize entitlements; you must also follow the applicable buyer terms, store rules, and payment policies. Deleting your Ducklet account does not automatically cancel a Dodo or App Store subscription, so manage the subscription with the relevant provider first. Refunds, taxes, failed payments, cancellations, and disputes are governed by the applicable provider rules and law. We retain limited subscription status and transaction identifiers to provide entitlements, handle refunds and disputes, prevent fraud, and maintain financial records.

AI features and third-party services

If you enable AI content processing, Ducklet creates text retrieval embeddings in Supabase. When you use personal context, references, or @folders in Chat Mode, relevant saved-content excerpts are sent through Ducklet's server to Z.AI to answer your request; link URLs or images may also be used for necessary web reading, OCR, retrieval captions, or visual answers. You can turn off subsequent AI processing in settings; when it is off, Chat Mode does not send your saved content or references. Library search itself uses Ducklet/Supabase keyword and semantic search.

You may not submit personal information, confidential material, trade secrets, protected health information, payment information, passwords, verification codes, or other sensitive data that you are not authorized to process with Ducklet or Z.AI. You may not use AI features to violate another person's privacy, intellectual-property rights, or other legal rights, or treat AI output as a medical, legal, financial, educational, journalistic, or other professionally qualified decision.

AI output may be wrong, outdated, incomplete, or unsuitable for your situation. You must independently verify OCR, image retrieval captions, and search results; Ducklet does not guarantee their accuracy, completeness, or continued availability. Z.AI is an independent third-party service, and its API, privacy policy, terms, availability, regions, and data practices may change. Use of the related feature is also subject to the applicable Z.AI Terms of Use.

General rules

You may not bypass access controls, interfere with the service, upload malicious code, abuse automated requests, violate another person's privacy, or use the service to distribute illegal, infringing, malicious, misleading, or unsafe material. Third-party pages and content are controlled by their respective rights holders; you are responsible for ensuring that you may save, process, and share the content.

The service is provided on an "as is" and "as available" basis. We work to keep it stable and secure, but do not guarantee uninterrupted service, accurate previews or AI output, or continued availability of third-party links. To the extent allowed by law, we are not responsible for indirect or incidental losses caused by third-party content, AI output, network interruptions, or misuse of the service. Nothing here limits liability that cannot legally be limited.

You may stop using the service and request account deletion. We may restrict or terminate access when an account seriously violates these terms, harms the service, or when required by law. Continuing to use the service after an update means you accept the revised terms; material updates will be communicated through reasonable means.

For questions about these terms, contact jazzlin559@gmail.com. The service is operated by individual developer Jiaze Lin.

Security

Architecture and access control

• Supabase Auth handles account authentication and sessions.
• PostgreSQL Row Level Security uses auth.uid() to isolate profiles, library_items, content_parts, content_embeddings, ai_jobs, and related data.
• Library search runs through an authenticated Supabase Edge Function, and both keyword and semantic results remain within the account-level data boundary.
• Clients use the Supabase anon key; the Service Role Key and Z.AI API Key are never shipped in the app, extension, or public repository.
• Client-to-cloud and server-to-provider traffic uses HTTPS/TLS; Dodo Payments webhooks verify the provider signature, and RevenueCat webhooks verify a server-side authorization token.

AI data boundary

• Only when AI content processing is enabled and a task requires it does the server send relevant Chat Mode excerpts, explicitly referenced saved content, link URLs, or images to Z.AI. When the setting is off, saved content and references are not sent.
• Link processing may use Z.AI Web Reader to retrieve public content; image processing may use a Supabase Storage signed URL that is valid for about five minutes for OCR or visual understanding.
• The extension and mobile apps do not call Z.AI directly or hold its API key; third-party model calls are centralized in a controlled Supabase Edge Function.
• Ducklet stores retrieval chunks, OCR or image retrieval captions, embeddings, model identifiers, job status, and necessary usage-control data to provide features and troubleshoot failures.
• Server-side controls limit AI request spacing, retries, monthly items, attempts, and estimated budget to reduce duplicate requests, abuse, and unexpected cost.

Operations and release

• Production and test environments are separated, and sensitive keys are configured through hosting-platform environment variables.
• Database changes are reviewed and deployed through versioned migrations.
• We regularly review RLS, Auth Redirect URL, database RPC permissions, CORS, Edge Function secrets, and third-party API boundaries.
• Before release, we perform dependency, secret-leak, and permission checks and complete platform data disclosures for the features actually enabled.
• AI output is assistive and is not a substitute for high-risk automated decisions or professional services.

If you find a vulnerability, send reproduction steps, impact, and the relevant version to jazzlin559@gmail.com. Please do not access, alter, or disclose another user's data.

Account deletion

Account deletion requests removal of your authentication account and Ducklet-side account details, saved content, notes, image records, folders, AI-derived results, text embeddings, and AI job records. Deletion cannot be undone. Short-lived backups, legal records, security logs, or technical metrics held by service providers may remain for the shortest period allowed by applicable law; aggregated data that has been anonymized and can no longer be linked to you may remain.

You can start deletion from “Settings → Delete account” in the iOS and Android apps; the entry point uses the current session to call an authenticated server-side deletion flow. The Chrome extension provides the same account-deletion information and a contact fallback. If the entry point is temporarily unavailable, send a request from your registered email to jazzlin559@gmail.com with the subject "Ducklet account deletion request". Do not send a password or verification code. We will verify ownership through email and confirm the processing timeline.

Under its current API Data Processing Addendum, Z.AI says API input content is not stored as content on its servers and is processed in real time; Z.AI may still retain necessary technical or usage metrics under its terms. If you want to exercise an access, correction, deletion, or restriction request, describe whether it concerns your account, saved content, or AI processing records.

Chrome extension data disclosure

The Ducklet Chrome extension replaces the new tab page and saves pages, organizes tabs, saves images, or schedules read-later reminders when you explicitly request it. The extension does not upload your complete browsing history to our servers and does not call Z.AI directly.

Data processed and purposes

• Account and session: Email, account identifier, display name, and the Supabase sign-in session for login and cross-device sync.
• Current tabs: Tab URLs, titles, site icons, and tab-group information for displaying the new tab page and for actions you explicitly trigger, such as focusing, closing, grouping, or saving tabs. This is primarily processed locally in the browser.
• Pages you save: URL, title, source, preview image, and save time for Read Later, Tasks, and Favorites.
• Notes and images you save: Note text, image assets, and their titles or sources for storage and cross-device display in your account.
• AI content processing: If enabled in account settings, Ducklet creates text retrieval embeddings in Supabase. A link URL or image may be sent by the server to Z.AI when web reading, OCR, or one image retrieval caption is necessary; ordinary notes are not sent to Z.AI. The extension does not contain the Z.AI API key. You can turn off subsequent AI processing in settings.
• Library search: Search queries are sent to Ducklet's Supabase search function, which uses keyword search and gte-small semantic embeddings to find your library content. The current implementation does not send every library search to Z.AI.
• Settings and reminders: Language, theme, search engine, tab groups, due reminders, and notification settings stored in Chrome local storage or your synced account.
• Preview and icon requests: When you explicitly save a page, the extension may request HTML metadata from that public URL and request a favicon from Google or DuckDuckGo. These requests may include ordinary network information.

Chrome permissions

• tabs, tabGroups: Read, display, focus, close, and organize current tabs and tab groups.
• activeTab, scripting: Read public page metadata or extract a preview image only after you click to save the current page.
• storage: Store the sign-in session, interface settings, and reminder records.
• bookmarks: Read or write native Chrome bookmarks when you use browser-bookmark synchronization.
• identity: Complete supported third-party sign-in flows through the browser identity API.
• contextMenus: Provide user-invoked context-menu actions such as saving to Ducklet.
• Optional history: Read local Chrome history only after you enable history search; history is not uploaded to Ducklet servers.
• favicon: Display browser-cached site icons.
• alarms, notifications: Schedule due reminders when you enable read-later reminders.
• http://*/*, https://*/*: Retrieve public preview information and icons only when you explicitly save a page. The extension does not sell or use browsing records for ad targeting.

Prominent disclosure and consent

The extension's sign-in screen asks you to read and agree to the data-processing notice and provides links to this policy and account deletion. After you save a page, note, or image, the content enters the server-side AI queue only when account AI content processing is enabled. You can turn the setting off at any time; new content will then not create AI processing jobs, but existing AI results are not automatically deleted.