Privacy policy

Who we are

DuckEars (“we”, “us”) operates duckears.com and the DuckEars application. We are the data controller for the personal data described here. Questions go to privacy@duckears.com.

What we collect

If you only join the waitlist

Your email address, the page you submitted it from, and the date. That is the entire record. We use it to email you about early access and product updates, and for nothing else.

If you use the application

• Account data — email address, display name, and authentication identifiers from your sign-in provider.
• Content you upload — the documents you convert into courses, plus the lessons, questions and explanations generated from them.
• Learning data — which questions you answered, when, and whether you got them right. This is what drives your review schedule; without it the product does not work.
• Technical data — IP address, browser and device type, and error diagnostics.

We do not collect special category data, and you should not upload documents containing other people’s health, biometric or financial records.

How we use it

• To generate your curriculum and schedule your reviews.
• To keep your account secure and prevent abuse.
• To email you — product updates if you asked for them, and service messages (password resets, billing) either way.
• To understand aggregate usage so we can fix what people bounce off.

AI processing of your documents

Generating lessons means sending extracts of your uploaded documents to third-party model providers. We only send the extract needed for the task, we contract with providers on terms that prohibit training on your content, and we do not use your documents to train our own models. Our current providers are listed under Subprocessors below and we will update that list before adding a new one.

Legal bases (UK/EU)

• Contract — running the service you signed up for.
• Consent — marketing email, and any non-essential cookies. You can withdraw it at any time.
• Legitimate interests — security, abuse prevention and aggregate product analytics, balanced against your rights.

Sharing and subprocessors

We do not sell personal data and we do not share it for advertising. We use a small number of processors to run the service — hosting, database and storage, email delivery, payments, error monitoring, and the AI model providers described above. Each is bound by a data processing agreement. A current, named list is available on request from privacy@duckears.com.

How long we keep it

• Waitlist emails — until you unsubscribe, or twenty-four months after the last time you engaged, whichever comes first.
• Account and learning data — while your account is open, then deleted within 30 days of closure.
• Uploaded documents — until you delete them. Deleting a course deletes its source file and everything generated from it.
• Billing records — as long as tax law requires.

Your rights

You can ask us for a copy of your data, correct it, delete it, restrict or object to processing, or take it elsewhere in a portable format. Email privacy@duckears.com and we will respond within 30 days. If you are in the UK or EU and you think we have got it wrong, you can complain to your national data protection authority.

International transfers

Some of our processors operate outside your country. Where that happens we rely on adequacy decisions or Standard Contractual Clauses.

Children

DuckEars is not intended for children under 13 (or under 16 where local law sets that bar). We do not knowingly collect their data — if you believe we have, contact us and we will delete it.

Changes

If we change this policy materially we will email registered users and update the date at the top. The previous version stays available on request.