Privacy — SuperDuck for Mac
The short version: the AI runs on your Mac. We don't have a server that sees your conversations, your files, your voice, or your camera. We can't read them because they never reach us.
What the app does with your data
Conversations are computed by a model running on your Mac and stored on your Mac, in the app's own folder under Application Support. New chat deletes them. We never see them.
The folder you choose (Settings → Folder) is read and written only by the app, only on your Mac, only when a question or a request calls for it. Choosing it uses the standard macOS file picker; the app has no access to anything else on your disk.
Manner and Context are text files on your Mac. They are sent to the model with every question; that is their purpose.
Voice is turned into text by Apple's on-device speech recognition. The app requires on-device recognition and refuses to run dictation without it. Audio is not recorded or kept. Read aloud uses the system voice on your Mac.
Camera and screen are used only when you press OCR or Screen OCR, or choose the Mirror theme. A single frame is read for text and discarded; the Mirror theme shows the camera and records nothing. macOS asks your permission for each the first time.
Files you drop on the chat or open are read on your Mac and, if you drop them, copied as text into your folder. They go nowhere else.
What leaves your Mac
Nothing, by default. These are the only network connections the app ever makes, and when:
- Downloading a model. When you choose one, the weights are fetched from the model's public home (Hugging Face). The list of models comes from superduck.ai. Neither request carries anything about you beyond the ordinary fact of a download.
- Your phone. If you pair the iPhone app, your Mac keeps a connection to our relay (relay.aimeru.com). The relay forwards encrypted messages between your devices and cannot read them: the key is created on your Mac and travels to your phone inside the QR code, never through the relay. The relay keeps an encrypted copy of recent messages for about a day so a phone that was off can catch up, then discards it. It knows connection times and IP addresses, as any server does. It has no accounts and stores no names.
- The Internet switch. Off by default. When you turn it on, the words the AI decides to search for go to DuckDuckGo, and the pages it reads are fetched from their sites, like a browser would. Turn it off and it stops. The switch is in the sidebar where you can see it.
- The LAN page. If you turn on Settings → LAN, the app serves a chat page to other devices on your own network. It is not reachable from outside your network. Anyone on your Wi-Fi can use it while it is on; the setting says so.
There is no account, no login, no analytics, no crash reporting, and no telemetry of any kind. The app does not know who you are.
The model for other apps
Settings can expose the model as a local server (http://127.0.0.1:8000) for other apps on your Mac, and optionally on your local network. Anything those apps send to it stays on your Mac or your network, by the same rules as above.
Children
SuperDuck is a general tool and is not directed at children. The model is an open-source model with its own behaviour; a parent sets the Context and keeps the Internet switch off.
Changes
If this policy changes, the date at the top changes and the app's Docs window says so.
Contact
sd@superduck.ai. A person reads it.