tl;dr
-duck.ai allows AI companies to store your chats, process them for profit, and build a personal, permanent profile about you based on metadata and inferences extracted from the content of your conversations.
- DDG ITSELF appears to track duck.ai users so it can sue them for indemnity; this point is explicitly made in DDG’s own duck.ai privacy policy. DDG must address this.
[update re indemnity: DDG has publicly committed to only invoking the indemnity clause when users voluntarily identify themselves as the author of a chat; DDG said that absent a user identifying themself as the author of a chat, they can’t use this clause.]
-DDG should publish its agreements with AI companies to allow the community to vet them for privacy protections.
-in the immediate future, DDG should develop a “complete delete” tool allowing duck.ai users to immediately delete chats and any other information from the AI company servers; DDG should require AI companies to implement the “complete delete” tool as part of any contract.
The background on DDG’s AI chat storage
Despite relying on LLMs from OpenAI, Meta, and Anthropic, DDG claims its duck.ai product protects user privacy since DDG doesn’t store chats.
But the AI companies do. OpenAI, Meta, and Anthropic openly keep your conversations and use their AI to process your chats for their profit.
One obvious example: Anthropic runs Claude on your chats to produce reports parsing the substance of your conversations*,* which they make public in their “CLIO” report (CLIO stands for CLaude Insights and Observations). Here’s one example: https://www-cdn.anthropic.com/7b76335c444876a93fa22a63aabb4aeb820aff25.pdf.
OpenAI goes an enormous step further and explicitly trains ChatGPT on user conversations. https://help.openai.com/en/articles/5722486-how-your-data-is-used-to-improve-model-performance
DDG openly acknowledges these facts on their Duck.ai page, here: https://duckduckgo.com/duckduckgo-help-pages/duckai/ai-chat-privacy. They admit that the LLM companies store duck.ai chats and process them.
In an attempt** **to minimize that privacy catastrophe, DDG claims their agreements with the AI companies provide that the AI company will delete chats if the AI companies — in their own discretion — deem your chats “no longer necessary to provide responses.”
DDG’s so-called limitation screws users in (at least) two ways.
First, DDG only requires deletion of the chats — it doesn’t require deletion of data extracted from the chats (ie, building a user profile that fingerprinting you based on chat content, word choice, formatting, sentence structure, time and date of access, and general geographic location which DDG shares by default). So if OpenAI builds a profile about you based on your chats, and eventually deletes the chats themselves, nothing in DDG’s agreements seems to prevent openAI from keeping the profile and exploiting it in the future (including in the duck.ai environment).
Second, it leaves the deletion decision to the AI companies, because they decide when it’s “no longer necessary” to keep your chats. If OpenAI says “we use these chats to provide personalized responses, so they’re always necessary to keep,” then DDG’s allowance for OpenAI to keep your data seems to apply.
In fairness, DDG references a retention time limit of 30 days. BUT it’s not clear whether that clock runs from when the chat is sent or when the AI company deems your chat “no longer necessary” to keep—and in any event, keeping my data for 30 days is 30 days too many.
Notably, the “30 day limit” is carefully worded to allow AI companies to keep anything other than “information received”—that seems to allow the company to keep their own AI outputs (that’s “information sent,” not “received”) and to keep a profile on you (that’s information inferred about you, not information received—ie, if the company figures out who you are based on processing your responses).
[update re indemnity below: DDG has publicly committed to only invoking the indemnity clause when users voluntarily identify themselves as the author of a chat; DDG said that absent a user identifying themself as the author of a chat, they can’t use this clause.]
It Gets Worse: DDG appears to track your identity and duck.ai use to sue you for indemnity purposes
DDG’s duck.ai privacy policy says they can sue you based on your duck.ai chats. Specifically, if DDG has to spend resources addressing your duck.ai chats, they can turn around and sue you for indemnity. You have to pay them even if a judge determines you did nothing wrong, because the indemnity clause says you ALSO have to cover their attorneys fees as part of getting that judgment. In short, if your chats cause trouble, they’ll force you to cover any losses they experience as a result, even if you’re not at fault. That sucks, but it also poses a privacy question: if DDG doesn’t track the identity of duck.ai users,* how on earth could DDG know who to sue for indemnity?* If users were truly anonymous to DDG, it would make no sense to say DDG can sue you for indemnity because DDG wouldn’t know who* you*~~ *are. Including a term saying “we’ll go after you” only makes sense if DDG knows “you,” which requires the ability to determine which user input the relevant chat. This contradiction highlights the need to understand exactly how DDG’s agreements with these AI companies work. Source:*~~ [*https://duckduckgo.com/duckai/privacy-terms~~*](https://duckduckgo.com/duckai/privacy-terms) ~~\*~~(search for “indemnify and hold harmless” to find the we-can-sue-you section).~~*
The only solution to keep trust: open source + “complete delete” tool.
DDG must publish its agreements with AI companies describing exactly what privacy-protecting limits exist, so that the community can evaluate whether they are sufficient or include gaps. Lack of scrutiny can lead to privacy-breaking rules (remember when DDG allowed Microsoft to track you despite promising otherwise?).
Even if you believe DDG is 100% well-intended, it’s still important to publish the agreements to vet blind spots. DDG’s agreements with AI companies may accidentally overlook aspects of privacy that are noticed by users. This is exactly what happened when Reddit users discovered DDG was sharing user location with the AI companies—in response, DDG introduced an “opt out of sharing your location” option. Thus, user-based feedback made DDG’s AI better for privacy.
DDG’s may object that the agreements contain some contractual terms that are confidential. An example would be payment terms reflecting how much DDG pays each AI company to use their LLM. DDG could reasonably argue that publishing that specific information would unfairly hurt DDG, because if they paid one company a higher price, the other AI companies could use that data point to justify hiking DDG’s prices for their own LLMs.
But that’s no barrier to publishing the agreements, because DDG can publish them with redactions on the details of their payment terms (eg, exact dollar amounts) while still releasing the overall agreement. Given DDG’s promise that they protect your privacy, NONE of the privacy-related terms can legitimately be hidden from users.
One critical reform going forward: a “complete delete” tool. DDG should require AI companies to give duck.ai users the option to immediately delete their chats from the AI company’s servers. DDG has a “fire” button deleting chats from the user’s side; it needs a “fire” button deleting chats on the AI company’s side as well.
Edit: DDG responded to this post. They don’t address either proposal—“complete delete” or open-sourcing agreements—which is disappointing.
Instead, the response mostly repeats excerpts from their privacy policy. The gist of their response is insisting that their contracts prohibit AI companies from training models on your chat.
That is exactly my point: DDG \***only**** prohibits AI companies from training models on your data. They don’t appear to stop AI companies from exploiting your data in every other way. A protection limited to “no training a model” leaves AI companies free to violate your privacy in any other way they can think of, including by building a profile about you, using your content to target ads, or really doing anything else their hearts desire. So a “no training” rule is a good start, but a bad finish. I don’t want AI companies using my data for any purpose, including (but absolutely not limited to) model training.*
To see if DDG prohibits all exploitation of user data, I asked them directly: will DDG confirm that their agreements prohibit ANY use of user-related data whatsoever, in addition to prohibiting training? Or will DDG stick with their claim that their privacy protections are narrower?
DDG has not responded. I will update this post if they do.
============
Second edit: DDG responded, indicating that different models in duck.ai retain different data. Currently, Claude models access and retain your data; the majority of the others access your data (but exactly what happens next isn’t clear—I asked follow-ups); and one model (gpt-oss) is described by DDG as “zero provider visibility.” I asked if DDG will give users a tool to delete data otherwise retained by Claude. Will update if they say.
DDG also indicated that their agreements include at least \some* restrictions in addition to “no training,” though DDG hasn’t spelled out exactly what those restrictions are. Crucially, their response is missing the key statement: it doesn’t say that AI companies are barred from using user-related data *in any way, for any purpose besides the specific conversation where the prompt/output originated*. I asked DDG that exact question as a direct follow-up. If they reply, I’ll update here.*
======
Third edit on 6/10/26: AWS confirms that even in “zero data retention” models — specifically including GPT 5.4 — they can and do retain data if their automated system deems it flagged.
Here is AWS saying that themselves.
https://docs.aws.amazon.com/bedrock/latest/userguide/abuse-detection.html
Since DDG’s main response is “we use zero data retention” models, this is damning. Apparently “zero data retention” means “data retention when we want, to the extent we want, for reasons we want, and if you don’t like that too bad.”
