Privacy Policy

Effective 2026-10-09 · Last updated 2026-10-09

Ducktate turns your voice into text on your own Mac or iPhone. Your audio never leaves your device. Some features do send data to us or to services we use: usage analytics (on by default, and you can turn them off), your account, purchases, and Ducktate Cloud. Ducktate Cloud cleanup is on by default for Pro and trial users, and it sends the text of your dictations and meetings to our servers on Google Cloud. This policy says what we collect, why, who receives it, how long we keep it, and how you control it.

1. Who we are

Ducktate is made by Gravitas AI LLC ("Gravitas AI," "we," "us," or "our"), 7754 Okeechobee Blvd PMB 384, West Palm Beach, Florida 33410, United States. We are the controller of the personal data this policy describes.

This policy covers: the website at ducktate.com (the "Site"), the Ducktate Mac app, the Ducktate iPhone app, the web notes app at app.ducktate.com, Ducktate Cloud, and the emails we send. For privacy questions and requests, write to [email protected] (see Section 18).

2. The short version

• Your audio never leaves your device. Speech is turned into text on your Mac or iPhone. We never receive your audio.
• Your notes start on your device. On the Mac they are Markdown files in a folder you choose. On the iPhone they sync through your own iCloud.
• Ducktate Cloud sends text to us. For Pro and trial users, Ducktate Cloud cleanup is on by default. It sends the text (never the audio) of dictations and meetings to our servers on Google Cloud, where Google Gemini models clean it. You can turn it off. See Section 4.
• Analytics are on by default. The website, the Mac app and the iPhone app send usage events to PostHog. The website also uses Google Analytics and Cloudflare Web Analytics. Analytics never include your dictation text, transcripts or notes. You can turn them off. See Section 6.
• We do not sell your personal information, and we do not use it for targeted advertising.

3. What we collect, by product

3.1 The website (ducktate.com)

• Analytics. Pages you view, when you leave a page, clicks, scroll depth, which sections you see, the buttons you press, and the plan you pick. Your browser, device type and approximate location (from your IP address) may be recorded by the analytics services. PostHog, Google Analytics and Cloudflare Web Analytics receive this. See Section 6 for your choices.
• Waitlist. If you join the waitlist, we store your email address, the page or link you came from, your browser's user agent, and the time. We use this to send you your invite. We also send our team an email that a new person joined. The sign-up event we send to PostHog has the first page and referrer of your first visit, but not your email address.
• Account page and checkout. If you sign in on ducktate.com/account (with Google or an email sign-in link), we receive your email address and account ID. If you buy Pro, we send your account ID and email address to Stripe to start the checkout. On this page we tell PostHog your account ID, but not your email address.
• Referral links. If you open a referral link, the referral code is kept in your browser until you sign in and redeem it.
• Unsubscribe page. When you unsubscribe, we store your email address on our do-not-email list.
• Fonts and code. The account page loads fonts from Google Fonts. The account page and referral page load the Supabase sign-in code from esm.sh. These services receive your IP address when your browser fetches the files.

3.2 The Mac app

• Audio. Microphone and, for meetings you record, system audio are kept only in memory, turned into text on your Mac, and then discarded. The app does not upload audio.
• Notes and history (on your Mac only). Notes are plain Markdown files in a folder you choose. The app also keeps the raw and cleaned text of your last 200 dictations in a file on your Mac. The app reads the title of the front window on each dictation to file the note. These stay on your Mac.
• Usage analytics (on by default). The app sends usage events (for example, a dictation started, how long it took, how many words, which cleanup provider ran) and error and crash reports to PostHog. Events never include your dictation text, transcripts or notes. The Mac app has no session recording. If you sign in, the app links these events to your account ID and your email address. Turn this off in the Mac app's Settings, Privacy section.
• Account (optional for free use). If you sign in (email link, 6-digit code, or Google), we store your email address, account ID, display name, the time and version of the Terms you accepted, your plan, and your referral codes. You need an account for Pro and Ducktate Cloud.
• Feedback and problem reports. If you send one, we receive your message, its type, the app and macOS versions, and an incident ID. You can attach a diagnostic bundle; the app shows it to you before you send it. Our team gets a Slack notice with your email address and the first 2,000 characters of your message.
• AI cleanup. The text of your dictation goes to the cleanup provider you use. For Pro and trial users this is Ducktate Cloud by default. See Section 4 and Section 5.
• Updates and model downloads. The app checks for updates at dl.ducktate.com (served by Cloudflare) and sends no system profile. If you pick a larger speech model, the app downloads it from Hugging Face. No content is sent.
• RevenueCat. The Mac app includes the RevenueCat software kit for a Mac App Store channel that is not active. The kit can contact RevenueCat with a random ID, or your account ID after you sign in. It never receives your email address.
• Pairing with an iPhone. Pairing moves a vault key between your devices. Our server holds a sealed (AES-GCM) package that we cannot read for up to five minutes. A daily cleanup deletes any that remain.
• Optional sync to your own server. If you turn on vault sync and enter your own server, the app sends your notes to that server. You operate it; we do not receive this data.

3.3 The iPhone app

• Audio and notes. Speech is turned into text on your iPhone. Notes and audio sync through your own iCloud account, not through our servers. When your iPhone is paired with a Mac, notes are sealed with your vault key before they sync. When it is not paired, they sync as plain text in your iCloud.
• Account (optional). You can sign in with Apple, Google, or an email sign-in link. We store your email address and account IDs.
• Usage analytics (on by default). The iPhone app sends usage events to PostHog: onboarding steps, permission answers, capture and meeting counts and durations, note edit counts, settings changes, sign in and sign out, errors and crashes. Events are linked to your account ID only, never your email address. They never include note text, titles, transcripts, audio, file names or speaker names. Session recording and screen capture are off. Turn analytics off in Settings ("Share anonymous usage and errors").
• Ducktate Cloud cleanup. For Pro and trial users, the iPhone app cleans takes and meeting notes with Ducktate Cloud by default. See Section 4.
• Purchases. The iPhone app sells nothing and has no payment code. Pro on the iPhone comes from your Ducktate account.
• Account deletion. Settings, below Sign out, lets you delete your account.

3.4 The web notes app (app.ducktate.com)

You sign in to the web app with your Ducktate account. Notes and attachments you keep there are stored in Ducktate Cloud (Section 4). If you connect an AI agent (for example Claude, ChatGPT or Codex) to your notes with a key or sign-in you approve, that agent can read and write your notes. We record each agent read and write, and you can see that record.

3.5 Emails

We send waitlist confirmations and invites through Resend, and sign-in emails through Supabase. These services receive your email address and the message. Every marketing email has an unsubscribe link. When you unsubscribe, we keep your email address on our do-not-email list so we do not write to you again.

4. Ducktate Cloud

Ducktate Cloud is our own server service. It runs on Google Cloud (Cloud Run and Firestore in the us-central1 region of the United States) and uses Google Gemini models through Google Vertex AI. It is for Pro and trial users only. Free users never use it.

4.1 Cloud cleanup

• On by default for Pro and trial users. If you never picked a cleanup provider, Ducktate Cloud is your provider. If you picked another provider, or chose local-only AI, we do not change your choice.
• What is sent. The text of your dictation, a style setting, and up to 100 glossary words. For notes: the cleaned text, your existing note tags, and the date. For meetings: the transcript lines with speaker labels, your template headings, the notes you typed, the title, participant names, the date, and any question you ask the meeting assistant. Audio is never sent.
• What we keep. We do not keep your text after we send back the result, with one exception: a meeting job can hold its transcript and result text for up to 24 hours so it can finish. We keep usage records (model, word and token counts, time taken, a one-way hash of the request) but not your text. We do not log the text.
• Google. Google processes the text for us. Google says it does not use it to train its models. Under Google's terms, Google may cache the text in memory for up to 24 hours and may keep it to detect abuse.
• How to turn it off. On the Mac: Settings, AI Model, switch off "Ducktate Cloud cleanup", or turn on Local-Only AI. On the iPhone: Settings, switch off "Ducktate Cloud cleanup" (your Mac then cleans the notes when they sync).

4.2 Cloud notes

• What is stored. If you keep notes in Ducktate Cloud, we store the notes and their attachments (in Cloudflare R2), their details and a change history (in Google Firestore), and their keys (wrapped by Google Cloud KMS).
• Encryption. Cloud notes are encrypted at rest with keys we manage. They are not end-to-end encrypted: our systems can read them to run search and to serve the AI agents you connect.
• When your plan ends. After a paid plan ends, you keep access for 90 days (30 days after a trial). Then your cloud notes are locked for 30 days, and you can only export them. Then we delete them.
• When you delete your account. Your cloud notes are locked at once and deleted within 30 days.

5. AI cleanup providers

You choose the cleanup engine in the Mac app. For Pro and trial users the default is Ducktate Cloud (Section 4). The other choices are:

• ChatGPT (OpenAI). If you sign in with your own ChatGPT account and select it, the transcript text and limited note context are sent to OpenAI under your account to produce the cleaned-up note. This data is handled by OpenAI under OpenAI's privacy policy. We do not operate a server in between and we do not retain this text.
• Claude (Anthropic). If you select Claude, the app uses the Claude command-line tool that you have installed and signed into on your own Mac. The transcript text is processed by Anthropic under your own account and their privacy policy. Ducktate never sees or stores your Anthropic credentials.
• OpenRouter (Pro). If you are on Pro and connect your own OpenRouter API key, the transcript text and limited note context are sent to OpenRouter under your key and their privacy policy. Your key is stored in your Mac's Keychain.
• Ollama (your own server). If you select Ollama, the text goes to the Ollama server address you enter, which you operate.
• Ducktate Local (on your Mac). Cleanup runs on your Mac with a built-in model. No text leaves your Mac.
• Off. If AI cleanup is off, your transcripts stay as they are and no text goes to any AI provider.

AI training. When you use your own account or key, your agreement with that provider decides whether it may train on your text. We do not use your dictation text, transcripts or notes to train any model of our own.

6. Analytics and your choices

We use analytics to learn which pages and features help people, and to find errors. We do not use analytics for advertising.

• PostHog (United States servers) receives website events, Mac app events and iPhone app events. On the website it records pageviews, clicks and heatmaps. It does not record your screen: session recording is off. We set PostHog to discard IP addresses.
• Google Analytics (Google LLC) receives website pageviews, your browser and device type, the referring page, and an approximate location. We tell Google not to use advertising storage or ad personalization.
• Cloudflare Web Analytics, which our host Cloudflare adds to every page, counts visits and page loads. Cloudflare says it does not record the query part of the web address.

6.1 Privacy choices on the website

• EEA, UK and Switzerland. If you visit from these regions (or we cannot tell where you are), you see a banner. PostHog and Google Analytics do not load until you select Accept. Reject is as easy as Accept.
• Everywhere else. PostHog and Google Analytics load by default. To turn them off, select "Privacy choices" at the bottom of any page and select Reject.
• Changing your mind. "Privacy choices" also lets you change your answer at any time. When you turn analytics off, we stop PostHog and Google Analytics and remove the PostHog and Google Analytics cookies and browser storage that this site set.
• Pages without PostHog and Google Analytics. This policy, the terms, the subprocessors page and the unsubscribe page never load PostHog or Google Analytics.
• Cloudflare Web Analytics is added by our host, and the Privacy choices setting does not turn it off.

6.2 Do Not Track and Global Privacy Control

Global Privacy Control (GPC): if your browser sends a Global Privacy Control signal, our website treats it as an opt-out everywhere: PostHog and Google Analytics do not load. Do Not Track: there is no common standard for the older Do Not Track signal, so our website does not change what it does when it receives one. Use Global Privacy Control or Privacy choices instead.

Other companies on our website: Google (through Google Analytics) and PostHog collect information about your use of our website over time. Google may also collect information about your activity on other websites, under Google's own privacy policy.

6.3 Analytics in the apps

The Mac app and the iPhone app send usage events to PostHog by default (Section 3.2 and Section 3.3). Turn this off in each app's Settings.

7. Cookies and browser storage

Our own server sets no cookies. The scripts on our pages store these items in your browser:

8. Purchases and subscriptions

• Where you buy. Pro is sold on ducktate.com. Stripe processes the payment. We send Stripe your account ID and email address; you give Stripe your card and billing details. We never see your full card number (Stripe's Privacy Policy).
• What we store. Your plan and its status, your Stripe customer ID, and copies of the billing event records Stripe sends us. We use them to give you the features you paid for.
• Free trial. Every new account gets 30 days of Pro free, with no card.
• Apps. The iPhone app sells nothing. Pro on your Mac and iPhone comes from your Ducktate account. Your plan status is cached on your device so paid features work offline.

9. Permissions the Mac app requests

macOS asks your permission before the app can use these. Each is used only for the stated purpose, and none of them send data to us:

• Microphone. To capture your speech for on-device transcription.
• System audio capture. To include other participants when you record a meeting. This does not require screen-recording permission.
• Automation (Apple Events). To read your browser's open tab addresses so the App can detect a Google Meet call, and to paste transcribed text into the app you are using. The App checks whether a tab is a meeting; it does not collect or transmit your browsing history.
• Accessibility. To provide the global push-to-talk shortcut and to paste text where your cursor is.

10. Who receives your data

We share personal data only with the service providers that run Ducktate for us, and with the AI providers you choose. Our Subprocessors page lists each one, what it does, the data involved, and where it is. In short:

• Supabase: accounts, sign-in, plans, feedback, diagnostic bundles, waitlist, do-not-email list.
• Google Cloud and Google Gemini: Ducktate Cloud processing and cloud note details. Google LLC also runs Google Analytics, Google sign-in and Google Fonts.
• Cloudflare: website hosting, Cloudflare Web Analytics, app downloads, and cloud note storage (R2).
• PostHog: analytics for the website and both apps.
• Stripe: payments. Resend: email. Slack: internal notices of feedback and code redemptions. Apple: Sign in with Apple and your iCloud. Hugging Face: optional model downloads. esm.sh: sign-in code on two web pages.
• AI providers you choose: OpenAI, Anthropic, OpenRouter, or your own Ollama or sync server, under your own account.

We do not sell your personal information, and we do not share it for targeted (cross-context behavioral) advertising.

11. Where your data is stored

Gravitas AI LLC is in the United States. Our account database (Supabase) is in Canada. Ducktate Cloud runs on Google Cloud in the United States (us-central1), and Google may run Gemini models in other regions. PostHog stores analytics in the United States. Cloudflare serves the website from its global network. If you are outside these countries, your data goes to countries whose data protection laws may differ from yours. To ask about the safeguards for a transfer, contact us.

12. How long we keep data

• Your account: until you delete it. You can delete it in the Mac app (Settings, Account, "Delete my account") or the iPhone app (Settings, Delete account), or by writing to us. Deletion also cancels your Stripe subscription.
• What we keep after you delete your account, and why: billing and payment event records (with the link to your account removed) and a record of any access code you used, for tax, accounting and fraud reasons; one short record that the account was deleted, for security; and your email address on our do-not-email list if you unsubscribed, so we honor that choice. Stripe keeps your Stripe customer record under its own policy.
• Feedback: 365 days. Diagnostic bundles: 90 days. Both are deleted sooner if you delete your account.
• Pairing packages: 5 minutes (any that remain are deleted the next day).
• Waitlist entries: we have no fixed period. We keep your entry until you ask us to delete it.
• Ducktate Cloud: cleanup text is not kept, except meeting job text for up to 24 hours. Usage records: up to 400 days. Cloud notes: see Section 4.2.
• Analytics: kept by PostHog and Google under the retention settings of our accounts. Google Analytics cookies last 2 years; the PostHog cookie lasts 365 days.
• On your devices: you control your notes and app files. To remove them, delete your notes folder and the app's support files, then uninstall the app. Data you sent to your own AI provider or server is under that provider's policy.

13. Security and encryption

• Data moves between the apps, the website and our servers over encrypted (HTTPS) connections.
• Mac notes are plain Markdown files unless you turn on Encryption Mode (Pro). Encryption Mode encrypts note bodies with AES-256-GCM, protected by your password and a recovery phrase. File and folder names, and attachments, are not encrypted. Your dictation history file is plain text when Encryption Mode is off.
• iPhone notes are sealed with your vault key when your iPhone is paired with a Mac.
• Cloud notes are encrypted at rest with per-vault keys that we manage through Google Cloud KMS. They are not end-to-end encrypted, so our systems can read them.
• No system is perfectly secure. If you find a security problem, write to us.

14. Legal bases (EEA, UK, Switzerland)

If you are in the EEA, the UK or Switzerland, we use your data on these legal bases:

• Contract: to run your account, your plan and payments, Ducktate Cloud, and the emails you asked for (waitlist, sign-in, invites).
• Consent: for PostHog and Google Analytics on the website. You can withdraw consent at any time in Privacy choices.
• Legitimate interests: app usage analytics and error reports (to fix and improve Ducktate; you can turn them off), Cloudflare Web Analytics, security and fraud prevention, and internal notices about feedback.
• Legal obligation: billing and tax records.

You do not have to give us any data to use the free Mac app. We need your email address for an account, and an account for Pro. We do not make decisions about you by automated means that have legal or similar effects.

15. Your rights and how to use them

Depending on where you live, you can ask us to: tell you what personal data we hold and give you a copy; correct it; delete it; give it to you in a portable format; stop or limit some uses; and withdraw consent. In the EEA, the UK and Switzerland these are your GDPR rights, and you can also complain to your local data protection authority. In California and other US states with privacy laws, you have similar rights, you can use an authorized agent, and we will not treat you differently for using your rights.

How to use them:

• Email [email protected], or write to the postal address in Section 18. We may ask you to confirm that you control the email address on the account.
• Delete your account in the Mac or iPhone app (Section 12).
• Turn analytics off in Privacy choices on the website, or in each app's Settings.
• Use the unsubscribe link in any marketing email.

Response time: we answer within 45 days. If you are in the EEA, the UK or Switzerland, we answer within one month. If we need more time, we tell you why.

Appeal: if we refuse your request, you can appeal. Reply to our answer with "Appeal" in the subject line. We answer appeals within 60 days. If you are not satisfied, you can contact your state attorney general or your data protection authority.

16. Children

Ducktate (the website, the apps and Ducktate Cloud) is not for children under 13. We do not knowingly collect personal information from children under 13. If you think a child under 13 gave us personal information, contact us and we will delete it.

17. Changes to this policy

We update this policy when Ducktate or the law changes. When we do, we change the "Last updated" date at the top. For important changes, we also give a clear notice, for example on the website or in the app. We update this policy before a new feature uses your data in a new way.