Duck.ai is DuckDuckGo’s chat interface to models it does not build itself — it sits between you and Anthropic, OpenAI, Mistral, Azure and Tinfoil, forwarding your prompt with the identifying parts taken off. It launched in autumn 2024 and left beta in March 2025. The design question it answers is narrow and specific: what would a chat client look like if the thing you were trying to hide was not the content of the conversation but the fact that it was yours? The answer here is no account, no IP address passed downstream, and no chat history on anyone’s server.

Privacy Architecture

Nothing is asked of you before the first message. No email, no phone number, no card — you open the page and type. That matters more than it sounds, because an account is the durable identifier that ties every session you ever have back to one profile, and without one there is nothing for a chat history to accumulate against.

What reaches the model provider is the prompt and not much else. DuckDuckGo’s documentation states that metadata containing personal information — the IP address is the example given — is completely removed before the model is prompted, so the provider sees requests arriving from DuckDuckGo rather than from you. The company’s own privacy policy goes further and says IP addresses are never logged to disk alongside Duck.ai chats in a way that could be tied back to a user. So the proxy step is not just a relabelling exercise where the operator keeps the mapping — the stated position is that the mapping is not written down at either end.

Conversations stay on the device. Recent Chats are stored locally on your device, not on DuckDuckGo servers; you can delete them one at a time, burn all of them with the Fire Button, and pin up to five you want to keep. DuckDuckGo says that if you use Sync & Backup or certain other optional features, chats are stored in an end-to-end encrypted format it cannot read. By default, a conversation started on a laptop does not exist on the phone, which is the direct cost of not having a server-side account.

On the provider side, the contractual position is zero data retention — prompts and responses deleted immediately after a reply is generated — with one documented exception. At OpenAI and Anthropic, prompts may be held in short-term memory for up to an hour for caching, to cut token costs and latency, and DuckDuckGo states this cache is never written to disk; Anthropic may also retain chats where required by law or as necessary to combat malicious use. DuckDuckGo lists no retention exceptions for Mistral, Azure or Tinfoil. The no-training commitment covers all five providers: Anthropic, OpenAI, Mistral, Azure and Tinfoil are all contractually barred from using Duck.ai conversations as training data.

The hardware-enforced part of this needs to be stated precisely, because it applies to two models and not to the other eight. Requests routed to Tinfoil — which hosts gpt-oss-120b and Gemma 4 31B — are processed inside a Trusted Execution Environment, so that Tinfoil itself cannot see the prompt or the model’s response. That is a stronger architectural claim than a contract alone, though it still rests on DuckDuckGo and Tinfoil’s own description of the setup rather than an independent audit of it. For the Claude, GPT and Mistral models, which run through the Anthropic, OpenAI, Mistral and Azure APIs, there is no such enclave: the protection there is the contract plus the stripped metadata, which is a weaker thing. If enclave-level isolation is what you came for, the choice of model determines whether you get it.

Trust & Transparency

The operator is Duck Duck Go, Inc., a United States company. That is the jurisdiction people will weigh first, and it is worth weighing against what the architecture actually leaves available to compel: no account, no server-side chat store, and no IP-to-query mapping written to disk. A demand for records still runs into the question of which records exist.

DuckDuckGo has been independent since it was founded in 2008 and remains majority-owned by its founder and team members — no acquisition, no private-equity parent, no holding company whose other properties sell advertising data. DuckDuckGo says it does not track how people use the chat, store prompts, or train on the data. Its documentation describes anonymous aggregate statistics (message counts, tokens used) and a random sample of messages reduced to one of about 40 topic categories, stored with the hour, model, plan, platform and approximate country and language but no identifiers; a conversation is stored in full only if you choose to share it as feedback.

The documentation is the strongest part of the trust case. The privacy pages name each model provider, state the retention terms per provider, disclose the one-hour caching exception rather than rounding it down to “we don’t store anything,” and scope the enclave claim to the specific host it applies to.

What is missing is verification. No independent third party has audited Duck.ai’s data flow, and the implementation is closed source, so the metadata-stripping step and the no-disk-logging claim cannot be checked from outside. Every architectural claim above rests on the operator’s own description of its systems, backed by a reputation built in another product line, and not on anyone’s inspection. That is the reason this score sits where it does.

Features

Ten models are available across the tiers, from four different families. Six come free: Claude Haiku 5.5, Mistral Small 4, GPT-6 Luna, GPT-5.4 mini, and the two Tinfoil-hosted open-weight models, gpt-oss-120b and Gemma 4 31B. The subscription adds GPT-5.6 Terra and Claude Sonnet 5.5, and the higher tier adds Claude Opus 5.5 and GPT-5.6 Sol along with higher reasoning effort.

Switching between them is free-form — you pick a model per conversation rather than committing to one, which is the practical argument for a front-end like this over going to each provider directly. Comparing how two families answer the same question takes one dropdown instead of two accounts.

File uploads are supported, with limits worth knowing before you rely on them. Images and PDFs go through, but only on some models rather than all of them, and DuckDuckGo says uploaded images and files are scanned for child sexual abuse material by a third-party moderation provider outside the encrypted channel used for Tinfoil models and kept only if flagged, and PDF page counts are capped by tier: 15 pages free, 35 on Plus, 50 on Pro. Spreadsheets are not supported at all. For document analysis at any volume, those page ceilings arrive quickly.

Image generation is available, also with an unpublished daily cap. There is no confirmed live web search inside the chat interface itself — DuckDuckGo’s AI-assisted answers on the search results page are a separate feature, and nothing in the Duck.ai documentation establishes that the chat mixes fresh search results into its replies, so plan on the models’ training data being the boundary.

Usability

There is no standalone Duck.ai application, but Duck.ai is built into the DuckDuckGo browser app on Windows, macOS, iOS and Android — not a separate download, a mode inside the browser. A Search/Duck.ai toggle sits in the address bar (position configurable: always Search, always Duck.ai, or whichever was used last), chat tabs carry a Duck.ai label in the tab manager, and a dedicated Chats menu gives quick access to recent conversations — searchable, pinnable, individually deletable, or erasable all at once with the Fire Button. On iOS, Voice Chat is reachable from a toolbar shortcut, a Siri shortcut, or Lock Screen and Control Center widgets. DuckDuckGo lists its browser for Mac, Windows, iOS and Android; on other systems Duck.ai is available at duck.ai in any browser.

Set against that, the path to a first message is about as short as it gets: open the site or the app, pick a model, type. No signup wall, no email confirmation, no onboarding sequence, no card on file to try the paid models’ free counterparts. For the case of “I have one question and I do not want an account for it,” the absence of a signup saves everything.

The device-local history has a usability consequence beyond the lack of default sync. Clearing browser data clears your chats, the Fire Button clears them by design, and a private window starts empty every time. Five pinned conversations survive within a browser profile, which is enough to keep a working reference thread and not enough to treat this as a place where research accumulates.

Daily usage limits exist on the free tier and DuckDuckGo does not publish the numbers — only that a cap is there, that the paid tiers raise it, and that the top tier doubles the middle one. Subscribers have a daily and a weekly limit and can draw on the weekly one once the daily one is used up. You find out where the ceiling is by hitting it.

Price & Value

The pricing here is easy to misread, so state it plainly: $9.99 a month is not the price of Duck.ai. It is the price of DuckDuckGo’s entire subscription, a four-in-one package covering a VPN, advanced Duck.ai models, a personal information removal service, and identity theft restoration. Access to the better models is one quarter of that bundle. The Pro tier at $19.99 a month is the same four services with Claude Opus 5.5, GPT-5.6 Sol, higher reasoning effort and double the usage limits on the chat side. Annual billing is $99.99 and $199.99 respectively.

There is no AI-only plan. If the VPN, the data removal service and the identity restoration service are things you neither want nor will use, there is no way to pay a smaller amount for just the models — you buy all four or none. Evaluated as an AI subscription in isolation, that is poor value; evaluated as a privacy bundle where the chat models come along with three other services you were going to consider anyway, the arithmetic changes completely. Which of those two situations you are in decides whether this price is reasonable.

The free tier is the part that needs no qualification. Six models, including two running in hardware enclaves, usable with no account, no card and no trial clock — the only limit is an unpublished daily message cap and image-generation cap. For a large share of everyday use, the free tier is the product, and the subscription buys frontier models rather than buying access at all.

Pros and Cons

No account of any kind — no email, phone number or card before the first message, so there is no durable identifier to accumulate history against
IP address and other personal metadata are removed before the prompt reaches the model provider, and the privacy policy states IP addresses are never logged to disk in a form tied back to a user
Chats are stored in the browser on your own device rather than on a server, deletable individually or all at once with the Fire Button
All five model providers — Anthropic, OpenAI, Mistral, Azure and Tinfoil — are contractually barred from training on Duck.ai conversations
gpt-oss-120b and Gemma 4 31B run inside a Trusted Execution Environment at Tinfoil, so the host cannot see the prompt or the response
Six models free with no account, including both enclave-hosted ones, with no trial period to expire
Ten models across four families with per-conversation switching, so comparing two answers takes one dropdown rather than two accounts
Built into the DuckDuckGo browser app on Windows, macOS, iOS and Android with a dedicated Search/Duck.ai toggle, not confined to a browser tab
Independent since 2008 and majority-owned by its founder and team, with no advertising-data parent company and no per-user usage tracking in the chat

No independent third-party audit of the data flow exists, and the implementation is closed source, so every architectural claim rests on the operator's own description
The Trusted Execution Environment covers only the two Tinfoil-hosted models; the Claude, GPT and Mistral models are protected by contract and metadata stripping alone
No standalone Duck.ai application — it's a mode inside the DuckDuckGo browser (Windows, macOS, iOS, Android)
Chats are stored locally by default, so a conversation started on a laptop does not exist on the phone, and clearing browser data erases it
Advanced models are only sold inside a $9.99/month four-service bundle with a VPN, personal information removal and identity theft restoration — there is no cheaper AI-only tier
Prompts may sit in OpenAI and Anthropic cache memory for up to an hour, and Anthropic may retain chats where required by law or to combat malicious use; both are disclosed but the text exists outside your device in that window
Daily usage limits on the free tier are real but the numbers are not published, so you discover the ceiling by reaching it
PDF uploads are capped at 15 pages free, 35 on Plus and 50 on Pro, only some models accept files at all, and spreadsheets are not supported
No confirmed live web search inside the chat, so answers are bounded by each model's training data
United States jurisdiction, which is the weakest part of the picture on paper — mitigated in practice by how little data exists to compel

Our Rating

Duck.ai suits the person who wants to ask a model a question without that question becoming part of a profile: no account, nothing stored on a server, identifying metadata removed before the prompt leaves, and a free tier good enough that most people never reach the paywall. It’s built into the DuckDuckGo browser app on Windows, macOS, iOS and Android as well as available at duck.ai. The two enclave-hosted models push the privacy case further than contractual promises alone can. It suits you less if you want conversations synced across devices, an AI subscription priced on its own rather than bundled with three other services, or an independent auditor’s word rather than the operator’s — that last one is the main limit here.

Privacy Architecture8.5/10
No account, IP and other identifying metadata stripped before the prompt reaches the model provider, chats kept on the device rather than on a server, and contractual no-training terms with every provider — with a hardware-enforced enclave on two of the ten models rather than all of them
Trust & Transparency6.2/10
Detailed public documentation of the data flow, a no-telemetry stance and long-standing independent ownership, but the implementation is closed source and no third-party audit of these claims exists, so the architecture has to be taken on the operator's word
Features7.0/10
Ten models from four providers with free switching between them, image and PDF uploads, and image generation — but no spreadsheet support, page-count caps on PDFs and no confirmed live web search in the chat interface
Usability7.5/10
Built into the DuckDuckGo browser app on Windows, macOS, iOS and Android — a Search/Duck.ai toggle in the address bar, a dedicated Chats menu for history — plus duck.ai in any browser; held back by chats being local to each device by default and unpublished daily usage caps
Price & Value8.0/10
Six models usable free with no account and no card, but the advanced models are only sold inside a $9.99/month four-service subscription with no cheaper AI-only option

Overall7.5/10

Privacy Architecture 30% · Trust & Transparency 20% · Features 20% · Usability 20% · Price & Value 10%

See our rating methodology →