Privacy policy.

These rules are enforced in code, not just promised here:

• Slack suggestions start off. A workspace’s admins decide, for everyone in it, whether the app checks what people say in channels it is invited to. Otherwise it reads only what a person writes to it or points it at. Only the author sees a suggestion, and nothing exists until they confirm.
• Private signals stay private. A passed date nudges the person who promised, privately. The waiting side sees state, never the nudges.
• Yours to take or erase. Export everything you can see, any time, self-serve, and delete your account the same way.

All My Ducks is operated by Ed Eliot, trading as All My Ducks , the data controller for the personal data described here. Contact: [email protected]. If the operator later changes (for example, when a company is formed to run All My Ducks ), we’ll update this page and tell you by email.

We collect only what running the product requires:

• Account details: name, email address, password (stored only in a scrambled form that can’t be turned back), a profile photo if you upload one, timezone and notification preferences. Lawful basis: performing our contract with you.
• Other email addresses: any further addresses you add to your account, and which one each workspace uses for you. The members of a workspace see the address it uses. An address that isn’t verified within a day is deleted. Lawful basis: performing our contract.
• Sessions and remembered devices: when you visit this site or the app, your session is stored with your IP address and your browser’s description of itself (which browser and system you use), to keep you signed in and to protect your account. If you tick “Remember this device for 30 days” at the two-step sign-in, we store a name for the browser worked out from that description (such as “Chrome on macOS”), when it was last used, and a code we keep only in scrambled form. Lawful basis: our legitimate interest in keeping accounts secure, and performing our contract.
• Promises and todos: the tasks and promises you and your teammates record: descriptions, dates, notes and their history. Lawful basis: performing our contract.
• Slack identity: if your workspace connects Slack, we store the mapping between your account and your Slack user ID (matched by verified email) so notifications reach you and suggestions can be attributed. Lawful basis: performing our contract. Suggestions from what people say (below) are separate: they start off, and the workspace’s admins decide for everyone in it.
• Billing details: handled by Link and Stripe; we never see or store full card numbers. We keep each subscription’s plan and status and, when Stripe passes them on, the card’s type and last four digits. Lawful basis: performing our contract and legal (tax) obligations.
• Microphone: the microphone button uses your browser’s own speech recognition to turn what you say into text in the box; no audio reaches us. In Chrome that recognition is done by Google under Google’s terms.
• API keys and connected apps: the API keys you make (kept only in a scrambled form that can’t be turned back, with when each was last used), and the apps you connect through the sign-in and consent screen (the app’s name, where it sends you back to, and the access it holds). A connected app acts as you within what the consent screen lists, and what it does with what it reads is under its own terms. You can disconnect it at any time. Lawful basis: performing our contract.
• Webhooks: if you set one up, we send what happens to things you can see, as the API shows them to you, to the web address you choose, signed so you can check it came from us. We keep the address, an encrypted signing secret, and a record of each delivery (which event, when, and the answer your server gave), never the body. Once it leaves us, what happens to it is up to you and that address. Lawful basis: performing our contract.
• Calendar links: a private link a calendar app can read. It lists your open, dated items in one workspace, and things other people have shown you, with their first name. Anyone holding the link can read it, so treat it like a password; making a new link stops the old one. We keep only a scrambled form of it that can’t be turned back into the link. Lawful basis: performing our contract.
• Waitlist: while sign-up is by invite, the name and email address you give when you join the waitlist, so we can invite you; they go once you sign up, or after 12 months (see below). Lawful basis: your request to be invited.
• Phone apps: if you use one of our phone apps and allow notices, it registers the phone’s notification address and a name for the device, so notices reach it. Notices travel through Google’s Firebase Cloud Messaging, and on an iPhone also through Apple’s push notification service. They carry the notice’s title and text and up to 300 characters of the item it is about. Lawful basis: performing our contract.
• AI usage counts: each time an AI feature runs, we add to a daily count for you, the workspace, the feature and the model: how many calls, how much text went in and out, and what they cost. Never the words. See AI analysis below. Lawful basis: our legitimate interest in running the service and keeping its costs in check.
• Technical logs: request records for security and debugging. The content of commitments and messages is scrubbed from logs before they are written. Lawful basis: our legitimate interest in keeping the service secure and working.

We do not run analytics trackers, advertising pixels, or profiling of any kind. We never sell personal data.

The fonts on every page, on this site and in the app, are served from our own site, so no outside font service learns that you visited.

If your workspace connects Slack and its admins turn suggestions on, the app checks what people say for promises, only in channels it has been explicitly invited to. It reads English only. A check on our own servers first asks whether a message has the shape of a promise in English; one that doesn’t is answered there and never leaves our servers. Most messages stop there. One that might be a promise is sent to Anthropic’s Claude API (the Claude Haiku 5.5 model) for a single classification (“does this look like a promise?”), then discarded. A message that mentions a password, a code, a card, an ID number or a date of birth isn’t sent at all. Message text is not saved in our records, and a message that isn’t a promise is never stored. The system that processes a message keeps its own copy for up to an hour after it finishes. If processing a message goes wrong three times, the record of that keeps the message for seven days, and is deleted within a day after that. Only the author of a message ever sees a suggestion made from it, and nothing becomes a commitment unless the author confirms it. A suggestion keeps a short description and a link back to the message, and one not used is deleted after 30 days. A line you write to the app in Slack (by mentioning it, with its slash command or in its own conversation with you) is read as quick add reads one, under your AI switch and whatever the workspace’s suggestions switch says, and a message you react to with a duck is shown back to you alone and never sent to Claude; either way nothing is added until you press “Add”. The “Add to All My Ducks” message shortcut works whatever the workspace’s suggestions switch says, because it only reads a message when you pick it.

Before a Slack message, a line typed into quick add or a draft’s details are sent to Claude, we swap what we can recognise for placeholders: the names of people the app knows, names a small name-finding model on our own servers spots in Slack messages, email addresses, phone and card numbers, ID numbers, dates of birth, street addresses, links, passwords and keys. The real values are put back in what Claude writes. This catches what it can recognise, not everything, so some personal details can still reach Claude.

Two other features send text to Claude. Quick add sends the line you type, with a placeholder for you and for each other person in your workspace, and today’s date and time, to Claude Haiku 5.5 to pick out a name and a date. The optional draft, offered when you want to move a date, drop something or say no, sends Claude Sonnet 5.5 the item’s description, a placeholder for the other person (or the first word of a team’s name), any new date you proposed, and, if the item has been quiet for weeks and it is yours, a line saying so. The description goes through the same swapping as below, and the draft comes back to you with the real names in it. Nothing else is sent: no lists, no history, no email addresses.

Under Anthropic’s commercial terms, nothing we send is used to train models. Anthropic deletes it within 30 days, unless it needs to keep it longer to enforce its usage policy or the law requires it.

We count AI use, never its words. Each answered call adds to a daily row for the person it was for, the workspace, the feature and the model: the number of calls, how much text went in and out, and the cost. Our operators see these counts in our back office, to watch what the service costs to run; nobody in a workspace sees them. When an account is deleted, its counts stay in the totals with nobody’s name on them.

Whether the app checks what people say in a workspace’s Slack channels is the workspace’s decision, made by its admins for everyone in it, as connecting Slack at all is. Suggestions start off, and every workspace was reset to off on 6 October 2026. Admins turn them on or off on the workspace’s AI page or in the app’s Home tab in Slack, with immediate effect, and anyone in the workspace can see there whether they are on and how messages are handled. Every person has an AI switch in their profile, which turns off every AI feature for them, whatever the workspace has chosen: quick add parsing, drafting and Slack suggestions. A line you write to the app itself is quick add, so the AI switch governs it and the suggestions switch does not. A shared workspace’s admins can also turn every AI feature off for everyone in it.

• A promise or an ask is seen by the person who promised and the person it was made to. When it is made to a team, everyone in the team sees it, and an ask sent to a team is seen by its members until one of them says yes.
• A todo is seen by you alone, unless you choose to show it to everyone in the workspace, to a team, or to people you pick. Nobody is told when you show them something. Anyone who can see it can read it and add a note; only you can change it.
• Workspace admins manage membership and billing. Being an admin shows you nothing extra.
• Private signals (such as a quiet heads-up that a date might slip) are shown only to the person they concern, however widely the item itself is shown.
• Our operators, the people who run the service, can see accounts (name, email address, timezone, when last active), workspaces (name, members’ names, email addresses and roles, billing), the waitlist, how many tasks, promises and asks an account or workspace has and how many are done, and the AI usage counts above. They cannot see what any commitment or note says. Everything they do in our back office is written to an audit trail: opening an account, a workspace or the waitlist as well as changing one, such as deleting an account or extending a trial. They cannot open those pages without the entry being written.

We use a small number of processors, each under a data processing agreement:

• DigitalOcean: application hosting, managed databases and profile photo storage. Everything is stored in London, UK; profile photos are delivered through DigitalOcean’s content delivery network, whose servers are worldwide. A photo is fetched with no cookies and without telling that network which page it appears on.
• Stripe: payments and subscription management.
• Anthropic: the AI classification, parsing and drafting described above (US; not used for training; deleted within 30 days unless Anthropic needs it longer to enforce its usage policy or by law). Slack messages, quick add lines and drafts reach it with the names and details we can recognise swapped for placeholders.
• Slack: only if your workspace connects it, under your workspace’s own Slack terms.
• Google: sign-in identity, only if you choose to sign in with Google; and Firebase Cloud Messaging, which carries notices to our phone apps, only if you use one.
• Apple: its push notification service, which carries notices to our iPhone app, only if you use it.
• Cloudflare: DNS and the proxy every request passes through, and bot detection on the sign-in, sign-up, password, waitlist and email verification forms (Turnstile). Turnstile receives your IP address and browser signals, sets no cookies, and processes them under Cloudflare’s Turnstile Privacy Addendum.
• Postmark: transactional email delivery (US).
• Sentry: error reporting, with personal data disabled.

Paid plans are sold by Link, a Stripe company, under its own terms and privacy notice; Link takes the payment. We send it the name of the workspace the plan is for, the plan and its price, the currency when it is pounds or euros, and the page to bring you back to. You give it the details its own checkout page asks for, such as your email address and payment details. It never receives your tasks, notes or anything else written down here.

Where a processor is outside the UK/EEA (Stripe, Anthropic, Cloudflare, Google, Apple, Sentry, Postmark and DigitalOcean are US companies), the transfer is protected by the EU–US Data Privacy Framework or Standard Contractual Clauses.

One other service is reached along the way. When you choose a new password, our server checks it against Have I Been Pwned, a public list of passwords exposed in known breaches. It does this in a way that never sends the password and nothing that identifies you; the request comes from our server, not your browser.

• Account details: while your account exists; anonymised immediately on deletion.
• Promises between people: while the workspace exists: they are the shared record both parties rely on. Your own private todos: deleted todos are recoverable for 30 days, then erased for good.
• Slack message content: not saved in our records (checked, then discarded). The system that processes a message keeps its own copy for up to an hour after it finishes. If processing a message goes wrong three times, the record of that keeps the message for seven days, and is deleted within a day after that.
• Detection suggestions: they stop being actionable after 7 days, and the row is deleted 30 days after it was made.
• Other email addresses: while they are on your account; one not verified within a day is deleted.
• Sessions: a session, with its IP address and browser description, ends after 2 hours without use and is cleared out some time after that. “Keep me signed in” starts a new one for you whenever you come back in the 2 weeks after you signed in.
• Remembered devices: 30 days from when you proved the second step, then deleted. Changing your password, turning two-step sign-in off or on, or using a recovery code forgets them all at once, and you can forget any of them on the Security page.
• Phone app registrations: until you sign out of the app, the phone stops accepting notices, or you delete your account.
• Webhooks and calendar links: until you delete them. Leaving a workspace stops its calendar link working at once, and nothing from it reaches your webhooks after that.
• Waitlist entries: your name and email address are kept until you sign up or delete your account, or for 12 months after you joined or were last invited, whichever comes first. Email us and we’ll delete yours sooner.
• AI usage counts: kept as daily totals; on account deletion your name comes off them.
• Technical logs: 30 days, content-scrubbed.
• Billing records: as long as tax law requires, held by Link and Stripe.

Under the UK and EU GDPR you can:

• Take a copy: export everything you can see, self-serve, from your profile (Article 20, portability; Article 15, access).
• Correct: edit your name, email and preferences in the app (Article 16).
• Erase: delete your account, self-serve, from your profile (Article 17). Your own tasks are erased outright; commitments involving others keep their shared record with your name and email removed, because the other person relies on that history too. Your webhooks, calendar feed links, API keys, connected apps, phone and browser sign-ins, and any password reset you had pending are deleted with it. Delete your account says how, step by step, and what is deleted and what is kept. If nobody can sign in to an account any more, we erase it on request.
• Object or restrict: including turning off AI analysis of your words at any time (Articles 18 and 21).

Exporting asks for your password. Deleting asks for it too, or, for an account with no password, for a code we email you. The Security page in the app lets you set a password.

Anything you can’t do self-serve, email [email protected]; we respond within one month. You can also complain to your supervisory authority; in the UK that is the ICO (ico.org.uk).

Every page, on this site and in the app, sets two strictly necessary cookies: a session cookie and a security token. Signing in can add two more, only if you ask for them: one that keeps you signed in, and one that remembers a device for two-step sign-in. There are no tracking, analytics or advertising cookies, so there is no cookie banner. The cookie policy lists every cookie we set and what the app keeps in your browser’s storage.

All traffic is encrypted in transit, and passwords are stored only in a scrambled form that can’t be turned back. If a breach ever affects your personal data, we will notify you and the relevant authority as the law requires (within 72 hours to the authority).

If this policy changes in a way that matters, we’ll tell you by email before it takes effect; the date at the top always reflects the current version.