Security.

• A promise or an ask is seen by the people on either side of it. A todo is seen by you alone unless you choose to show it to everyone in the workspace, a team, or people you pick.
• Passwords, API keys, remembered-device codes and every invite or feed link are stored only in a one-way scrambled form, so a copy of the database would not reveal them.
• Credentials we do have to read back, like a Slack connection or a webhook’s signing secret, are encrypted with a key that never lives beside the data.
• Slack messages are not saved in our records. The system that processes one keeps it for up to an hour afterwards, and longer only when handling it goes wrong, as set out below. Card numbers never reach us. What Google sends when you sign in is used once and discarded.
• AI calls send one message, one typed line or one item’s description at a time. Under Anthropic’s commercial terms none of it is used for training, and Anthropic deletes it within 30 days unless it needs to keep it longer to enforce its usage policy or by law. Before a Slack message, a quick add line or a draft’s details are sent, the names and details we can recognise are swapped for placeholders. Slack suggestions start off, and a workspace’s admins decide for everyone in it.

The product enforces its privacy model in code, not in a policy. A promise or an ask is shared between the person who promised and the person or team it was made to. A todo is seen by its owner alone unless they show it to everyone in the workspace, to a team, or to people they pick; anyone it is shown to can read it and add a note, and only the owner can change it. Workspace admins manage membership and billing; being an admin opens nobody else’s list. Private signals, such as a quiet heads-up that a date might slip, are shown only to the person they concern, however widely the item is shown, and that boundary is enforced where the data leaves the server, not just in the interface.

Our own operators can see accounts, workspaces, billing and the waitlist so they can help you, along with counts: how many tasks, promises and asks an account or workspace has and how many are done, and daily counts of AI use (calls, amount of text and cost, per person, workspace, feature and model). They cannot see what any commitment, note or message says. Everything they do in our back office is written to an audit trail: opening an account, a workspace or the waitlist as well as changing one, such as deleting an account or extending a trial. They cannot open those pages without the entry being written.

In transit. All traffic between your browser, the API, integrations and All My Ducks is encrypted with TLS.

At rest. Data lives in managed databases with encryption at rest, and backups inherit it. On top of that, the few secrets the app needs to read back (a Slack connection, webhook signing secrets, two-factor secrets and recovery codes) are encrypted again by the app with a key kept apart from the database, so a copy of the database on its own cannot read them.

Scrambled, never stored. Passwords, API keys, the secrets connected apps use, remembered-device codes, workspace invites, waitlist invites and calendar feed links are all kept only in a one-way scrambled form that can check a match but can’t be turned back.

Not kept. Slack message text is read, classified and discarded: none of it is saved in our records. The system that processes a message keeps its own copy for up to an hour after it finishes. If handling a message goes wrong three times, the record of that keeps the message for seven days, and is deleted within a day after that. Card details go straight to Stripe and never touch our servers. When you sign in with Google we keep only an identifier for your Google account, never anything that would let us act in it.

• Passwords are at least 12 characters. A new or changed password is checked against Have I Been Pwned, a public list of passwords exposed in known breaches, in a way that never reveals the password or who you are. If that check can’t run, the other rules still apply.
• Optional two-factor authentication with an authenticator app and single-use recovery codes.
• After the code step you can tick “Remember this device for 30 days”, so that browser skips the code until then. It skips only the code, never the password. Changing your password, turning two-factor off or on, or using a recovery code forgets every remembered device, and the Security page in the app lists them so you can forget any one.
• A session ends after 2 hours without use. “Keep me signed in for 2 weeks” is off unless you tick it, and lasts 2 weeks, not years. Deleting your account ends every session on every device.
• Sign in with Google, if you prefer, with nothing stored beyond the link to your account.
• Sign-in, sign-up and password reset are limited in how often they can be tried, so someone guessing passwords at scale is stopped and a busy shared office never is. Password reset answers the same way whether or not an account exists.
• Exporting your data asks for your password again. Deleting your account does too, or, for an account with no password, asks for a code we email you. An account with no password can set one on the Security page in the app.
• Sign-in, sign-up, password and waitlist forms, and the email verification code, are checked for automation by Cloudflare Turnstile, which sets no cookies and never asks you to solve anything.

Every page tells your browser exactly where it may load anything from: our own site, and Cloudflare for the bot check, nowhere else. That stops a planted script or a look-alike page from running inside ours. No other site may show our pages inside its own, and when you follow a link away from us the other site learns only our address, never which page you were on. Our cookies only travel over an encrypted connection, the one that keeps you signed in can’t be read by the page itself, and none is sent when another site tries to submit a form to us or contact us in the background. The cookie policy lists every one.

The web app, the phone apps, AI assistants and other tools all go through the same doors with the same permission checks, so there is no privileged back door. An app or assistant you connect asks for your permission on a consent screen, using the current industry standard for doing that safely, and never sees your password. API keys either act as you, or are limited to one workspace and managed by its admins, and no key can give itself more power or make other keys. We only accept messages from Slack that prove they came from Slack, and our Slack app asks for the least access it needs and never acts as any person.

Connecting an app shows a consent screen that says what it will and won’t be able to do as you, and where the request comes from. Every connected app is listed beside your API keys and can be disconnected there; neither a key nor a connected app can see or change that list.

Webhooks go only to https addresses on the public internet, never to private network addresses. Each delivery is signed with a secret only you and we hold, so you can check it came from us and when it was sent. The body is built when it is sent, through the same permission checks the API uses, and is never stored.

A calendar link is a secret in a web address: anyone holding it can read that feed, so treat it like a password. It never carries private signals, it stops working when you leave the workspace, and making a new one stops the old one.

Three features send text to Anthropic’s Claude API, one item at a time: Slack suggestions and quick add to Claude Haiku 5.5, drafts to Claude Sonnet 5.5. Slack suggestions start off, and every workspace was reset to off on 6 October 2026. A workspace’s admins turn them on or off for everyone in it, on its AI page or in the app’s Home tab in Slack, and anyone in the workspace can see there whether they are on. Once they are, a message written in a channel the app has been invited to is first checked on our own servers. Detection reads English only, and a message without the shape of a promise in English is answered there and never leaves our servers. Most messages stop there. The rest are sent to ask one question: does this look like a promise? A message that mentions a password, a code, a card, an ID number or a date of birth isn’t sent at all. Only the author sees the suggestion, nothing exists until they confirm it, and a message that isn’t a promise is never stored. Each person also has a switch that turns every AI feature off for them, whatever the workspace has chosen, and a workspace’s admins can turn every AI feature off for everyone in it. Quick add sends the line you type, with a placeholder for each other person in your workspace and today’s date, so it can pick out a name and a date. A line you write to the app in Slack (by mentioning it, with its slash command or in its own conversation with you) is read the same way: that is quick add, so the AI switch governs it and the suggestions switch does not. The “Add to All My Ducks” message shortcut works whatever the suggestions switch says, because it only reads a message when you pick it. The optional draft, for moving a date, dropping something or saying no, sends the item’s description, a placeholder for the other person and any new date you proposed, and the draft comes back with the real names put back. Under Anthropic’s commercial terms none of it is used to train models, and Anthropic deletes it within 30 days unless it needs to keep it longer to enforce its usage policy or by law.

Before a Slack message, a quick add line or a draft’s details are sent, we swap what we can recognise for placeholders, and put the real values back in what Claude writes: the names of people the app knows, names a small name-finding model on our own servers spots in Slack messages, email addresses, phone and card numbers, ID numbers, dates of birth, street addresses, links, passwords and keys. It catches what it can recognise, not everything, so some personal details can still reach Claude.

We count AI use, never its words: each call adds to a daily count of calls, how much text went in and out, and cost, for the person, workspace, feature and model. Only our operators see those counts.

• Logs are structured and scrubbed of commitment and message content before they are written. Error reporting runs with personal data disabled.
• The database is backed up every day and each backup is kept for seven days; it can be restored to any moment in that week. A restore always goes to a new, separate database, never over the live one.
• Secrets such as API keys and the database password are held encrypted in our host’s configuration and given to the app when it runs; none live in the codebase or in built images.
• The full test suite, including every authorization boundary, runs before any change ships.

The services we rely on, and what each one receives, are listed in the privacy policy: DigitalOcean (hosting, in London), Cloudflare, Stripe, Anthropic, Postmark, Sentry, Slack if your workspace connects it, Google for sign-in and for notices to our phone apps (Firebase Cloud Messaging), and Apple for notices to our iPhone app.

You can export everything you can see, self-serve, and delete your account the same way. Both ask for your password, except that an account with no password deletes with a code we email it instead. The privacy policy sets out what we keep, why, and for how long.

If you believe you have found a security issue, email [email protected]. We read every report, reply within two working days, and will not take action against anyone reporting in good faith. Please give us a reasonable chance to fix a problem before sharing it publicly.