Privacy policy

1. Information we collect

• Account and waitlist details: your email address, your name if you give it, the plan you are interested in, and anything you write to us.
• Content you send through the Service: your instructions, conversation history, screenshots and the UI structure of your phone's screen captured while the agent works, run events, saved Flows, schedules and settings.
• Device information: phone model, Android version, connection state and the package names of apps the agent opens, as needed to operate the phone.
• Billing information: payments are handled by our third-party payment processor. We receive your plan, payment status, country, the last four digits of the card and transaction identifiers. We never receive or store your full card number.
• Technical data: IP address, browser type, pages visited, timestamps and error logs.
• Local storage: the website keeps your theme choice (light or dark) in your browser's local storage. We do not set advertising or tracking cookies.

2. What we deliberately do not keep

Text typed into password fields is never written into a Flow, and sensitive typed text is redacted from the conversation history. The agent never bypasses a PIN, pattern or password; when a person is needed, it stops and asks. A phone screen can show other people's personal information, so please do not run the agent on screens you are not allowed to process.

3. How we use information

We do not sell your personal information, and we do not use it for advertising profiles.

• To provide, operate and secure the Service, and to run the tasks you ask for.
• To process payments, manage subscriptions and prevent fraud.
• To answer your messages and give support.
• To send service notices, and, if you joined the waitlist, to tell you when DuckClick opens. You can unsubscribe at any time.
• To understand how the Service is used and to improve it.
• To comply with the law and enforce our terms.

4. Legal bases (EEA, UK)

Where the GDPR or UK GDPR applies, we rely on: performance of a contract (to provide the Service), our legitimate interests (security, fraud prevention, improving the Service), your consent (for example the waitlist, which you can withdraw), and legal obligation (tax and accounting).

5. Who we share information with

• AI model providers: to let the agent see and operate your phone, your instructions and screenshots are sent to the model provider you choose, or to the gateway you configure. Their terms and privacy policies govern what they do with it, so choose one you trust.
• Payment processor: to take payments and handle refunds and tax.
• Infrastructure, email and support providers that process data on our behalf under contract.
• Authorities or other parties when the law requires it, or to protect rights, safety and the Service.
• A successor, if we are involved in a merger, acquisition or sale of assets. We will tell you if your information is affected.

6. International transfers

We and our providers may process information in countries other than yours. Where required, we use safeguards such as standard contractual clauses.

7. Retention

• Conversations and their screenshots are kept until you delete them. Deleting a conversation also deletes its files, including the agent's own session copy.
• Account data is kept while your account is open. Billing records are kept as long as tax and accounting law requires.
• Waitlist emails are kept until we have told you about the launch or you unsubscribe.
• Server logs are kept for a limited period for security and debugging.

8. Security

We use encryption in transit, access controls and least-privilege access to protect information. API keys you enter are write-only in the console. No system is perfectly secure, so we cannot guarantee absolute security.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to our use of your information, to receive a copy of it, to withdraw consent, and to complain to your data protection authority. Residents of California can also ask what we collect and have it deleted or corrected, and we do not sell or share personal information for advertising. Residents of China have comparable rights under the Personal Information Protection Law.

To use any of these rights, write to us at the email address below. We may need to verify your identity, and we aim to reply within 30 days.

10. Children

The Service is not directed to anyone under 16, and we do not knowingly collect their information. If you believe a child has given us information, contact us and we will delete it.

11. Changes to this policy

We may update this policy. We will post the new version here with a new date, and tell you about material changes.

12. Contact

Questions or requests about privacy: use the email address on the Contact page.