Can I trust DuckDuckGo, optional Duck.ai?

Trust checks

• Secure by Design

  ● Strong

  Strong security foundation

  Why this result

  This check looks for security issues at high severity or above in the code of this build, and none were recorded. Its scope covers stored credentials, how the app protects data on the device, and how it protects data in transit.

• Data Minimization

  ● Strong

  Tracking done right

  Why this result

  The check looks at analytics and attribution code for companies other than the developer: the data it reads, the companies named in code as recipients, and whether a consent step runs before that code. In this build, either no such code was recorded, or a consent step runs before it and the app's own disclosures describe the collection.

  The app contains no third-party analytics, advertising, or attribution SDKs. All usage telemetry is handled by DuckDuckGo's own internal system, which includes code to send anonymous, non-linked behavioral counts to a DuckDuckGo-controlled server. No personal identifiers, search queries, or browsing history are included in these events. The app does not use the advertising identifier or any vendor identifier. The privacy tracking flag is declared as false, and no tracking domains are listed. There is no evidence of data collection that occurs before a user takes an action.

• Manifest Mismatch

  ◐ One criterion not met

  Disclosure incomplete or contradicted

  Why this result

  The check compares the app's privacy disclosures against what the code does, and at least one claim did not match in this build. Mismatches of this kind include a data category collected but not disclosed, a recipient the disclosure omits, and an identifier attached to data the disclosure describes as anonymous.

• User Control

  ● Strong

  No lock-in

  Why this result

  The check looks for a way to export the data an account has accumulated and a way to delete the account itself. In this build, either both were found, or the app has no account of its own and keeps its data on the device. For an app without an account, the developer has no server-side copy to export or delete, and deleting the app removes the data in its own storage.

  Browsing history, bookmarks, passwords, and browser settings are stored locally on the device. The Fire Button feature permanently wipes all local browsing data on demand. The password vault stores credentials in a format the user controls on their own device. Account credentials and authentication state are removed from the device when an account is removed. There is no evidence of proprietary data formats that would trap user content or of artificial barriers to stopping use of the app.

What the app contains

• 6 services

  Third-party services the scan names in the build:

  • GRDB
  • Lottie
  • JWTKit
  • ZIPFoundation
  • Kingfisher
  • Gzip

Method and limits

Static analysis: the decompiled code, manifest and resources of this build, read file by file. Network traffic at run time is established by a capture of the running app.

Files decompiled

38

Scan date

10 September 2026

Corrections

No correction is published for this app.