Privacy
Your files stay on your device.
This page explains, precisely, what Duck Tools does and does not do with your data. Short version: we never receive it.
What we don’t do
- No file uploads. There is no file-upload endpoint on duck.tools. Local tools process images and text inside your browser tab. Domain Availability, DNS Lookup and IP Network are the exception: they send the name or address you type to our servers so we can ask the registry, a public resolver or a RIR.
- No tracking cookies. We do not set analytics or advertising cookies. If you sign in, we set one first-party session cookie so we remember you. That is why there is no cookie banner.
- No analytics or ad scripts. No third-party trackers are loaded on ordinary pages. Opening sign-in loads Cloudflare Turnstile so we can tell people from bots.
- Accounts are optional. Tools work without one. If you sign in we store your email and send a one-time sign-in link; we do not use a password.
What does use the network
We would rather be exact than make claims that sound better than they are:
- Pages, scripts, styles and fonts are downloaded from duck.tools like any website. Our web server writes standard access logs (IP address, requested URL, user agent), which are used only for operating the service.
- Duck Tools sits behind Cloudflare, which routes traffic to our server and applies its own network-level protections. SeeCloudflare’s privacy policy.
- AI tools download a model on first use. The AI Background Remover fetches the open-source BEN2 model weights from Hugging Face and the ONNX runtime from duck.tools, then caches them in your browser. Your image is not part of that request — it never leaves your device.
- Domain Availability posts the name you type to
/api/domainson duck.tools. We query CentralNic (and Namecheap when configured) for availability, and public RDAP/WHOIS plus the homepage for taken names. Fresh WHOIS is cached so repeats are fast, and capped with a daily quota. Buy now opens Namecheap; we may earn a commission if you register there. The endpoint refuses other origins, requires a short-lived session token, and cannot be embedded as a free reseller API. - DNS Lookup posts the host you type to the same
/api/domainsAPI. We resolve records via Cloudflare DNS over HTTPS, probe common hostnames, and reverse-lookup discovered IPs. Repeats are cached briefly. Other sites cannot embed this endpoint. - IP Network posts the address you type to the same
/api/domainsAPI. We query the regional registry via RDAP and port-43 WHOIS, and Cloudflare DNS for the reverse name. Fresh WHOIS is cached and shares the daily quota. Other sites cannot embed this endpoint. - Currency Converter posts the currencies you pick to
/api/currency. We fetch public daily rates from the exchange-api CDN (jsDelivr, with a Cloudflare Pages fallback), cache them, and draw charts from sampled daily closes. Other sites cannot embed this endpoint. - External Tools loads the curated list from
/api/links. Favicons are requested from DuckDuckGo’s icon service using the hostname only. A suggestion stores the name, URL and the email you signed in with. We do not fetch the destination page. Other sites cannot embed this endpoint. - Sign-in posts your email to
/api/auth. We check Cloudflare Turnstile, email a one-time sign-in link via SMTP2GO, and set a session cookie when that link is confirmed. We keep the email and a hashed session. Links work once and expire in ten minutes. The secret in the link is stored as a hash, so guessing it is not practical.
We don’t claim the site works offline. Once a tool’s code (and, for AI, its model) is cached, it will often keep working without a connection, but we haven’t engineered for that yet.
How to check
Open your browser’s developer tools, switch to the Network tab and use a local tool. You will see requests for scripts and (for AI) model files, and none carrying your image or text. Domain Availability, DNS Lookup and IP Network are different: you will see/api/domains requests that include the name or address you typed. External Tools shows/api/links and favicon requests to DuckDuckGo. Sign-in shows/api/auth and a Turnstile request to Cloudflare.
Changes
New server-side tools are labelled Server on the card and page, explain exactly what is sent, and are added here first. Domain Availability, DNS Lookup, IP Network, External Tools and Currency Converter are those tools today.