Privacy Policy

Last updated: 15 October 2026

The short version. Buck turns your study material into quizzes. To do that, the files, text and links you give Buck are sent to an AI provider to write questions. If you make an account, we store your profile and your study history so you can come back to it. We don't sell your data and we don't show ads.

Who we are

Buck the Duck ("Buck", "we", "us") is a study app that creates flashcards and quizzes from your learning material. If you have a question about this policy or your data, email hello@bucktheduck.site.

What we collect

Account details — your email address, password (stored hashed by our authentication provider), name, username, role (for example, student) and, if you choose, your school and a profile picture.
Study material you submit — PDFs, pasted text, web links and images (such as diagrams) you use to create StudyPacks, and the questions Buck generates from them.
Your activity — StudyPacks, quiz answers and scores, quiz history, calendar events and reminders you create.
Social features — friend connections, messages you send to other users, and live quiz rooms you create or join, including your name and score shown to other players.
Technical data — your IP address and basic request information (time, page, browser), which our hosting provider logs and which we use to rate-limit requests and prevent abuse.

Without an account (demo mode), your StudyPacks and settings are kept only in your browser's local storage and are not sent to our database.

How we use it

To generate questions, grade answers and read labels on diagrams.
To save your StudyPacks, history and settings to your account.
To run social features such as friends, messages and live rooms.
To keep the service secure, prevent abuse and fix problems.

We don't sell your personal information, use it for advertising, or use your material to train our own AI models.

Who we share it with

We use a small number of service providers to run Buck. They only get what they need to provide their service:

DeepSeek (AI provider) — receives the text and images you submit so it can write questions, grade answers and read diagrams. DeepSeek is based in the People's Republic of China, and data sent to it may be processed and stored there under its own privacy policy. Please don't upload material that contains sensitive personal information.
Supabase — hosts our database, authentication and file storage.
Vercel — hosts the website and server.
Upstash — stores short-lived request counters (keyed by account or IP address) used for rate limiting.
Google Fonts — serves the fonts used on our pages, which means your browser connects to Google.
Hipolabs Universities API — when you search for your school, the search text is sent to this public directory.

We may also disclose information if required by law, or to protect the safety of our users or the service.

Diagram images

Diagram images you upload to your account are stored at an unlisted web address so they load quickly. Anyone who has that exact address can view the image, so avoid uploading images you need to keep private.

Local storage

Buck uses your browser's local storage to remember things like your theme, demo progress and unsaved drafts. We don't use advertising or tracking cookies. Our sign-in provider stores a session token so you stay signed in.

How long we keep it

We keep your account data for as long as your account exists. Rate-limit counters expire within hours. Material sent to the AI provider is not stored by us beyond a temporary cache (up to 24 hours) used to avoid repeating identical requests. If you delete your account, we delete your profile and study data from our database within 30 days, except where we must keep it by law.

Your choices and rights

You can view and edit your profile in the app. You can ask us to access, correct, export or delete your personal data by emailing hello@bucktheduck.site. Depending on where you live, you may have further rights, including the right to object to or restrict processing and to complain to your local data protection authority.

Children

Buck is not intended for children under 13, and we don't knowingly collect personal information from them. If you are under the age of digital consent where you live, please use Buck with a parent's or guardian's permission. If you believe a child has given us personal information, contact us and we'll delete it.

Security

We use encrypted connections (HTTPS), access controls on our database and rate limiting to protect your information. No online service is perfectly secure, so please use a strong, unique password.

Changes to this policy

If we make material changes, we'll update the date above and, where appropriate, let you know in the app.