På svenska · This policy is published in English and Swedish. Both versions apply; if they differ, the Swedish version prevails.

OneDuck · Privacy

What we store, and why.

OneDuck is an app where you use, build and share small apps, with Agenda (calendar and tasks) as one of the official apps. This policy explains what information about you we handle, why, who receives it and how long we keep it. In short: we store what is needed for the apps and their social features to work. We do not sell any data and we do not show ads.

Who is responsible

Nordic Duck AB (Swedish company reg. no. 559606-7693), Sturegatan 4b, 753 14 Uppsala, Sweden, is the data controller. Questions about your data: [email protected].

Account

You create an account and sign in with Apple in the iPhone app, and with Google or a code by email on the web, at id.oneduck.app. With Apple, we receive an identifier from Apple and, the first time, your name and an email address (which may be Apple’s private relay address). With Google, we store only your Google identifier, your name and your email address, and Google learns that you sign in with us. Signing in with Google does not connect your calendar; you do that separately. With email, we send a code to the address, and that address becomes your sign-in. You can also add an address from your phone, under Account → Email for the web. The address then gets a code that you enter in the app, and a receipt with your username once it is linked. We also store the username you choose, your country, which version of the terms you accepted and when, and the age you confirmed when you created your account on the web or when an app with an age limit or the question about contributions asked for it. Your sign-in and the codes are stored only as hashes, never as the token or the code itself. To stop abuse, we store a keyed hash of your IP address for 24 hours when someone asks for a code, never the address itself.

Calendars

When you connect Google or Microsoft, we store access tokens, encrypted, and a copy of your calendars and events: name, colour, title, time, location and your response to invitations. Google and Microsoft include descriptions and attendee lists, but we never store them. The copy is needed for the app to be fast and to work out when you are free. The app only writes to your calendars when you ask it to: when you add, change or delete an event, or when you turn on a sync. A sync writes its own, labelled events into the calendar you choose or sends them as invitations to the address you enter, and you choose whether they only show that you are busy or also the title and location.

OneDuck’s use and transfer to any other app of information received from Google APIs (calendars, tasks, and the name and email address from signing in with Google) will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use data from Google, or other calendar and task data, for advertising, do not sell it and do not allow it to be used to train AI models.

Tasks

Tasks you create only in OneDuck are stored on our server. If you have connected Google or Microsoft and given the app access to tasks, we also store a copy of your lists in Google Tasks and Microsoft To Do: the list’s name and each task’s title, notes, due date and whether it is completed. If you change such a task in OneDuck, we write the change to Google or Microsoft. The copy is updated about every five minutes and is deleted when you disconnect the account.

Apps and what you add

What you save in apps, photos you take or choose in an app, and what an app shows in a widget are stored on our server so that you can use them from your phone and on the web. Only you can see your private data. What you add to a group’s or community’s app can be seen by the people in it. Photos are stored with Cloudflare. A photo taken only to look something up is deleted after 24 hours unless the app keeps it.

An app about health or something else sensitive, such as religion or politics, first asks whether it may store such information with us. If you say yes, it is used only for the app and can be seen only by you and the people you choose among your friends and groups, never by strangers. The app may only fetch information from services we have reviewed, and anything is sent to them or to AI only if you specifically say yes to that. If you withdraw your yes, what the app has stored is deleted. Apps about your finances are likewise shared only with friends and groups.

Building apps

When you build or change an app, we store the conversation: what you write and the replies. To build the app, what you write is sent to OpenAI, together with your name, the names of the people in the group the app is being built for and a few short examples from the data already there, so that the new app fits with it.

Voice

What you say is turned into text on your phone. When you choose Tolka (Interpret), the text is sent to our server and on to OpenAI, which turns it into suggestions. You decide what is saved. We do not store the text, only how many times the feature is used.

AI in apps

Apps can ask an AI model for suggestions, summaries and the like. The first time, we ask you. If you say yes, what the app includes in the request, such as text, data the app has access to or a photo, is sent to OpenAI or, if the app uses it, Anthropic. We store how much AI is used, not the request, but the app may save the answer. You can change your answer in the app’s settings.

An app that can see your calendar can never send anything to other services. If you also turn on AI in that app, the question says that your calendar events may be sent to the AI service. They are used only to answer you and never to train models.

Other services in apps

An app can fetch information from another service, such as weather or timetables. The first time, we ask you. What you search for is then sent to that service from our server, not from your phone.

You can also connect your own accounts with the services OneDuck supports, such as Spotify or Strava, and choose which ones yourself. You then sign in with that service, and we store the keys, encrypted, together with your name at that service. An app may use the account only if you say yes, and only while you are using the app. You can see which accounts you have connected, and disconnect them, under Account. That service’s own terms and privacy policy apply to what happens there.

Notifications

Notifications to an iPhone always go through Apple’s notification service. If you allow notifications, we therefore store your phone’s notification address, and notifications you receive, including ones that someone in your group has scheduled, are sent to Apple with their title and text so that Apple can deliver them.

Apps on the web

An app can also be opened in a web browser, at its own address on oneduck.site (for example matlistan.oneduck.site), by the people its owner has let in: only the owner, chosen friends or a group. Each time someone is let into an app or turned away, we record which app it was, who it was if they were signed in, when, and what happened. We keep this for 30 days so that we can detect attempts to break in and sort out errors. Only we see it, never the app’s owner, and in that log we never record your IP address, your browser or what you do in the app.

If someone invites you with a link, you become friends in OneDuck when you join, and the person who invited you sees that you have joined. The app’s owner sees who has been let into the app on the web, how and when they got in and who invited them, but never when they use the app. If someone signs in to your account on the web, we tell you which kind of browser it was (for example Chrome on Windows), and under Account you can see where you are signed in, so that you can sign out everywhere if it wasn’t you. The email with a code also says which kind of browser asked for it and when.

Apps that may see your calendar can also be opened on the web. There they show your events, and what others share with you from their calendars at the level they chose, only after you have signed in. In the browser, too, such an app can never send anything to other services or open links. You still connect your calendar in the iPhone app.

Friends, groups and communities

Others can find you by name, username or exact email address, and then see only your name and username, never your email. Others can see your calendar and your private data only if you share them yourself, and then at the level you choose, for example only that you are busy. You only share your own calendars, never ones others have shared with you, and a linked work calendar only as busy. If an app wants to count what you add outside the group, for example in leaderboards or statistics by country, we ask first, and you choose whether to take part anonymously, with your name or publicly. Anonymous statistics are never shown for fewer than three people. If you publish an app, your name is shown as its creator.

In a community, an app that everyone who added it uses together, what you do is never shared just because you take part. The first time something can be shown to others, for example a film rating, the app asks whether your friends there may see it: all your friends, only the people you choose (friends or whole groups), ask every time, or not at all. The answer applies to that app and that kind of content until you change it in the app's settings, and you can hide each item afterwards. Others in the community see your name only if you are friends, and if you block someone you no longer see each other's content. What you add is also counted anonymously in the app's shared averages and top lists (for example “Popular in Filmkväll”), including what you show nobody. Nobody can see what you in particular gave, an average is shown only once at least three people have contributed, and you can stop being counted in the app's settings.

A group can have a shared calendar. What you add there, with title, time, place, who takes part and a short note, is stored with us, not with Google or Microsoft, and only the group can see it. We do nothing else with it. Everyone in the group can change and delete events. A deleted event can be restored for 30 days and is then deleted. Anyone who wants to can copy the group’s events to their own Google or Outlook calendar, but never the note or the comments. The group sees who does, and an event marked “Don’t copy” stays with us. The people taking part in an event get a notification when it changes. If you leave the group, what you added stays for the others, without your name.

Suggestions on Home

The first time you open Home, we ask whether Home should learn what you use. If you say yes, OneDuck records which apps and features you use and when, for example that you open an app around lunchtime on weekdays. We also record which suggestions Home showed, where and why, what you did with them and what you change in My Home. Suggestions may also be based on what is current in your apps, on when you are busy according to your own calendars, on due dates for your tasks, on changes others have made in apps you share (for example “Elin changed the shopping list”, only if you can see the change yourself) and on apps you have just added. Sometimes Home shows something it is unsure of, in order to learn. We never record the content: no titles, texts or notes, and the calendar only as busy or free. Apps about health and other sensitive matters are suggested only if you choose so yourself.

This information is kept for 60 days. It is used for your suggestions in OneDuck, later on to send reminders at the right time, and as totals that include at least five people to make suggestions better for everyone. Data from Google and Microsoft is used only for your own suggestions, never in totals. For every suggestion you can see why it is shown. If you say no, Home shows only what the apps themselves say is current. We then record nothing, and you are not named in other people’s suggestions either. You can change your mind under Account → Anpassa efter hur jag använder appar (Personalize based on how I use apps). If you turn it off, we delete what we have stored.

Location and weather

If you allow location, Home and the Weather app show the weather where you are. Your phone then sends only roughly where you are, rounded to a square of about 11 × 6 kilometres, to our server, which fetches the forecast from the Norwegian Meteorological Institute (MET Norway). The institute gets only the square, never who is asking, and we never store where you are. Places you save in Weather stay on your phone and are sent the same way when you look at them. What Weather learns from your answers about clothes stays on your phone too. You turn it off by hiding the weather on Home, under ••• in Weather, or in the iPhone’s settings for OneDuck.

An app that asks for your location, on the phone or in the browser, gets it only while you use the app and only if you say yes. In the browser, the browser asks too, and you can take back the permission for the app’s address there. If the app saves it, the same rules apply as for anything else you add.

Recommendations

To suggest films, series and other things you may like, OneDuck records which suggestions an app showed you and what you did with them: that a suggestion was shown, where in the list, which signals were behind it and what kind of reason was shown, and whether you opened the title, saved it, voted, marked it as seen, rated it or chose Inte intresserad (Not interested). This is stored as ids and numbers, never as text or names. When you plan a film night, the other participants are recorded only as a keyed code, not by name or account. We use it only to improve your own suggestions and OneDuck’s recommendations, never for advertising, and we do not hand it to anyone else. What you do only affects your own suggestions, never what others see about you, and we draw no conclusions about sensitive matters such as health, politics or religion. The information is kept for 60 days; after that only anonymous daily totals per app remain (for example how often a kind of reason led someone to open the title), and only where at least five people are included. It follows the same setting as the suggestions on Home: if you turn off Account → Anpassa efter hur jag använder appar, we delete what we have stored about you. Titles you marked Not interested are kept in the app as your own data until you undo it.

Once enough people have rated, your ratings also help others get better suggestions, anonymously: we work out that people who liked one film often also liked another, and such a link is used only once at least five people are behind it. Nobody learns that you in particular liked something, and suggestions never say they come from someone like you. You turn this off with the same choice as being counted in the app’s averages, in the app’s settings.

Contributions that improve apps

An app may ask to use what you correct, for example a photo of a parking sign and what the sign actually says, so that it gets better at recognising such things. You can also ask for this yourself. It is always voluntary and asked separately, by OneDuck and not by the app, and the question shows what the contributions will be used for. If you say no, the app works exactly as before. You can answer yes always, be asked every time, or no, and we ask again after a year. We only ask people aged 18 or older.

A contribution is a copy, not your own data, and contains only what the app has declared: what you corrected and, if the app says so, the photo. The photo is cropped to what is to be recognised. We remove location data and other information the camera put in the photo and blur people and licence plates. Photos where a person is clearly visible are not sent at all. The copy is stored without any link to your account and with the date only, not the time. Instead, your phone gets a receipt for each contribution, kept in your iCloud Keychain. Contributions can only be about things, never about you or other people, and never contain health or other sensitive data, free text, or data from your calendars and task lists at Google and Microsoft.

OneDuck receives the contributions, trains the models and is responsible for them, also for apps built by others. The app’s creator never sees the contributions or what the model contains. Contributions are stored with Cloudflare within the EU and trained on OneDuck’s own servers within the EU. We never sell contributions and use them only for the purpose stated in the question.

You remove your contributions, one at a time or all of them, in the app’s settings under Contributions (Bidrag). A removed contribution is deleted within a couple of hours and is not used when the next model is trained. A model that has already been trained may be used until the next version exists, and we retrain within 12 months at the latest. Because contributions are not linked to your account, we can only find them through the receipts: if you lose both your phone and your iCloud Keychain, we can no longer tell which contributions were yours. Contributions are kept until removed, at most three years.

If you appear in someone else’s contribution, for example because you walked past while someone photographed a sign, you can ask us to remove it: write to [email protected] and tell us which app, roughly where and on which day. We look through the contributions from there and remove what may show you. We never search with face recognition.

Reports and feedback

If you report an app, we store the report and what you wrote, and whom you have blocked. A block means that you cannot find each other or send each other new friend requests, and that new apps from the blocked account are not shown to you. Feedback you send in the app is stored with your account so that we can reply.

The waitlist

If you leave your email on oneduck.app, we store it and add it as a tester with Apple (TestFlight), which emails you an invitation. To stop mass sign-ups, we store a keyed hash of your IP address for 24 hours, never the address itself.

Cookies

On the web, we use only the cookies needed for you to sign in and open apps: one that keeps you signed in at id.oneduck.app, one on each app’s address that shows you may open it, and a few that exist only while you sign in and protect the sign-in, for example by tying a code to the browser that asked for it. When you create an account, one of them also holds your email address, and with Google your name, for at most ten minutes until the account is created. If you tick “Remember me”, you stay signed in for 30 days; otherwise until you close the browser, and at most twelve hours. Apps can store settings in the browser, and they are deleted when you sign out. We use no cookies or scripts for statistics or advertising, which is why we don’t need to ask about cookies.

Why we may process your data

Who receives your data

We share data only with the services needed to do what you asked for:

Several of them are US companies. Transfers to the US are protected by the EU–US Data Privacy Framework where the company is certified under it, and otherwise by the European Commission’s standard contractual clauses.

How long we keep data

Deleting

In the app or on the web, at id.oneduck.app: Account → Delete account (Konto → Radera konto). We then delete your account, your calendar copies and tokens, your private data and photos, your apps and your syncs, and we revoke our access at Google. For Microsoft we delete the tokens; you can also remove the app at account.live.com/consent/Manage. What you have added to a shared group or community remains for the others, without your name, and copies that others have made of your apps remain. Contributions that improve apps are not linked to your account, so the app first withdraws them with the receipts on your phone. If that is not possible, they stay without any link to you until you withdraw them or they are deleted after at most three years.

Your rights

You have the right to know what data we hold about you and to get a copy, to have errors corrected, to have data erased, to receive your data in a machine-readable format, to object to processing based on legitimate interest, to restrict processing and to withdraw your consent. Contact [email protected]. If you think we are handling your data wrongly, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), imy.se.

Children and age limits

You must be at least 13 years old to use OneDuck. If you create your account on the web, you confirm this then. Apps with a higher age limit, for example 18 for apps about alcohol, ask you to confirm your age first.

Automated decisions

We make no decisions about you based solely on automated processing that have legal or similarly significant effects. AI only gives suggestions that you choose whether to use.

Contact

Questions about your data: [email protected]. The rules for using OneDuck are in the Terms of Service.

Last updated 4 November 2026.