Overview
DuckDisk is a local-first, open-source macOS application operated by Qi Yang. DuckDisk does not operate a server that receives your disk scan results, cloud file metadata, or OAuth credentials.
Data DuckDisk accesses
- Local and SSH file metadata, including names, paths, sizes, types, and folder relationships.
- OneDrive and Google Drive account details such as display name, email address, account identifier, and storage quota.
- Cloud file metadata such as item identifiers, names, sizes, MIME types, parent relationships, and trash state.
- OAuth refresh tokens needed to reconnect to a cloud account.
Google's full Drive permission is required to move arbitrary existing user-selected files and folders to Google Drive Trash. DuckDisk uses that permission only to read metadata and perform Trash actions that the user explicitly starts. DuckDisk does not download cloud file contents to calculate storage usage.
How data is used and stored
Metadata is used only to build the storage tree, calculate totals, update cached results, and perform actions you explicitly request. OAuth refresh tokens are stored in macOS Keychain. Scan indexes and connected-account records are stored locally on your Mac.
Data protection and security
- OAuth refresh tokens, saved SSH passwords, and private keys selected in the Mac App Store version are stored in macOS Keychain, which applies macOS encryption and access controls. DuckDisk does not write these credentials to its scan cache or connection files.
- Google Drive and OneDrive requests are sent directly from DuckDisk to the providers' HTTPS endpoints using TLS. SSH connections use the encrypted SSH protocol.
- OAuth access tokens are short-lived, used only in memory for provider requests, and are not included in DuckDisk logs or scan caches.
- Scan metadata and account records stay in DuckDisk's application data under the current macOS user account and are protected by the account's standard macOS file permissions. DuckDisk does not upload this local data to a DuckDisk-operated server.
- Users can clear scan caches, disconnect cloud accounts, and revoke Google authorization. These actions remove the associated local metadata and saved DuckDisk credential, as described below.
No security measure can guarantee absolute protection. Users should keep macOS updated, protect their login account, and install DuckDisk only from the official release page.
Cloud actions
When you choose to remove an item, DuckDisk asks Microsoft OneDrive or Google Drive to move that item to the provider's recoverable trash. DuckDisk does not permanently empty provider trash. No cloud item is changed without a user-initiated action.
SSH removal is different: when you explicitly confirm a remote deletion, DuckDisk asks the configured SSH server to permanently delete the selected item. The app restricts this operation to the configured remote root and refuses to delete that root itself, but the remote server may not provide a recoverable trash.
Sharing and selling
DuckDisk does not sell personal data, use cloud account data for advertising, or share scan data with data brokers. Requests are sent directly from the app to Microsoft, Google, or the SSH server you configured. Those providers process requests under their own privacy policies.
Google API data
DuckDisk's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. Google Workspace API data is not used to develop, improve, or train generalized or non-personalized artificial intelligence or machine-learning models.
Retention and deletion
Local scan caches remain until you clean the cache, disconnect the account, uninstall and remove DuckDisk's application data, or replace them with a new scan. Revoking Google Drive access from DuckDisk invalidates the saved Google token and removes that account and its cache from the Mac.
Website and updates
The DuckDisk website does not include DuckDisk-operated analytics or advertising trackers. The hosting provider and GitHub may process standard connection logs under their own policies. The app contacts GitHub only when you request an update check.
Contact
Questions or privacy requests can be sent to [email protected] or filed through the DuckDisk issue tracker.