Privacy Policy

Last updated: 2 October 2026

This policy explains what personal data Thunderduck Inc. (“Thunderduck”, “we”) collects when you visit thunderduck.ai, why we collect it, who we share it with, and the choices you have. It covers both thunderduck.ai and the Thunderduck platform — the console, API, and the connectors that expose it to AI assistants. Where your service agreement gives you stronger commitments, that agreement prevails.

Who we are

Thunderduck Inc., a Delaware corporation. For any privacy question, including a request to access or delete your data, email [email protected]. We are the controller of the personal data described here.

What we collect

• —Beta access requests. When you submit the form on our beta page we collect your first name, last name, email address and company name. We use these to assess and process your request and to email you about your account.
• —Contact enquiries. Our contact page links to a Google Form. Anything you submit there is collected by us through Google Forms.
• —Analytics and advertising data. Cookies and similar identifiers set by Google Analytics and Google Ads, together with your IP address, approximate location, device and browser characteristics, the pages you view, and which of our calls-to-action you click. We use these to measure traffic and to measure the performance of our advertising.
• —Anti-abuse signals. Our beta form is protected by Cloudflare Turnstile, which assesses whether a submission is automated. Cloudflare receives technical signals from your browser for that check.

We do not ask for special-category data, and we do not knowingly collect data from children.

Cookies, analytics and advertising

We load Google’s gtag.js on every page. It serves two purposes: Google Analytics 4 (property G-VNQD7SB5N5) for traffic measurement, and Google Ads (AW-18391776130) for conversion measurement and audiences. When you click one of our sign-up buttons, or successfully submit a beta request, we record that as an event so we can tell which campaigns produce genuine interest. Google may set and read cookies on your device to do this, and may use the data as described in how Google uses information from sites that use its services.

We also use AdRoll for retargeting — showing our ads to people who have already visited this site. AdRoll sets its own cookies and identifiers for that purpose. Unlike Google’s tags, which load in a restricted mode until you consent, the AdRoll pixel is not loaded at all unless you accept. See AdRoll’s privacy notice and their opt-out page.

Our web fonts are served from our own domain — they are bundled at build time, so loading a page makes no request to Google Fonts.

Your choices and how to opt out

• —Turn off personalised advertising in Google My Ad Center.
• —Block Google Analytics with the Google Analytics opt-out browser add-on.
• —Accept or decline analytics and advertising cookies in the banner shown on your first visit. Declining is honoured through Google Consent Mode: the tags load but store nothing on your device and advertising identifiers are redacted.
• —Opt out of AdRoll’s retargeting directly on their opt-out page.
• —Change your mind at any time with Cookie settings in the footer, which clears your stored choice and shows the banner again. You can also refuse or delete cookies in your browser settings. The site works without them; only measurement is affected.
• —Ask us to access, correct, export or delete your data, or to object to our processing, by emailing [email protected]. We respond within 30 days.

Who we share it with

We do not sell personal data. We share it only with providers who process it on our behalf: Google (analytics, advertising, and Google Forms), AdRoll (retargeting, only if you accept cookies), Cloudflare (bot protection and content delivery), and Amazon Web Services (hosting, in the us-east-1 region of the United States, with pages cached at CDN edge locations worldwide). These providers may process data outside your country; where that happens we rely on the transfer mechanisms in their terms, such as the EU Standard Contractual Clauses.

How long we keep it

Beta request details are kept for 180 days after your request is decided, unless you ask us to delete them sooner. Analytics data is retained for the period set on our Google Analytics property, after which Google deletes it; advertising identifiers expire according to Google’s own cookie lifetimes.

The Thunderduck platform

Thunderduck queries data that stays where it already lives. When you register a catalog — a PostgreSQL or MySQL database, BigQuery, an Iceberg catalog, or an object-storage bucket — we do not copy it into our systems. Queries execute against your source, and only the rows your query returns pass through the platform.

What we store on your behalf:

• —Account data. Your name, email address and company, held in our identity service. If you sign in with Google we receive your name, email address and profile picture from Google; we never receive your Google password.
• —Query history. The SQL text you submit, who submitted it, timings, CPU and memory used, row counts, and any error message. We use this to show you your own history, to enforce cost limits, and to diagnose failures.
• —Catalog metadata. Table and column names, row counts and sizes read from your sources so the console can show what you can query. This is structure, not content — metadata collection stores no rows.
• —Query results. Written to encrypted object storage so you can page through them, then deleted automatically after one day. A result you explicitly save is copied to separate storage and kept until you delete it.
• —Connection credentials. Held in AWS Secrets Manager, never in our database, and never returned by any API or connector tool. Our service accounts resolve them at the moment a query runs.

Where platform data lives and how it is protected

Everything runs in the us-east-1 region of the United States. Databases and object storage are encrypted at rest, all traffic is served over TLS, and every query, catalog and stored result is scoped to your company — cross-company access is blocked in the query layer itself, not only in the interface. Access to production is limited to Thunderduck staff who need it to operate and support the service.

AI assistants and connectors

If you connect Thunderduck to an AI assistant such as Claude or ChatGPT, that assistant sends your request to us and receives what the tool returns — which, for a query, means the rows themselves. Once returned, that data is handled by the assistant provider under their privacy policy, not ours, and may be retained in your conversation history there. Connector access is authenticated with OAuth and scoped by token: a read-only token cannot modify your data whatever the assistant asks. Grant only the scopes you need, and treat a shared catalog as visible to everyone it is shared with.

Row-level AI judging (jev)

Thunderduck can run SQL functions — jev(), jev_prob() and jev_choice() — that ask TypeSafe’s Jev model a plain-English question about a row, such as whether it describes an unhappy customer. This is different from every other processor on this page in two ways: it is off by default, and it sends the full contents of the row, not just schema metadata. Nothing reaches TypeSafe until you add your own API key under Settings → Environment and write a query that calls one of these functions yourself — at that point, the rows that query matches are sent to TypeSafe under your own account with them, governed by TypeSafe’s own privacy policy, not ours. Use it only on rows you are comfortable sharing with TypeSafe, the same judgment you would apply before pasting a row into any third-party tool.

Bring your own Anthropic key

The schema-metadata inference above runs through Thunderduck’s own Anthropic account by default. Some companies consider their table and column names sensitive in their own right — not customer data, but still something they would rather not route through a shared account. Set your own ANTHROPIC_API_KEY under Settings → Environment (we verify it works before saving it) and your account’s column descriptions are inferred through your own Anthropic account and agreement instead. What is sent is identical either way — schema metadata only, never data values — this only changes whose account and agreement with Anthropic governs it for you. Unlike the jev section above, this introduces no new third party: Anthropic already processes this metadata for every account.

How long we keep platform data

• —Query results: one day, automatically. Results you save: until you delete them.
• —Query history and catalog metadata: for the life of your account, so history and cost reporting stay meaningful. Ask us and we will delete it sooner.
• —Account and credential data: deleted within 30 days of your account closing. Removing a catalog deletes its stored credentials immediately.

Who processes platform data

Amazon Web Services (hosting, databases, object storage and secrets, all in us-east-1), Cloudflare (TLS termination and the tunnel that fronts the service), Google (only if you choose Google sign-in), Mailgun (transactional email such as invitations), Anthropic (schema metadata — table and column names and types — to infer what your columns mean; no data values are sent; you may route this through your own Anthropic account instead — see below), and TypeSafe (row contents, only if you configure your own API key and call jev()/jev_prob()/jev_choice() — see below). We do not sell personal data, and we do not use your query data or your customers’ data to train models.

Legal basis

This policy and our handling of your data are governed by the laws of the State of Delaware, United States. That choice of law does not remove rights you have where you live: if you are in the EU or UK, the GDPR or UK GDPR still applies to this processing, and we rely on your consent for analytics and advertising cookies, on our legitimate interest in preventing abuse of our forms, and on the steps necessary to enter into a contract when you request beta access. Residents of US states with privacy statutes may exercise their rights through the same contact address below.

Changes

If we change this policy we will update the date above. Material changes will be announced on this page.