DuckCarryBuilt to be trusted.
Your photos stay on your computer. Here is what leaves it, who handles it, and which certifications those providers hold.
Stays on this computer
Photos go from your phone to your own folders and drives, by cable or a direct connection to your paired computer. They are never uploaded to us or to a cloud service.
GDPR
Your photos are processed on this computer. Error reports use legitimate interest; you can turn optional diagnostics off.
California privacy (CCPA/CPRA)
We do not sell or share your personal information.
HIPAA: local processing
Your photos never reach us, so we do not receive or store protected health information (PHI). Your organization stays responsible for its HIPAA compliance; we do not sign Business Associate Agreements.
Sentry: ISO 27001 and SOC 2 Type 2
Error reports are processed by Sentry, which holds these certifications.
Where you buy
Payments by Lemon Squeezy and Stripe
Website purchases are handled by Lemon Squeezy, a Stripe company and the merchant of record; payments run on Stripe's PCI DSS Level 1 certified infrastructure. We never see your card.
Mac App Store
If you buy the Mac App Store edition, Apple handles the purchase, payment and refunds.
Microsoft Store
If you buy the Microsoft Store edition, Microsoft handles the purchase, payment and refunds.
Your data
The DuckCarry desktop app copies photos and videos from your phone to folders you choose and checks them there. Its copy history, settings and thumbnails are stored on your computer. It does not upload your photos, videos or their locations to us or to any cloud service. The app goes online only to activate and check a license, to load map tiles from CARTO and OpenStreetMap when you open a map, to send error reports and, while you have Remote transfer turned on, to register this computer with the DuckCarry pairing service and set up direct connections with your paired phones.
Originals are the reference
Files arrive under temporary names, are checked with BLAKE3, and are read back from disk. Existing destination files are not overwritten. Converted photos and videos do not count as original copies.
A backup gets its own check
If you ask for a second copy, it is verified independently. A missing or changed required backup prevents the corresponding originals from becoming eligible for removal.
A deliberate removal
DuckCarry checks current originals again before supported removal. Two confirmations are required. A Live Photo needs both halves. Recently Deleted is never emptied by the app.
A paired local connection
Wi-Fi sharing is optional. Compare the temporary certificate fingerprint on your phone before entering the pairing code. Only selected files are sent. Received inboxes cannot remove anything from the phone.
Phone app: account and pairing
The phone app signs in to a DuckCarry account. Our servers keep the account, the list of paired devices and the messages that set up a connection. Each computer is approved on the computer and confirmed with the same six-digit code on both screens. Photos, videos, thumbnails and file names travel only over the direct encrypted connection, never through our servers or a relay.
Clear limits
System codecs, device access and direct connections depend on your computer, phone and network. Unprivileged Windows directory flushes can be unsupported. No software can promise immunity to hardware failure; keep an independent backup.
Privacy laws
GDPR and UK GDPR: error reports rely on our legitimate interest in keeping the app stable and secure. You can object by turning Send diagnostics off; crash reports stay on because we need them to fix crashes. Reports are transferred to the USA under Standard Contractual Clauses.
California (CCPA/CPRA): we do not sell or share your personal information, and your photo library is never used for advertising.
The full notices
Health data (HIPAA)
DuckCarry copies and checks photos on your computer; your photos never reach us. That means we do not receive or store protected health information (PHI) from them. If your organization is covered by HIPAA, it stays responsible for its own HIPAA compliance, and we do not sign Business Associate Agreements (BAAs).
Error reports
To find and fix problems, the app sends error reports to Sentry (Functional Software, Inc., USA). A report holds the error type and message with your home folder, user name and paths removed, the stack trace, the app version, the operating system, the computer model and a random installation identifier. It reaches Sentry with the IP address of the computer that sends it, and Sentry may store that address. Reports never contain your photos, videos, the names of your files, folders or phones, or your license key.
Crash reports are always sent. Other error details and logs are sent only while Settings > Photos & privacy > Send diagnostics is on; it is on by default and you can turn it off at any time.
Sentry holds ISO 27001 and SOC 2 Type 2 certifications for its service. Sentry Trust Center
Payments
Licenses bought on this website are sold by Lemon Squeezy, our reseller and merchant of record. Lemon Squeezy takes the payment and builds PCI DSS compliance into every sale; we never see your card number.
If you buy the Mac App Store edition, Apple handles the purchase, payment and refunds. If you buy the Microsoft Store edition, Microsoft handles the purchase, payment and refunds.
Open-source components
DuckCarry contains open-source software under its own licenses, listed in Settings > Legal > Third-party licenses. Those licenses apply to those components.
Report a security concern
Use the security contact channel. Describe how to reproduce the issue with generated test files. Please do not include personal photos, passwords or license keys.
You can also write to our security address. Our security.txt file lists the same contact. · /.well-known/security.txt
Contact security