The short version: we collect as little as the product allows, we don't run ad trackers, and below we list every place your study text goes and how long we keep it. The services we send it to keep it under their own policies, which the table below names.
Last updated: September 29, 2026
What Ask Mallard is. An app that provides a biostatistics consult and a library of calculators for clinicians, trainees, and health researchers. It helps you plan and interpret research methods. It is not a medical device, does not process patient records, and is not a substitute for a qualified statistician, your IRB, or clinical judgment. Ask Mallard is operated by Ask Mallard LLC, a California limited liability company, whose mailing address is 2108 N St, Ste N, Sacramento, CA 95816 ("we," "us," or "our"). Ask Mallard LLC is responsible for the personal information described in this notice.
Your browser's local storage holds your theme preference and tier selection, your name and email address when you are signed in, your analytics choice, and, if you have one, the token that unlocks Pro on this device. While a plan is generating it also holds the request you sent, your study description included, so the plan can be picked up again if you reload or close the tab. It is removed when the plan arrives; if you close the tab first, it stays in your browser until you next open the app, which removes it once it is more than 30 minutes old. Clearing your browser data removes all of it.
Signed out, nothing you generate is saved. A library that lives in one browser is a promise we cannot keep — it does not survive a cleared cache or a second device — so we no longer keep one. If a plan from an earlier version of the app is still in your browser, it is still there and still exportable: the Saved tab shows it, marks it as stored on that device only and not kept, and offers a button to remove it. Nothing new is written.
So your work can follow you across devices, when you are signed in the studies you work on are stored on our server (via Netlify) keyed to your account, and synced to the devices where you sign in. Saving is automatic and there is no Save button to forget.
A study is saved from the moment you ask for a design brief, not only when a plan is finished. We write the record at four points: when your description is accepted and the brief starts, when the brief is ready, when the full plan is generated, and again each time you generate a new brief or plan for the same study. That means a brief you never turn into a plan is still yours — it is a decision you made about your study, and it used to exist only in the tab that produced it. Records for one study are grouped together as versions of it.
A saved study includes the study description you typed, and the design brief and plan hold whatever you described. Your library lists studies by their description and uses it to group versions together, so the description is stored with the record and kept for as long as the record is. It is also kept in the generation recovery record described under How long we keep your plans, for up to 12 months from generation. Deleting the study removes the copy saved with it; deleting your account removes both.
How many we keep. A free account keeps one completed plan; a study still at the brief stage is held beside it and only takes that place once its plan is generated, so trying a second study can never remove the plan you already spent a credit on — and when it is about to, the app tells you and asks first. Pro keeps 40 studies, and up to 24 versions of any one of them. If a Pro subscription ends, nothing you have is deleted. Updating, revising or re-exporting anything you already hold removes nothing at all, however far over the new limit you are; the limit applies only to what you add next, and generating a new plan then replaces the least recently used one — named, and only after you say so.
We also keep simple counters of how many plans you have generated and how many design briefs you have run, to enforce plan and brief limits and to show your remaining plan credits. You can remove saved studies from the Saved tab, or delete your account to remove them (see Your choices, below).
How long we keep your plans. Saved studies, briefs included, are kept for 12 months from the last time you generated or revised them, then deleted. We email you before that happens — roughly a month ahead and again about a week ahead — so nothing disappears without notice, and a plan is not deleted until its final warning has actually been sent; revising a plan resets its clock, and any plan you export (Word, code pack, or PDF) is yours to keep regardless. Generation recovery records include your study description, saved inputs and generated output. They let you recover a paid result from credit activity even if you closed the browser or your library was full. These records are retained for up to 12 months from generation and then removed; export results you wish to keep. Account deletion removes these recovery records too. If generation is still running, deletion waits until it finishes; new generation is blocked once deletion begins.
Signing in is optional; you can use the free tier without an account. If you choose to sign in, authentication is handled by Clerk, our identity provider. Depending on the method you pick (Google or an email link), Clerk receives and stores your email address and basic profile identifiers to create and secure your account. Your subscription status (free or Pro) is stored on your Clerk account so it follows you across devices. We do not receive or store your social-login password. Clerk processes this data under its own privacy terms.
The Consult feature sends the study description you type to AI models to generate a plan. Your text goes to an Ask Mallard serverless function, which queues it for generation and returns the result to you. The request, your description included, is then kept as a generation recovery record for up to 12 months from generation (see How long we keep your plans), alongside the copy saved with your study.
Before anything is sent, the app checks your description for identifiers such as labelled patient names, record numbers, dates of birth, phone numbers and street addresses. Text from an uploaded file has them removed as it is read. When you ask for a design brief, a plan or a step of a plan, the app shows which kinds it found and offers to remove them, and sends nothing until you choose. Reviewer comments, and details you add to a plan afterwards, are checked the same way, and nothing is sent while they carry an identifier. The quick check of whether your description is complete enough to plan, and a question you ask Mallard in the app, have them removed before they are sent. The check looks for common identifier patterns and will not catch everything, so describe your study in de-identified terms regardless.
Two companies process that text, not one. Anthropic (Claude) drafts the plan and reviews it, and OpenAI reviews it a second time — independently, so that a methodological problem one model misses has a second chance of being caught. Both receive your study description after that check, together with the draft plan and the study details you entered. This applies to every plan and to every design brief; it is not limited to complex studies, and there is no setting that turns the second review off.
Literature search. To find background literature and check references, the app sends search terms built from your study description to the U.S. National Library of Medicine's PubMed service (NCBI E-utilities).
Do not paste identifiable patient information into the consult. Describe your study in de-identified terms — populations and variables, not names or records.
When a plan fails to generate, Ask Mallard records the error — its type and message, the engine involved, the app version, a short excerpt (a few hundred characters) of what the model had returned when it failed, and standard request metadata such as your IP address and browser — so we can find and fix problems. That excerpt can echo part of your study. The log holds at most the most recent 500 or so reports, and a daily clean-up deletes any report once it is more than about 90 days old. These logs are kept only to keep the service working, are visible only to Ask Mallard, and are not used to profile you or build an advertising picture of you.
How each plan was generated. When a plan is generated we also keep a small record of how it was built, so we can tell whether the checks and reviews described on the methods page are working: which model drafted it, which of our internal checks flagged something, whether the reviewers raised anything and whether the revision fixed it, and how long each stage took. It holds no study text and nothing that identifies you or your account, and it is not linked to your plans, so it cannot be traced back to a study. We keep these for 13 months, which lets us compare a month against the same month a year earlier.
If you flag a section. Each plan carries a control for telling us that a section is wrong — that it does not describe the study you are running, or asks for something you could not do. We store only which section you picked and which of the listed reasons, alongside the same anonymous record above. There is deliberately no comment box, because a note would carry your study into a store that is otherwise anonymous; if you have more to say, email support@askmallard.com instead. Flagging is optional, it changes nothing about your plan, and it is not linked to your account.
| Anthropic | Processes consult text to draft study plans and to review them. Governed by Anthropic's own privacy and data-use terms. |
| OpenAI | Processes consult text to review study plans a second time, independently of the model that drafted them. Runs on every plan and every design brief. Governed by OpenAI's own privacy and data-use terms. |
| Clerk | Handles sign-in and stores your account identity and subscription status. Only used if you create an account. |
| Stripe | Processes Pro subscription payments. Ask Mallard never sees or stores your card number — Stripe handles it directly. |
| Netlify | Hosts the site and serverless functions, and stores (via Netlify Blobs) the plans you save when signed in, your plan-usage counters, and error logs used to fix problems. May log standard request metadata (e.g. IP address) for security and rate-limiting. |
| Cloudflare | Provides DNS for both of our domains. It also runs receive-only email routing for our former medstatica.com domain (some older exported plans still cite a medstatica.com address); mail to our current @askmallard.com addresses is handled by Google Workspace instead — see below. The site itself is not proxied through Cloudflare: they do not see your visits, your study text, or anything you type into the app. The one exception is sign-in: our sign-in provider may show a Cloudflare bot check, and if it does, Cloudflare sees that page visit. |
| NCBI PubMed | The U.S. National Library of Medicine's literature database. Receives search terms built from your study description, and reference details, to find background literature and check citations. Governed by NCBI's own policies. |
| NLM Clinical Tables and NIH Common Data Elements | U.S. National Library of Medicine terminology services. When you look up a code or definition for a variable in the guided workspace, the term you typed (up to 160 characters, after the identifier check) is sent to find matching codes in RxNorm, LOINC, HCPCS, medical conditions or research data elements. Governed by NLM's own policies. |
| Resend | Sends our automated emails, such as the notice before saved plans reach the end of their retention period. Receives your email address and the content of that email. |
| Google Fonts | Serves the typefaces the site uses. Your browser requests them from Google when a page loads, which gives Google standard request details such as your IP address; no study text or account information is sent. |
| Google Workspace | Hosts email for our @askmallard.com addresses (hello@, privacy@, support@). When you email us, your address and the contents of your message are received and stored by Google under its own privacy terms. |
| PostHog | Privacy-first product analytics, used only if you accept analytics. Receives usage events (for example, that a plan was generated) and coarse properties, linked to your account ID when you are signed in — never your name, email or study text. Autocapture and session recording are disabled. Separately, Stripe sends billing events about checkouts, subscriptions and payments to PostHog so we can see revenue alongside usage; see Analytics. |
If you subscribe to Pro, Stripe collects and processes your payment details under its own privacy policy. Ask Mallard receives confirmation that a payment succeeded; when you're signed in, your Pro status is recorded on your account (via Clerk) so it applies across your devices. We never see or store your full card number or security code — Stripe handles them directly. Stripe also sends billing events to our analytics tool (PostHog) so subscriptions and payments can be looked at alongside product usage — see Analytics for exactly what that includes.
We use privacy-first product analytics (PostHog) to understand how the app is used — for example, how many plans are generated or which features are used — so we can improve it. We record usage events and coarse properties. When you are signed in, those events are linked to your account ID, a random identifier from our sign-in provider, so we can see how the app is used across your devices and alongside your subscription; they never carry your name or email. Your study text is never sent to analytics, and autocapture and session recording are turned off. Analytics runs only if you accept it in the notice shown on your first visit; you can decline. To count repeat visits, analytics uses a cookie or local storage to hold a random device identifier; declining prevents this and the account link above. We show no ads, use no advertising trackers, and do not sell your data. If a launch-list email form is present, the address you submit is used only to notify you about Ask Mallard and is not shared.
Billing data in analytics. Stripe, which handles our payments, sends billing events to PostHog so we can look at subscriptions and payments alongside product usage. These events are about checkouts, including a checkout that is not completed, and about subscriptions, invoices, payments, refunds and the payment methods used for them, so they can carry the contact, billing and card details you gave Stripe. They come from Stripe to PostHog directly rather than from your browser, so declining analytics does not prevent them — the analytics choice governs the usage events the app sends, not these billing events. Questions about them, or requests about your own records, go to privacy@askmallard.com.
Ask Mallard is intended for clinicians, trainees, and health researchers, and is not directed to children under 13. We do not knowingly collect information from children.
If this notice changes materially, we will post the updated notice here. Continued use after a change means you accept the revised notice.
Questions about privacy? Email privacy@askmallard.com. That address is hosted on Google Workspace (see Third parties), so your message is received and stored by Google on the way to us — if you would rather it did not, say so and we will give you another route. You can also write to us by post at Ask Mallard LLC, 2108 N St, Ste N, Sacramento, CA 95816.
No. Ask Mallard shows no ads, uses no advertising trackers, and does not sell your data.
No. Describe your study in de-identified terms only — no names, MRNs, dates of birth, or other identifiers. Strip identifiers before entering anything.
Signed out, nowhere: nothing you generate is saved. If you’re signed in, your studies are stored on our server (via Netlify) and synced to your account so they follow you across devices. You can delete them from the Saved tab.
It is sent through our function to the AI providers to generate your plan, after the identifier check described above. The request, your description included, is kept as a generation recovery record for up to 12 months from generation. The description is also saved with your study so your library can show and group it. Deleting the study removes that copy; deleting your account removes both. Search terms built from it are also sent to PubMed for the literature search.
Only privacy-first analytics (PostHog), and only if you accept it on your first visit. It records usage events, linked to your account ID if you are signed in — never your name, email or study text — and sets a cookie or local-storage value to hold a random device ID. Decline the notice, or clear your browser storage, to keep it off. If you start a checkout, even one you do not complete, or subscribe, Stripe also sends billing events to PostHog, which can carry the contact, billing and card details you gave Stripe; that is separate from the events your browser sends and is not affected by declining. See Analytics.
