Duck.ai vs Lumo vs Brave Leo: where each decrypts your prompt, with Morse alongside

The Morse teamPublished October 19, 2026Facts checked October 19, 20269 min read

Lumo vs Duck AI vs Brave Leo comes down to who reads your words. As of October 19, 2026, Duck.ai hides who you are from GPT, Claude, and Mistral but lets those providers read your prompts, Proton's Lumo runs open models on its own servers and encrypts your saved history, and Brave Leo runs every model itself and, since October 15, 2026, offers one end-to-end encrypted model, GLM 5.3 Flash, checked by Brave's server rather than your browser.

We read DuckDuckGo's Duck.ai help pages and privacy terms, Proton's Lumo security post, privacy page, Lumo 2.0 announcement, and pricing, and Brave's Leo pages, privacy policy, help center, and both of its TEE posts on October 19, 2026. All three deserve credit. None trains on your chats, none needs an account to start, and all three keep chat history on your device or encrypted where the company can't read it. They differ on where your prompt is decrypted and who checks that.

Duck.ai vs Lumo vs Brave Leo vs Morse at a glance

As of October 19, 2026. Every Duck.ai, Lumo, and Brave Leo cell comes from the page linked in the section below it.

How does Duck.ai keep your chats private?

By standing between you and the model. DuckDuckGo calls Duck.ai "private conversations with 3rd-party AI chat models, anonymized by us" (DuckDuckGo). Its privacy terms, last updated October 1, 2026, say that once your IP address is stripped, "no one can tell (including us and the underlying model providers) whether it was you personally submitting the Prompts or someone else" (DuckDuckGo). Requests still carry today's date, your timezone, and your region's unit system, worked out by an IP lookup that DuckDuckGo says it doesn't save (DuckDuckGo).

The providers read the prompt, so the protection is contractual. DuckDuckGo's two pages describe the deletion promise differently. The privacy terms say providers delete what they receive "at most within 30 days, with limited exceptions for safety and legal compliance" (DuckDuckGo). The privacy help page says providers "delete your prompts and responses immediately after generating a reply," lists that OpenAI and Anthropic may hold chats "in short-term memory for up to 1 hour," and says Anthropic may keep chats "where required by law or as necessary to combat malicious use" (DuckDuckGo).

Two free models go further. gpt-oss-120b and Gemma 4 31B run on Tinfoil "in a Trusted Execution Environment such that Tinfoil cannot see your prompts or the model's response," and Duck.ai labels them "zero provider visibility" (DuckDuckGo). The pages we read don't say whether your browser checks Tinfoil's attestation or DuckDuckGo does it for you.

History stays on your device by default, though Safari deletes it after 7 days without a visit. The free Sync & Backup option stores chats on DuckDuckGo's servers with "the master decryption key only stored on your devices," and deletes them after 18 months without access (DuckDuckGo; DuckDuckGo). Free models include Claude 4.5 Haiku, GPT-6 Luna, and Mistral Small 4; Plus adds GPT-5.6 Terra and Claude Sonnet 4.6, and Pro adds Claude Opus 4.8 and GPT-5.6 Sol with "2x higher usage limits than Plus" (DuckDuckGo). Duck.ai's terms say it's meant for people 18 or older.

Is Lumo AI really private?

Private from Proton's staff and from training, yes; private from the model, no. Proton says Lumo encrypts each message with a one-time key that only the model server can unwrap, and that the model has to be given "cleartext messages," so it prefers the term "user-to-Lumo (U2L) encryption" to end-to-end (Proton). That post describes no secure enclave or attestation, so nothing outside Proton checks what runs on those servers.

Proton's Lumo privacy page, read October 19, 2026, says "we keep no logs of what you ask, or what Lumo replies," that Lumo doesn't store "timestamps, IP addresses, or chat context," and that it doesn't train on chats except anonymized feedback you choose to give for Apertus 1.5. It names the models: "Qwen 3.5, GLM 5.3, Image-Turbo, FireRed-Image-Edit-1.1, and Apertus 1.5," running "exclusively on servers Proton controls." Saved history uses zero-access encryption, so "only you can see your data by logging in to your Proton Account," and a guest's chat "is erased at the end of each session" (Proton).

Lumo 2.0, announced June 30, 2026, added Fast and Thinking modes, image generation, web search that "cites its sources," memory, and encrypted Projects (Proton). The Free plan has limited messages, one Project, and "limited image generations"; Lumo Plus is "billed at $119.88 every 12 months" (Proton).

How private is Brave Leo?

Brave runs Leo's models itself and says it keeps nothing. Its help center says Qwen, Llama, and Claude models are all hosted "through our own secure infrastructure," with "no data sharing between Brave and the original model creators" (Brave). Brave's privacy policy, updated September 23, 2026, says Brave doesn't collect identifiers "such as IP address," doesn't "store or retain prompts, responses, context, or personal data" on its servers beyond large prompts cached for minutes, and doesn't train on conversations. Feedback you send with a thumbs up or down, including the full conversation, is kept for one year (Brave).

Free Leo offers Qwen 3.6 35B, GPT 6 Luna, Nemotron Nano 3 30B, GLM 4.7 Flash, and Claude Haiku 4.5. Premium adds Claude Sonnet 5.5 and Opus 5.5, GPT 5.6 Terra, Grok 4.7, DeepSeek v3.2, Kimi K2.5, and others (Brave). Premium costs $14.99 a month or $149.99 a year (Brave), and Brave issues "unlinkable tokens" so it can't tie your purchase to your use (Brave).

Brave Leo's end-to-end encrypted GLM 5.3 Flash

On October 15, 2026, Brave made chats with GLM 5.3 Flash end-to-end encrypted in Release, Beta, and Nightly. Your browser seals each prompt with Oblivious HTTP to a key that exists only inside a NEAR AI TEE on Intel TDX and Nvidia hardware. Brave's AI Gateway relays it, sees your IP address but not your words, and forwards the ciphertext under Brave's account. The model can also search the web from inside the TEE (Brave).

The check comes before the key. Brave's verification oracle rebuilds NEAR AI's code from public source and checks Intel's and Nvidia's attestations, and the gateway hands your browser the TEE's key only if the live attestation matches. Brave states the limit itself: "Today, your browser relies on the gateway for this check." Moving the check into the browser is its next step (Brave).

Which one checks the enclave from your own device?

None of the three, as of October 19, 2026. Lumo claims no enclave. Duck.ai's Tinfoil models run in a TEE, but its pages don't describe a check your browser makes. Brave's own server checks the attestation, then gives your browser the key. Brave's first TEE release, a November 2025 test of DeepSeek V3.1 in Nightly, relied on Brave's policies, and "Brave's servers also checked the TEE's proof and showed users a green label" (Brave; Brave). The October release added encryption Brave can't open, while the check stays on Brave's side.

Some of what ranks for these names predates it. A Privacy Guides forum reply from January 14, 2026, which ranks for "lumo vs duck ai," says "Lumo and Brave are not prevented from logging queries also" (Privacy Guides forum). For Brave's GLM 5.3 Flash chats, that stopped being true on October 15, because Brave's gateway now relays ciphertext it can't read. For Lumo and the rest of Leo, it still rests on each company's no-logs policy.

Brave Leo and Morse now offer the same E2EE model, GLM 5.3 Flash, and differ on where the check runs. On Morse, your browser does the checking itself, against versions pinned in the app, before anything leaves your device. We cover that model's specs and hosts in our GLM 5.3 Flash guide.

How Morse answers the same questions

Each of the three asks you to trust one company with one step: Duck.ai trusts providers to honor contracts, Lumo trusts Proton's model servers, and Brave Leo trusts Brave's gateway to vouch for the enclave. Morse puts the enclave check in your browser and the history on your device, and lets you pick, chat by chat, how much any provider sees.

• E2EE, for prompts no server should read. Your browser checks the enclave's cryptographic proof itself, comparing what's running against versions pinned in the app, then seals the message for that enclave alone. Our servers relay text they can't read, and the reply is decrypted only in your browser. Every E2EE reply has a lock you can open to see each check that passed, and a full report you can download. E2EE chats come with Pro, at $19 a month. The guarantee rests on the enclave hardware and attestation working as designed, and E2EE chats skip web search and image generation, so use Private when you need to search.
• Anonymous, for GPT, Claude, and Gemini without your name on them. Like Duck.ai, our proxy removes your account, email, and IP address and sends the message under Morse's own account, so the provider sees the question without knowing it's you. The provider may keep it for a limited time to check for abuse, under its own policy.
• Private, for open models on hosts that keep nothing. DeepSeek, Kimi, GLM, and xAI's Grok run on hosts that agreed to zero data retention. Where a provider confirms that on each reply, Morse checks it and refuses a reply that doesn't; otherwise Morse relies on the provider's commitment.

In every mode, your chat history is stored only in your browser, encrypted, and unlocking it takes two keys, one that never leaves your device and one our server gives you at sign-in. We don't train AI on your content, sell your data, or show ads (privacy policy). The same account also holds Characters, for roleplay and companion chats, and Studio, for images, with unfiltered models on paid plans. If you're weighing other encrypted apps, see Venice AI alternatives and how end-to-end encrypted AI chat works.

Choose Duck.ai, Lumo, Brave Leo, or Morse

• Choose Duck.ai if you want Claude Opus 4.8 or GPT-5.6 Sol through an anonymizing proxy and a subscription that bundles a VPN.
• Choose Lumo if you already live in Proton's apps, want models run only on servers Proton controls, and like Projects that keep files and chats together.
• Choose Brave Leo if you want AI built into your browser that summarizes the page you're reading, or end-to-end encrypted chat that can search the web from inside the enclave.
• Choose Morse if you want your own browser to verify the enclave before a word leaves it, GPT, Claude, and Gemini with your identity stripped in the same account, history encrypted on your device, and E2EE from $19 a month.

Start free, or try a chat from the home page without an account. On Pro, open the lock on your first E2EE reply.

Morse publishes this comparison. We've tried to keep it fair; if something's wrong or out of date, email hello@trymorse.ai.

DuckDuckGo and Duck.ai are trademarks of Duck Duck Go, Inc. Morse is not affiliated with or endorsed by Duck Duck Go, Inc.

Proton and Lumo are trademarks of Proton AG. Morse is not affiliated with or endorsed by Proton AG.

Brave and Leo are trademarks of Brave Software, Inc. Morse is not affiliated with or endorsed by Brave Software, Inc.