Privacy
Your writing stays on your machine. Here's the architecture, not the adjectives.
Every claim below points at something specific: a file, a Windows API, a test that fails the build. Marketing pages say "we take your privacy seriously." This one tells you the folder.
This is the plain-English explanation. The formal document is the Privacy Notice.
There is no Doppel account, and no server holding your content
There is nothing to sign up for, and no backend that stores your writing, your email, your meetings, or your documents. Those live in a file on your disk, named further down this page. That is structural, not a policy we could quietly reverse: there is nowhere on our side for that data to go.
We do run two small endpoints, and it would be dishonest to round them to zero. Neither sits in the path of your documents, email, or meetings — the only content that ever reaches one is what you yourself type into a bug report. Licensing issues and checks beta keys, and stores the email address you typed on the download page alongside the key's identifier — see the Privacy Notice, section 2, for how to have that deleted. Feedback receives a bug report only when you press the button, and will show you the literal payload if you press “View what will be sent” first.
Almost everything else that touches the network is something you switch on: a cloud model using your own API key, an email account you connect. Two things are not: the installed app checks our release feed for a newer version on its own, shortly after launch and periodically after that, and about once a day it downloads the public beta revocation list and checks your key against it on your own machine. Neither sends anything about you or carries an identifier, but neither has a setting to disable it, so it would be wrong to file them under “only when you choose”. Both are listed below.
Stays local / goes out only if you choose
| Stays on your disk, always | Leaves your device (each row says what triggers it) |
|---|---|
| Your writing profile and calibration answers | Draft text sent to a cloud model, only with your own API key, only when you pick a cloud engine |
| Every writing sample you give it | Email headers and bodies from an account you explicitly connect |
| Chat history and assistant memory | An anonymous version check against the update feed — automatic, and again when you open Settings → About; no switch to turn off the automatic one |
| Meeting recordings, transcripts, and debriefs | A bug report, only when you press the button, and it shows you what it attaches |
| Your indexed documents and knowledge base | An anonymous fetch of the beta revocation list — automatic, about daily; no switch to turn it off |
| Analytics and telemetry | None exist in the app. Nothing to send. |
Where the data actually is
One SQLite database, in your Windows user profile:
%APPDATA%\twin\twin.db
Paste that into File Explorer and you'll be looking at everything Doppel knows about you. Copy it, back it up, or delete it. It's a file on your disk and it behaves like one — including when you uninstall. The uninstaller removes the application and deliberately leaves this folder alone, so reinstalling picks up where you left off. Your data is yours until you delete it yourself.
Keys are encrypted by Windows, not by us
API keys, email tokens, and your license are stored through
Electron's safeStorage, which on Windows is DPAPI:
encryption tied to your Windows user account. Another account on the
same machine cannot read them, and neither can anyone who copies the
database file without your credentials.
Your calibration writing is walled off, and a test enforces it
The writing samples that teach Doppel your voice are used for exactly one thing: shaping how drafts sound. They are never mixed into chat context, never fed to a cloud model as background, and never used for any other feature.
That boundary is not a promise in a document. It's an automated test that scans the code for any path connecting the two, and fails the build if one appears. The rule can't quietly erode, because the build stops.
Nothing sends unless you set it up to
Every outgoing email or reply is a draft until you approve it, and outbound capability ships switched off. One feature can send without a per-message click: unattended replies in Teams chat. It is off by default, it applies only to people you add to an allowlist yourself, and it does not touch email. Turning it on is a decision you have to go and make.
This website talks to exactly one third party
No Google Fonts, no CDN-loaded libraries, no trackers, no cookie banner, because there are no cookies to consent to. The one third party is Cloudflare's cookieless Web Analytics, which counts visits, sets no cookie, and assigns no identifier that follows you between sites — its script and its beacon may show as more than one row in your network tab, but they all go to that one party. (The pages themselves are served from Cloudflare's network — that is our own hosting, not a third party we hand you off to.) Open your network tab on any page here and confirm it. The app is the stricter case: it sends no telemetry at all, and on its own makes only the two anonymous checks — updates and revocations — described in the Privacy Notice, sections 2 and 8.
Now go check the folder.
Then, if you like what you found, try it on one email.