Privacy Notice
Last updated: August 15, 2026 · Applies to the Doppel desktop application and the Doppel Voice browser extension, both by OnlyBrutus LLC.
The short version: Doppel is a local-first desktop app. Your writing, email, meetings, and documents stay in a file on your own disk. None of it reaches a server of ours, and we cannot see, collect, or sell it. Two small endpoints of ours do exist, and it would be dishonest to round them to zero: one issues and checks beta keys, and one receives a bug report if you choose to send one. Beyond that, the app on its own checks for updates and for revoked beta keys — anonymously, against our download host — and everything else that leaves your device goes directly to a service you connected under your credentials. Sections 2 and 8 cover each of these.
1. What data exists, and where it lives
Everything Doppel learns and stores lives on your device:
| Data | Where it lives |
|---|---|
| Your profile, writing-style calibration, behavioral-interview answers, learned corrections | A local SQLite database in your user profile folder |
| Chat history and rolling memory summaries | The same local database (chat session storage is a setting you control) |
| Email samples you upload for calibration | Encrypted files on your device (OS-level encryption via Windows DPAPI); sensitive content is redacted on-device before analysis |
| Meeting transcripts, summaries, and notes | The local database; recorded audio is transient. It is held only as an encrypted working file and destroyed after transcription (audio retention for imports is off by default and opt-in) |
| Knowledge-base index of folders/files you add | The local database; indexing happens entirely on-device |
| API keys and OAuth tokens (Anthropic, ElevenLabs, Tavily, Google, Microsoft) | Your operating system’s keychain (Windows Credential Manager), never in plaintext on disk, never in the database, never in logs |
| Voice-clone profile (optional, consent-gated) | On your device; cloning runs entirely on-device |
| Error log | A rotating local file; it never contains message content, email bodies, keys, or other personal data |
Doppel has no user accounts, no sign-up, and no cloud storage of its own. The app collects no analytics, usage statistics, or crash reports — nothing is transmitted about how you use it. (This website is separate and does count visits; see “About this website” below.)
2. What leaves your device, and when
Almost everything that leaves your device does so because you connected a service. Each of those is optional, uses your own credentials, and talks directly to that provider. Three entries at the end of the table are not connections you make — the automatic update check, the automatic licence check-in, and a bug report you choose to send — and they are described there in full:
| Service (all optional) | What is sent | When |
|---|---|---|
| Anthropic API (cloud drafting/chat engine) | The prompts needed to generate a response: your request plus relevant context (e.g. the thread you are replying to, your style profile summary). If a cloud chat request of yours fails and your on-device model steps in to answer, Doppel also sends periodic availability checks on this same connection until the cloud recovers — each carries your API key and no prompt content | Only if you add your own Anthropic API key and choose the cloud engine. A fully local engine is available instead, and some features ask for confirmation before using the cloud. The step-in behaviour (and with it the availability checks) can be switched off under Settings → AI Model. |
| Gmail (Google API) | Standard mail API calls under your Google account: reading your inbox, and sending messages you have individually approved | Only if you connect a Gmail account. See the Google Limited Use disclosure below. |
| Outlook / Microsoft Graph | Standard mail API calls under your Microsoft account: reading mail, sending messages you have individually approved | Only if you connect an Outlook account. |
| Microsoft Teams (Graph) | Retrieval of your one-on-one chats, and sending replies. Sign-in requests a send scope (ChatMessage.Send) alongside read access, so Doppel can send a reply you approve; incoming messages are stored locally | Only if you connect a work/school Microsoft account. A manual mode disables all background polling. Replies wait for your approval unless you switch on unattended replies — see section 7. |
| ElevenLabs (premium voice, opt-in) | Text to be spoken (TTS) or audio to be transcribed (STT) | Only if you add your own ElevenLabs key and select it as a provider. Free, fully offline voice is the default. |
| Tavily (web search, opt-in) | The search query | Only if you add your own Tavily key and enable web search. |
| Model downloads | Nothing about you. Doppel downloads AI model files (e.g. the bundled on-device language model) and verifies them by checksum | During guided setup, at your request. |
| Update check (not a connection you make) | Nothing about you. The installed app asks our release feed whether a newer version exists, and downloads it if one does | Automatically: shortly after launch, then periodically while the app runs — and once more if you open Settings → General → About, which shows you the answer. There is currently no setting to turn off the automatic checks. It carries no identifier and no usage data. |
| Licence check-in (not a connection you make) | Nothing about you. The app downloads the public list of revoked beta keys from our download host and compares it to your key on your own machine; the request carries no identifier | Automatically: shortly after launch, at most once every 24 hours. Like the update check, there is currently no setting to turn it off. A key found revoked takes effect on the next launch. |
| Bug report (not a connection you make) | What you typed in the report, the contact address recorded when you activated, your beta key’s identifier, and — if you leave the diagnostics toggle on — the app version, engine state, and a redacted tail of the local error log | Only when you press Send in the app’s feedback form. The report is archived and emailed to our support address, and is not deleted automatically. While diagnostics are switched on, “View what will be sent” shows the exact payload before anything leaves. |
Beta key requests (download page). If you request a beta key, the email address you enter is embedded in the issued key itself — you activate the app with that exact email the first time you open it — and is stored in our licensing database (Cloudflare D1) together with the key's identifier. The key is delivered on the download page only (copy or PDF download); we do not send it, or anything else, by email, and the address is not added to any mailing list and is not shared. An unredeemed key becomes inactive (expires) after 14 days; the address can then request a new one. We do not delete the request record when it expires.
3. On-device processing of sensitive data
- Email triage, inbox classification, writing-profile analysis, and document summarization run on a language model on your own machine (the bundled local engine or your Ollama install).
- Raw, unredacted email bodies from your calibration corpus are never sent to any cloud provider. On-device redaction happens first, and corpus analysis uses only the local engine.
- Meeting transcription runs on a bundled on-device Whisper engine; audio does not leave your machine for transcription.
- Where a feature would fall back to a cloud engine (for example, if no local engine is available for a document summary), Doppel asks for your confirmation first.
4. The Doppel Voice browser extension
Doppel Voice is a separate, optional extension for Google Chrome. It exists for one reason: so Doppel can speak in a browser-based meeting. It adds a microphone named “Doppel Voice” to the list Google Meet and Microsoft Teams already show you, and plays Doppel’s synthesized speech into it when you select it. You choose that microphone yourself, in the meeting app, exactly as you would choose a headset.
The extension collects nothing and transmits nothing. It makes no network requests of any kind, has no servers, stores nothing, and contains no analytics. Its only connection is a local channel to the Doppel app already running on the same computer.
| Question | Answer |
|---|---|
| Does it read the page? | No. It does not read, collect, or transmit page content, meeting text, chat, participant names, form fields, or anything else on the page. |
| Does it listen to your real microphone? | No. It never requests, records, or accesses your real microphone or camera. It only offers an additional microphone that the meeting app may choose to read. |
| Does it follow you around the web? | No. It runs only on Google Meet and Microsoft Teams meeting pages and does nothing anywhere else. It cannot see your browsing history, your other tabs, or your bookmarks. |
| Where does the audio come from? | The Doppel desktop app on the same computer, over Chrome’s native messaging channel — a direct local connection between the two programs. The audio never crosses a network. |
| What does it store? | Nothing. No storage, no cookies, no cache. Closing the meeting tab ends the connection. |
| What permissions does it request? | One: nativeMessaging, which is what lets it talk to the Doppel app on your machine. It requests no others. |
The meeting app you are in can read the audio you send through this microphone — that is what a microphone is, and it is the same exposure you accept with a real one. That is exactly why the device is always visibly named “Doppel Voice” and why there is no hidden mode: you, and anyone looking at the call’s device settings, can see which microphone is selected.
The extension is optional. Doppel’s other two output modes — a virtual audio cable, or playing out loud through your speakers — need no browser extension at all.
5. Google API Limited Use disclosure
Doppel’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
- Gmail data is used only to provide user-facing features you can see in the app: reading your inbox so you can review it, on-device triage suggestions, drafting replies for your approval, and sending messages you individually approve.
- Gmail message content is processed on your device. Inbox triage and drafting context assembly use a local language model; Gmail data is not sent to third-party AI providers.
- Gmail data is not transferred to anyone except as necessary to provide these features (i.e., API calls to Google itself), to comply with applicable law, or as part of a merger/acquisition with prior notice to you.
- Gmail data is never used for advertising, never sold, and never used to train AI models.
- No humans (including us) read your Gmail data. It resides on your device; we have no access to it.
6. Your control and data deletion
- Disconnect any service at any time in Settings. Disconnecting removes the stored tokens from your keychain.
- Delete stored content in the app: writing samples, chat sessions, meeting records, knowledge-base sources, transcripts, and the voice profile each have delete controls.
- Back up on your terms: the optional backup produces a single password-encrypted file, saved where you choose. There is no way to recover it without your password, and we never receive it.
- Uninstalling removes the application but deliberately leaves your data behind:
%APPDATA%\twin\survives, so that reinstalling — or an update that runs the uninstaller first — does not destroy your profile and history. To remove everything Doppel stored, delete that folder yourself after uninstalling. Revoking Doppel’s access in your Google account or Microsoft account settings severs its API access entirely.
7. What we never do
- No telemetry, analytics, or tracking in the app — Doppel transmits nothing about how you use it, ever. This website is a separate thing and does count visits; see “About this website” below.
- No selling or sharing of personal data — not the beta-key record, not a bug report you send, not anything else. What the app holds about you never reaches us at all.
- No advertising use of any data.
- No sending you did not switch on. Outbound actions ship switched off, and every message waits for your approval — unless you deliberately turn on unattended replies for a specific person in Teams, which is off by default and limited to an allowlist you choose.
8. About this website
Everything above is about the Doppel app. This website is a different thing, and it is worth being exact about the difference, because “no telemetry” is a claim we hold ourselves to inside the product.
- The app sends no telemetry. No usage data, no crash reports, no analytics pings — that is a design rule enforced in the codebase, not a policy we promise to follow. On its own it makes two kinds of requests, both anonymous and both described in section 2: a check for a newer version, and a check of the beta revocation list.
- This website counts visits. Pages here are served through Cloudflare, which records aggregate visitor counts using its cookieless Web Analytics. It sets no cookies, assigns no identifier that follows you between sites, and produces no profile of you. It is the only third party any page here talks to — open your browser’s network tab and confirm it.
- The beta-key form is the only place this site collects anything you typed, and it collects exactly one thing: the email address you enter. See section 2 and the Support page for how to have that record deleted.
No cookie banner appears on this site because there are no cookies to consent to.
9. Children
Doppel is not directed at children under 13 and is intended for professional use.
10. Changes to this notice
If this notice changes, the updated version will be published on this page with a new “last updated” date. Because the app collects nothing about how you use it, changes will generally reflect new optional integrations rather than new data collection.
11. Contact
Questions about privacy: see the Support page for contact details.