[ legal ]

Privacy Policy

Effective July 12, 2026

Plain-English summary. A doppelganger only works if it can see your stuff, so we take custody seriously. We collect what you give us and what your agent handles for you. We use it to run your agent — not to sell, not for ads, and not to train AI models. Your conversations go to AI providers to generate responses; your secrets are encrypted and never exposed inside agent sandboxes. Email us and we'll delete everything. The full policy below controls.

1. Who we are

This policy describes how DPG Labs, Inc. ("Doppelganger", "we", "us") handles personal information when you use trydoppelganger.com, app.trydoppelganger.com, and the Doppelganger applications and APIs (the "Service") — a product that runs AI agents on your behalf. Privacy questions and requests: founders@trydoppelganger.com.

2. What we collect

Account and billing

  • Sign-in details: your email address, and your name and profile picture if you sign in with Apple or Google. We have no passwords to store — sign-in is by email link or those providers.
  • Waitlist and onboarding details you provide, including what you tell your agent about yourself during setup (by text or, if you choose it, by voice).
  • Payment details are collected and stored by Stripe, our payment processor. We store your subscription status and usage records, not your card number.

Content you and your agent create

  • Your conversations and instructions to your agent, and its responses.
  • Your agent's working data: its memory, notes about contacts it manages for you, schedules, files and artifacts it produces, and drafts awaiting your approval.
  • Recordings of certain agent actions (for example, screen recordings of your agent operating a browser) so you can review what it did.

Connected accounts and credentials

  • When you connect a third-party service (such as Gmail, Google Calendar, Google Sheets, GitHub, Slack, Notion, Linear, Stripe, Spotify, Granola, or Loops), we store the access tokens and the data your agent reads or writes there on your instruction.
  • When you sign in to a website inside your agent's browser, we store that browser session (cookies) — encrypted — so your agent can keep acting there for you.
  • Secrets you store in the vault (API keys, tokens) are encrypted with envelope encryption and injected into outbound requests at our network edge; they are not exposed inside agent sandboxes.

Communications your agent handles

  • Email sent and received through your agent's inbox, and SMS/iMessage conversations on your agent's phone number — including message content, participants, and attachments.
  • Audio, if you use voice features; audio is processed to power the conversation.

Technical data

  • Logs and diagnostics: IP address, browser and device information, request identifiers, and event logs we need to run and secure the Service.
  • Cookies: we use only essential cookies (your sign-in session). No advertising cookies, and currently no third-party analytics. The marketing site sets no cookies at all.

Information about other people

Your agent will inevitably handle personal information about people you deal with — the contents of email threads, contact details, message history. We process that information only to provide the Service to you, at your direction. You are responsible for having the right to bring that information to the Service.

3. How we use information

  • To operate the Service: run your agents, execute the actions you direct, and sync with the accounts you connect.
  • To secure the Service: authentication, abuse and fraud prevention, debugging.
  • To bill you and manage your subscription and usage.
  • To support you and to send service communications (sign-in links, waitlist and account notices). We don't send marketing you haven't opted into.
  • To improve the Service, using aggregated or de-identified information.

We do not sell your personal information, we show no ads, and we do not use your content to train AI models.

4. AI processing

Agents are powered by third-party AI models. To generate responses and take actions, relevant content — conversations, connected-account data the agent is working with, media — is sent to our model providers: Anthropic (agent reasoning), OpenAI (voice conversations), Google (media analysis), and fal.ai (media generation). These providers process the data to serve our requests and, under our agreements with them, do not use it to train their models. The roster of providers may change; this policy will be updated when it does.

5. Google user data

If you connect a Google service (such as Gmail, Google Calendar, or Google Sheets), we access only the data needed for the features you use, at your direction. Doppelganger's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we do not use Google user data for advertising, do not sell it, do not use it to train generalized AI models, and allow human access only with your consent, for security purposes, or as required by law.

6. When we share information

We share personal information only with:

  • Service providers that process it for us: Amazon Web Services (hosting and storage, United States), E2B (isolated agent sandboxes), the AI providers in Section 4, Stripe (payments), AgentMail (agent email infrastructure), Sendblue (SMS/iMessage), Resend (transactional email), Entri (custom-domain setup), and network/proxy infrastructure providers that carry agent browsing traffic. Each is bound to use the data only to provide its service to us.
  • The people and services your agent interacts with — by design. When your agent sends an email, posts, or messages someone at your direction, the recipient and the platform receive that content.
  • Authorities, if required by law or to protect the rights, safety, or property of you, us, or others — after scrutinizing the demand.
  • A successor, if we go through a merger, acquisition, or asset sale; this policy would continue to apply to your data.

7. Retention and deletion

We keep your information while your account is active. When you delete your account — or delete specific content, agents, connections, or secrets — we delete the underlying data from production systems promptly, generally within 30 days, with backup copies aging out on a rolling schedule shortly after. We may retain what the law requires us to keep (for example billing records) and minimal records needed to prevent abuse.

8. Security

The architecture is built around not trusting the places where agents run: each agent executes in an isolated sandbox; sandbox traffic exits through a proxy we control; real credentials are injected at that edge and never stored inside the sandbox; secrets and stored browser sessions are encrypted at rest with managed keys; all traffic is encrypted in transit. No system is perfectly secure — if we learn of a breach affecting your data, we will notify you as required by law and tell you what we know.

9. Your rights

You can access, correct, export, or delete your information — through the product where controls exist, or by emailing founders@trydoppelganger.com. We respond to verified requests within the timelines the law sets, and we don't discriminate against you for exercising your rights.

  • EEA/UK: we process your data to perform our contract with you (running the Service), for legitimate interests (securing and improving it), or with your consent (voice features, optional connections). You also have rights to restrict or object to processing and to complain to your supervisory authority.
  • California: we do not "sell" or "share" personal information as the CCPA defines those terms, and we do not use sensitive personal information beyond what the statute permits for providing the Service.

10. International transfers

We operate from the United States and store data there. If you use the Service from elsewhere, your information is transferred to and processed in the US, under this policy and the safeguards described above.

11. Children

The Service is not directed to children and requires users to be 18 or older. We do not knowingly collect personal information from anyone under 18 as an account holder; if we learn we have, we will delete it.

12. Changes to this policy

We'll update this policy as the Service evolves. For material changes we'll give notice by email or in the product before they take effect. The current version will always be at trydoppelganger.com/privacy.html.

13. Contact

founders@trydoppelganger.com — a human founder reads it.

See also the Terms of Service — the contract that governs your use of the Service.