Privacy Policy

Last updated: October 2026. Doubletake is a free, hosted service at doubletake.gg. Questions or deletion requests: roowus.dev@gmail.com.

What we collect and store

• Account data: your e-mail address (from registration or Google Sign-In), your display name if you set one, and the hashed password if you set one. Passwords are stored only as argon2id hashes.
• What you save: the links, notes and media you share into Doubletake, and the library built from them (titles, tags, collections, your saved to-do list).
• Content we extract from saved links: page text, video transcripts, OCR of frames, comments and the like, fetched from the source when a run needs it. Extracted content is stored so runs and your agents can re-read it.
• Chats and answers: the questions you ask and the answers produced, including which model ran them.
• Usage and cost metadata: run timings, token counts and cost in USD, used to show your spend and enforce the caps you set.
• Sessions: the browser/device/agent tokens that sign in as you, stored only as SHA-256 hashes with a label and last-used time.

What we never store in readable form

Your AI provider API keys (OpenRouter, Anthropic, or any other provider you connect) are encrypted at rest with a server master key (ChaCha20-Poly1305 authenticated encryption) and are only decrypted in memory, for the duration of one of your runs. They never appear in logs, error messages, API responses or backups. Revoking a credential wipes the stored key material immediately.

Third parties

• Google — if you use Google Sign-In, Google shares your account identity (name, e-mail, account id) with us for authentication. We store the account id and e-mail.
• Your AI provider (e.g. OpenRouter or Anthropic) — research runs are executed and billed against your own credentials. Run content (saved pages, your question) is sent to the provider you chose to answer it. We do not run models ourselves and never bill you.
• Cloudflare — DNS and CDN in front of the site, subject to Cloudflare's own policies.
• Oracle Cloud — the hosting provider for the server and its Postgres database.

Google API Services User Data Policy / Limited Use

Doubletake's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Doubletake will not use, transfer, or disclose Google user data except as described in this policy: to authenticate you, to maintain your account, and to provide the service you asked for. Doubletake does not use Google user data for advertising, does not sell it, and does not allow human review of it except with your consent, for security purposes, or as required by law.

Data retention

Your data is kept until you delete your account. There is no separate archival copy: the application database is the only store of your saved items, chats, answers and extracted content.

Deletion

You can delete your account at any time, self-serve and immediately: use the Delete account button on the Account settings page, or visit doubletake.gg/delete. Deletion is immediate and permanent — the account row and everything attached to it (saved items, extracted content, chats, answers, to-dos, sessions, agent tokens, stored credential keys and spend records) is removed in a single transaction, and your sign-in token stops working at once. If you cannot sign in, e-mail roowus.dev@gmail.com from the account address and we will delete it for you.