Privacy Policy

What we collect

• Account: email, name, password hash, or your Google identity if you sign in with Google.
• Your uploads: the selfies you send to generate photos, and the selfies you use to make an AI twin.
• Your results: generated images and videos, the prompts you typed, and the credits spent.
• Payments: handled by Stripe. We keep the order, amount and your withdrawal consent record; we never see your card.
• Technical: request logs and error reports.

How your face data is handled

Uploaded selfies and trained twin models are stored in a private bucket with no public address. AI providers (Google, OpenAI, fal.ai) receive the selfie only to produce your generation, through a short-lived signed link. Generated results are stored on a public address so you can share them; only you get the link.

You give explicit consent to this processing when you upload, and you can withdraw it by deleting your data at any time.

Retention

• Results: until you delete them, at most 12 months after creation.
• Uploaded selfies and twin models: deleted 90 days after last use, or immediately from Me in the app.
• Account: until you delete it. Deleting the account deletes every file.

Your rights

Access, correction, deletion, portability and objection, under the GDPR. Use Me in the app or write to [email protected]. You can complain to the Lithuanian State Data Protection Inspectorate.

Connected social accounts (TikTok, YouTube)

You can connect a TikTok account or a YouTube channel to post your results from the app. Doppelshot uses YouTube API Services for the YouTube connection; by connecting a channel you also agree to the YouTube Terms of Service (https://www.youtube.com/t/terms) and the Google Privacy Policy (https://policies.google.com/privacy).

Doppelshot's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

• What we receive from Google: the name, handle and avatar of the channel you connected, and an access token that lets us upload videos to that channel. We do not read your subscriptions, comments, watch history or any other YouTube data.
• What we do with it: we show the channel name in the app, upload the videos you choose (immediately, at the time you scheduled, or automatically for new videos when you turned that rule on), and read the processing status of those uploads. Nothing is uploaded without a rule or an action from you.
• Storage: tokens are encrypted at rest and stored only as long as the connection exists. They are never shared with third parties, sold, or used for advertising.
• Revoking access: disconnect the channel from Social in the app (we revoke the token at Google and delete it), or remove Doppelshot from your Google account at https://myaccount.google.com/permissions. TikTok accounts can be removed the same way from Social or from TikTok settings.

How we protect your data

• In transit: every connection to Doppelshot and to our providers uses HTTPS (TLS).
• At rest: our database (Neon) and file storage (Cloudflare R2) encrypt data at rest. Selfies and twin models sit in a private bucket reachable only through short-lived signed links.
• Passwords are stored as salted PBKDF2 hashes. Access tokens of connected accounts (Google, TikTok) are encrypted with AES-GCM before they reach the database and decrypted only at the moment of an upload.
• Access to production data is restricted to authorized AitekLabs staff, for support and operations only.
• Deletion is real: deleting a file, a twin, a connection or the account removes the data from our systems; a disconnected Google or TikTok token is revoked at the provider and erased.
• In case of a data breach affecting you, we notify you and the Lithuanian supervisory authority within 72 hours, as the GDPR requires.

Cookies

The app keeps your session in your browser storage. No advertising cookies.