Dup Privacy Policy

Effective: September 11, 2026

This Privacy Policy explains how Stratoxphere Lab (“Stratoxphere,” “we,” “us,” or “our”) handles personal data when you use Dup, the Stratoxphere account platform, and related account, commerce, access, device, and licensing services (collectively, the “Service”). The operator’s legal identity is disclosed in the Contact section below.

Stratoxphere is the controller of the personal data described as Platform Data below. Our privacy contact is [email protected].

1. The Important Distinction: Dup Content and Platform Data

Dup has two separate data paths.

AI processing happens directly from your device. Dup uses your own API keys to send content from your device to your selected inference providers: third-party services you choose for transcription or language-model processing. Audio, selected text, optional screenshots, transcripts submitted for rewriting, custom vocabulary, prompts, and AI output do not pass through the Stratoxphere Platform. Stratoxphere does not receive or store that content on its servers through this path.

Account and access data goes to Stratoxphere. The Stratoxphere Platform processes information needed to sign you in, manage access and purchases, activate devices, validate licenses, prevent abuse, provide support, and maintain security and transaction records.

Data stored only on your device is described separately below. It is not collected by Stratoxphere unless you deliberately send it to us, for example in a support request.

2. Data Stored or Processed on Your Device

Dup stores or handles the following locally:

Removing the application may not remove its data automatically. Use Dup’s clear controls or your operating system’s application-data tools if you want to remove local data.

3. Content Sent Directly to Inference Providers

You can choose the inference provider for live transcription separately from the inference provider for language-model tasks. Depending on what you do and which features you enable, Dup sends the following directly under your API key for the selected provider:

• microphone audio and the settings or vocabulary needed for transcription to your transcription provider;
• a transcript and your selected writing style or instruction for a rewrite to your language-model provider;
• selected text and the transcribed spoken instruction for the modification feature to your language-model provider; and
• an in-memory screenshot to your language-model provider when Screen Context is enabled.

When Screen Context supplies vocabulary for transcription, Dup also sends the extracted terms to your transcription provider. If you select different providers, transcripts and screen-derived vocabulary can therefore be processed by both providers, while microphone audio goes to the transcription provider and screenshots go to the language-model provider.

Each inference provider handles this content under its applicable terms and privacy policies. Review the current documents published by your selected providers for the services you use before deciding what content to process through Dup. Those documents may change independently of this Policy. Stratoxphere does not restate or control those providers’ data practices.

Because you choose and control each provider account, API key, related configuration, and content sent through that key, Stratoxphere cannot access, delete, export, or control content held by those providers on your behalf.

4. Platform Data We Collect

We collect or generate the following categories of Platform Data:

Some sensitive commerce and licensing values are stored in protected form. We do not receive the AI content described in Section 3 through the Stratoxphere Platform.

5. Why We Process Platform Data

We use Platform Data to:

• create, authenticate, secure, and maintain your Stratoxphere account;
• connect Dup to your account and confirm current access;
• administer purchases, licenses, device activations, offers, and referrals made available through the Service;
• match commerce confirmations to the correct account and product;
• prevent duplicate, fraudulent, unauthorized, or abusive use;
• respond to refunds, payment disputes, security events, privacy requests, and support requests;
• diagnose failures and protect users, the Service, and third parties;
• maintain transaction, audit, accounting, and legal records; and
• comply with law and enforce the Dup Terms of Service.

Where the European Economic Area, United Kingdom, or similar law applies, our legal bases are performance of a contract when processing is needed to provide your account and Dup access; legitimate interests in securing, operating, improving, and preventing abuse of the Service; compliance with legal obligations for transaction and regulatory records; and consent where law requires it for a specific optional activity. You can disable Screen Context and local history without withdrawing from the account or license contract.

Product access and eligibility rules may be applied automatically. Contact us if you believe a rule was applied incorrectly.

6. When We Share Data

We disclose Platform Data only as needed for the purposes described below. Each provider’s current terms and privacy notices govern its own services and may change independently of this Policy.

• Google and Firebase Authentication provide account authentication. See Firebase Privacy and Security and the Google Privacy Policy.
• Creem acts as merchant of record and supports payments, tax, orders, refunds, customer access, and licensing. See the current Creem Privacy Notice and Creem Buyer Terms.
• Cloudflare hosts and protects the Stratoxphere Platform. See the current Cloudflare Privacy Policy.
• GitHub distributes official Dup downloads and versioned legal documents. See the current GitHub Privacy Statement.
• Professional advisers and service providers may receive data when needed to provide legal, accounting, security, support, or infrastructure services and subject to appropriate duties.
• Legal and safety recipients may receive data where reasonably necessary to comply with law or legal process, protect rights and safety, investigate fraud, or establish and defend legal claims.
• Business-transfer recipients may receive data as part of a merger, financing, reorganization, acquisition, bankruptcy, or sale of assets, subject to applicable law and appropriate notice.

We do not sell personal data. We do not share personal data for cross-context behavioral advertising and do not use Platform Data to serve targeted ads.

7. International Processing

Our providers operate internationally, so Platform Data may be processed outside your country. Each provider describes its locations and transfer practices in its current privacy documentation linked above.

8. Retention

Local data remains on your device until you clear it, it is replaced or pruned by Dup, or you remove it using your operating system. Access credentials remain only while needed for their purpose or until they expire, are revoked, or are removed.

We retain Platform Data only for as long as reasonably necessary for the purposes described in this Policy, including to provide and secure the Service, maintain an account or license, prevent fraud and repeated misuse, resolve disputes, and meet tax, accounting, consumer-protection, and other legal obligations. Retention depends on the type of data, why it was collected, the sensitivity and risk of keeping it, and applicable legal requirements.

Account and access records are generally retained while the related account or service relationship remains active and for a reasonable period afterward. Transaction and accounting records may be retained for longer where required by law. Expired connection requests, operational logs, audit records, and support communications are deleted or minimized when they are no longer needed for security, support, dispute resolution, or legal compliance.

We may retain specific data longer when required by law, needed to establish or defend legal claims, or necessary to address fraud or security incidents. Where possible, we will restrict use during that extended period.

9. Your Controls and Choices

You can:

• leave Screen Context off or disable it at any time;
• disable, inspect, or clear local dictation history;
• select the providers and models used for transcription and language-model tasks;
• remove locally stored API keys or revoke them through the corresponding providers;
• change Dup settings and custom vocabulary;
• edit the display name associated with your Stratoxphere account;
• manage supported device activations through your account;
• disconnect Dup from your account; and
• request account deletion by emailing [email protected] from the email address associated with your Stratoxphere account.

Clearing Dup’s local data does not delete data held by your inference providers under your API keys, Platform Data stored by Stratoxphere, or transaction records held by Creem. Requests concerning data controlled by an inference provider or Creem may need to be directed to the corresponding provider.

10. Your Privacy Rights

Depending on where you live, you may have rights to request access, correction, deletion, restriction, objection, or portability; withdraw consent where processing relies on consent; opt out of certain sharing; or appeal our response. You may also have the right to complain to a data protection or consumer authority.

Submit a request to [email protected]. We may need to verify that you control the relevant account. We will not discriminate against you for exercising a privacy right. Some data may be exempt from a request or retained where required for security, fraud prevention, transactions, legal compliance, or legal claims.

If we process data based on legitimate interests, you may object based on your circumstances. If we use consent, withdrawing consent does not affect processing that occurred before withdrawal.

11. Security

We use administrative, technical, and organizational safeguards designed to protect Platform Data, including protections for data in transit and at rest, access controls, credential management, and separation between public application code and server-side credentials.

Dup uses secure storage provided by the operating system for supported credentials. No method of storage or transmission is completely secure, and we cannot guarantee absolute security. You are responsible for protecting your device, Stratoxphere account, inference provider accounts, and API keys.

12. Children

Dup is not directed to children. You must meet the eligibility requirements in the Dup Terms of Service and the current terms of any third-party service you use with Dup. If you believe a child has provided Platform Data in violation of those requirements, contact [email protected].

13. Changes to This Policy

We may update this Policy when Dup, our providers, law, or our data practices change. The effective date identifies the current version. We will provide notice of material changes when required by law.

The Policy committed with a tagged Dup release provides a versioned record for that release. The current policy will also be available from the official Dup repository and Stratoxphere website.

14. Contact

Stratoxphere Lab

Founded and operated by JHEN-KE LIN

Privacy and support: [email protected]