Privacy Policy
Deduplo does its work on your own computer — your files never leave it. The only time the app connects to the internet is to activate and verify your licence, so there is very little for this policy to describe.
Last updated: 15 September 2026
Who we are
Deduplo ("we", "us") is a desktop application operated by Deduplo, a sole proprietorship registered in India. For anything in this policy, write to support@deduplo.com.
What the application sends
The Deduplo desktop application connects to the internet for one purpose only: to activate and check your licence. When you enter your key — and periodically afterwards — it sends your licence key, a one-way (salted) hash of your machine ID, the app version and your operating system to our licensing server over an encrypted (HTTPS) connection. It makes no other network requests: no analytics, no crash reporting, no advertising and no account system.
Like any server, ours sees the IP address that request comes from. It uses it only to limit repeated requests and does not keep it. What it keeps, against your licence, is the country that address maps to and the dates of the first and the latest check — so we can tell a licence that is being shared across the world from one that has been reinstalled on the same person's machines.
Your photos, videos, audio files and documents are read on your computer, and never leave it. No file, no thumbnail, no filename and no scan result is ever uploaded anywhere.
Apart from the licence details above, we do not receive your files, your folder names, your scan results or your usage patterns from the application.
What Deduplo stores on your own device
To make repeat scans fast, Deduplo keeps working data in your user folder. This data stays on your machine and is yours to delete at any time.
| What | Why it exists |
|---|---|
| Hash cache | File paths, sizes, timestamps and the computed image fingerprints, so a second scan only looks at what changed. This file is encrypted on disk with a key held by your operating system's own protection service. On the rare build that cannot protect it, the file is stored unencrypted and Settings ▸ Privacy says so, beside the button that clears it. |
| Thumbnail cache | Small previews so results render instantly. Size-capped and cleared automatically. |
| Settings file | Your preferences, chosen folders and licence key. |
| Activity log | A local record of what was deleted and when, so a mistake can be traced and undone. Length-capped. |
| Saved results | A scan you save to a file of your own naming — and, only when you switch that on, the app's own copy of your last result so it can be brought back after a crash or on the next launch. |
| Notes | The notes you type on a set, keyed by the photo's full path. Written when you save a scan and on the way out, and listed by its own name in the clear-data window. |
| Keep-rule memory | Which keep rule you tend to choose, so the app can say so once per session. A count per rule, no paths. |
| Never-match list | The pairs you told Deduplo never to match again, by file path. Kept apart from the caches so clearing them does not forget your decisions; it has its own row in the clear-data window. |
| Pre-delete backups | Full copies of the photos a delete was about to remove, only when you asked for one, so a bad batch can be undone from disk. Listed and clearable from Settings ▸ Privacy. |
| Quarantine folder | Files removed on a drive that has no Recycle Bin, with a record of where each came from. More ▸ Restore quarantined files puts them back. |
| App log | A short record of what the app did and any error it met. It can carry the full paths of files in your library and the text of an error message. Size-capped at about 1.5 MB, and cleared from Settings ▸ Privacy, which lists it. |
| Debug log | The same in more detail, for a support request: timings, decoder failures and the diagnostic dump the app writes if it ever stops responding. Also carries full file paths. Size-capped at about 8 MB, cleared from the same place. We only ever see it if you attach it yourself. |
Everything except the settings file can be removed from Settings ▸ Clear cached data.
On Windows all of it lives in one folder, %LOCALAPPDATA%\Deduplo (an older install kept
the same files loose in your user folder; they are moved into that folder the first time the new
version starts). On macOS and Linux each of these is a file or folder in your home directory whose name
begins with .duplicate_photo_finder (the quarantine and backup folders are named
DuplicateFinder_Quarantine and DuplicateFinder_Backups). Deleting the folder, or
those files, removes the settings file and all of the above. On Windows, Deduplo also keeps one small
number in two places outside that folder: the registry, under its own key
(HKEY_CURRENT_USER\Software\Deduplo), and a file under
C:\ProgramData\Deduplo that every Windows account on the computer can read — how many free
clean-up credits have been used, so that the credits are counted per computer rather than per account.
Neither is personal data, and neither is removed by uninstalling. Nothing else is left behind.
When you buy a licence
Purchases are handled by Paddle, which acts as the Merchant of Record and seller of the licence. Paddle collects the information needed to complete a sale — your name, email address, billing address and payment details — and is responsible for tax and invoicing. We never see or store your card details. Paddle's own privacy policy applies to that part of the transaction: paddle.com/legal/privacy.
From Paddle we receive your name, email address and order reference. We use them only to generate and send your licence key, to answer support requests, and to keep the records a business is legally required to keep. We do not sell, rent or share this information, and we do not send marketing email unless you ask us to.
Your licence key carries your email address — and your name, if you gave one — signed in. The app shows them under Settings ▸ License and writes them as a "licensed to" line into the HTML report and the JSON export (the CSV and text exports carry no identity line), so a report or a key that is passed around can be traced back to the licence it came from. That line is written only into files you choose to export, on your own device; it is never sent anywhere.
When you contact support
If you email us or use the form on our contact page, we hold what you send — your name, email address, country, the description of your problem, any screenshot you attach, and a log file if we ask for one — for as long as it takes to help you, plus a reasonable period afterwards in case you write again. A log can carry the paths of files in your library, which is why the app asks you to look through it before attaching it. Please do not send us your photos or personal files; we do not need them and would rather not have them. A picture of the app window is usually enough.
The contact form is handled by our own code, running on Cloudflare (the company that also hosts this site), which turns what you typed into an email and delivers it straight to our mailbox. No form-forwarding service sits in between. Before it sends, the page runs Cloudflare Turnstile, a bot check that usually needs no click; it looks at signals from your browser and your IP address to decide whether you are a person, and sets no tracking cookie. Your IP address is not written into the email or stored by us. If you would rather skip the form, email us directly at support@deduplo.com — it reaches exactly the same place.
This website
The site has no analytics, no advertising and no tracking cookies, and it sets no cookies of its own. Three things on it do reach a third party:
- The typefaces (Sora, JetBrains Mono and, on the user guide, Inter) load from Google Fonts, so your browser requests them from Google's servers and Google receives your IP address and user-agent.
- The contact page runs Cloudflare Turnstile as its bot check, as described above. It loads only on that page.
- The pricing section asks Paddle what the licence costs where you are, so it can show the price in your own currency. Paddle needs your approximate location (from your IP address) to answer.
The site itself keeps nothing in your browser's storage; Paddle's checkout may keep what it needs for a purchase in progress, as Paddle's own privacy notice describes. Nothing else on the site contacts anyone.
Children
Deduplo is not directed at children and we do not knowingly collect information from anyone under 16.
Your rights
Depending on where you live — for example under the EU/UK GDPR or India's Digital Personal Data Protection Act — you may ask us for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it. Since the only personal data we hold is your purchase record and any support email, such a request is quick to answer. Write to support@deduplo.com and we will respond within 30 days. For data held by Paddle as Merchant of Record, contact Paddle directly.
Changes to this policy
If this policy changes, the updated version is posted on this page with a new date at the top. Material changes will also be noted in the application's release notes.