DutyDesk
Security and privacy

The only thing that leaves your computer is a licence check

There is no cloud in the middle. We hold no copy of your conversations, because we have nowhere to put one — the bot runs locally and the data stays in the app’s data folder on that same computer.

Stored on your computer
Messages, rules, flows and the log live in a SQLite database on your own machine.
Encrypted keys
Sign-ins and tokens sit in your operating system’s secure store.
No cloud
No server sits between you and the conversation. We hold no copy.
Clean disconnect
Releasing an account erases the keys and ends the link.

What crosses the network, and what does not

The list is complete. Every outbound connection the app or the site opens, and where it goes.

Data
Where it goes
Status
Message content
Stays on the computer, in a local SQLite database
Never leaves
Rules and flows
Saved locally; a rule’s text goes to your AI provider when the rule uses AI, or when you edit rules with AI
Only if enabled
Message log
Saved locally only
Never leaves
Sign-in details
Encrypted in the operating system’s store
Never leaves
WhatsApp messages
To WhatsApp’s servers, as from any linked device
To the platform
Telegram messages
To Telegram’s official Bot API
To the platform
Text sent for an AI reply
To the provider you chose — OpenAI or Google — only while AI is on
Only if enabled
Audio sent for transcription
To the transcription connector you chose, only while transcription is on
Only if enabled
Product key
To our licence server, for verification only
Leaves
Your account on this site
To the licence server — email, hashed password and the billing details for an invoice
Leaves

Where the keys are kept

The WhatsApp sign-in, the Telegram bot token and the AI keys are encrypted in the operating system’s secure store — not in a text file, and not in the clear in the database. The interface is never handed them at all.

macOS
Keychain · a separate Safe Storage item
Windows
DPAPI, through the system store
Linux
The desktop’s own store · libsecret. With no keyring installed, the keys are written to disk unencrypted.
What is encrypted
The WhatsApp sign-in, the Telegram token, the AI keys
What is readable in the database
The message text, the rules and the log
If the system’s encryption key changes — a different computer, a restore from backup — the app stops with an explicit error instead of quietly opening a new connection. That is what keeps a working sign-in from being erased beyond recovery.

A boundary between the interface and the engine

The app is built in two layers. The engine — the connections, the keys and the database — runs in a separate process from the interface, and everything that passes between them goes through one defined bridge.

mainEngine
The platform connections, the rule engine, the database and the keys. The only process with access to the network and the disk.
bridgeBridge
A closed list of the actions the interface is allowed to ask for. Nothing else crosses between the layers.
uiInterface
The screens you see. It is handed data to display, with no access to the keys and no network connection of its own.
The interface cannot read keys, open a network connection or reach files directly.

And what we do keep — your account area

The account on this site is the single exception. It exists to hold the key, the devices and the invoices — and that is exactly what is in it, and nothing more.

Password
Stored hashed with scrypt and a random salt. The password itself is kept nowhere and cannot be recovered.
Sign-in session
An HttpOnly cookie that code in the browser cannot read. The server keeps only its fingerprint.
Payment card
It never passes through us and is never stored with us. The card and the processing sit with Stripe alone.
Deleting an account
Erases the key, the devices and the log. Payment records stay on for the retention period the law requires, with the account and the key detached from them. The invoice itself remains with Stripe.
This translation is provided for convenience. The Hebrew text is the binding version and prevails in any conflict.

The risk to know about before you start

The WhatsApp connection speaks the multi-device protocol of a personal account, the way a linked device does — not the official WhatsApp Business API. Automating this way is against WhatsApp’s terms of service, and at high volume in particular it can get the account blocked.

We do not hide this, and we do not promise it will not happen. What we do do: the rate limits are on by default, not an option you switch on after the fact.

Telegram runs against the official Bot API and carries none of this risk. If you want automation with no exposure at all, start there.

WhatsApp is a trademark of Meta Platforms, Inc. This product is not affiliated with, endorsed by or sponsored by Meta, and does not use its official API.

What reduces the exposure
Random pause before replying
2–8 seconds
Cool-down per contact
60 seconds
Daily cap per connection
200 messages
Replies to private messages only
Default
Pause the bot in one click
A button on every screen
Each one is on by default and can be tuned.

What is checked before every release

Nothing ships on the strength of “it worked on my machine”. Every push runs the full suite, and every screen the menu reaches has tests of its own.

1,154
Automated tests
The reply engine, the flows, the routing and the connections.
628
Interface tests
Every screen the menu reaches, apart from the Guide, is tested end to end.
3
Operating systems
Builds are compiled and tested on every push.
5
Interface languages
Including a fully mirrored layout for Hebrew and Arabic.
In full disclosureThe builds are not digitally signed at this stage, so the operating system will show a warning when you install. How to get past it

A question this page does not answer?

The guide goes into the technical detail — including exactly what is stored in the local database.

Read the guideDownload