Privacy policy

Last updated September 29, 2026

dopp (dopp.sh) sits between your app and a decision API such as Jev, records the requests and answers, and trains small models on them for you. This page says what we keep, why, and which other companies handle it.

What we collect

• Your account: your email address, and, if you sign in with GitHub, Google or Apple, the email and name that provider shares. We don't get your passwords.
• Requests you send through dopp: the text or data in each request (the "state"), the questions asked, and every answer (from Jev, your models, or anything else you choose). This is the core of the service: it's what your models learn from.
• Requests you add: text you paste, datasets you import, and examples dopp writes for you.
• Usage and billing: what you used (answers, writing, training) and its cost. If you buy credits, Stripe handles your card; we never see or store card numbers.
• Technical data: timestamps, how long requests took, and error details, so the request log works and we can fix problems. We also keep a server-side log of page and API requests with the page, the referring site, country, device type and a daily visitor hash, and no IP address, for 45 days.

How we use it

• To answer your requests and forward them to the answerer you picked.
• To train, measure and serve models for your account only. Your requests are not used to train models for anyone else.
• To show you your requests, usage and balance, to bill you, and to keep the service secure.

We don't sell your data and don't use it for advertising.

Who else handles it

• TypeSafe (Jev): requests you route to Jev are sent to TypeSafe's API.
• Cloudflare: hosts the site, the database and file storage, and sends sign-in emails.
• Modal: runs model training and hosted models on your requests.
• Google (Gemini): writes new example requests when you ask dopp to generate some.
• Stripe: processes payments.
• PostHog (US): counts visits and product events, as described below.
• GitHub, Google, Apple: only if you choose to sign in with them.
• Hugging Face: public datasets you choose to import are downloaded from there; we don't send them your data.

Visit counts

dopp.sh counts visits and a few product events, like making a route or starting a training, with PostHog on their US servers (your browser sends them to dopp.sh, which passes them on to PostHog). PostHog also records sessions (what the page showed and where you clicked) so we can see where someone got stuck; what you type into fields is masked out of recordings. It sets its own cookie to recognise a returning visitor. When you're signed in, events and recordings carry your account's id and email, so we can see who got stuck. We don't send the contents of your requests or your keys.

Cookies

One cookie keeps you signed in. A few others are set only in these cases: when you open a promo link (30 days) or a claim link (1 day), so the credit or key lands on your account after sign-in; while you sign in with GitHub or Apple (10 minutes); and when you arrive from a link with ?ref=, which we keep for 30 days to count which post or game brought you. PostHog sets one analytics cookie, as above. No advertising cookies.

Keeping and deleting data

We keep your requests and models until you delete them or close your account. You can delete requests and models in the app. To close your account and delete everything, email privacy@dopp.sh from your account's address; we'll do it within 30 days. Backups may hold copies for a short time after that.

Your rights

You can ask for a copy of your data, a correction, or deletion at the address above. Trained models can be downloaded from the app.

Changes

If we change this policy in a way that matters, we'll say so on the site or by email before it takes effect.