Not one byte leaves the machine.
DuplicateDuster never transmits file names, hashes, or content anywhere. Scanning works with the network cable pulled, which makes it safe for material that is not allowed to leave the room. The only outbound calls it ever makes are a licence check and an update check — and there is an offline licence file for machines that never go online.
What's actually in place.
Fully local processing
Scanning, hashing and reclaiming all happen on your machine, with no network connection required at any point. No file names, hashes or content are ever transmitted anywhere.
Read-only scanning
A scan lists and reads; it never writes. Nothing is removed without an explicit confirmation naming the file count, the total size, and what is about to happen to those files.
The original cannot be selected
Source-side files are rendered with a keep badge and no checkbox at all. Deletion is structurally limited to the target folders you nominated — this isn't a default you can click past, it's the shape of the screen.
Protected system locations
Windows, Program Files, ProgramData, the recycle bin and System Volume Information — and on Unix /bin, /usr, /etc, /boot and friends — are skipped during the walk and refused again at delete time, whatever ends up selected. Paths are resolved first, so a traversal like ..\Windows\System32 can't slip past.
Symlinks never followed
Symbolic links are neither traversed nor reported. Resolving one and deleting what it points at is exactly the failure mode a deduplication tool must not have.
Three-pass secure overwrite
The optional secure erase overwrites a file's data three times (0xFF, then 0x00, then random bytes), renames it repeatedly so the original name doesn't survive in the directory entry, zeroes the timestamps, and then unlinks it. Each pass is flushed to disk rather than left sitting in the page cache. On Linux it hands off to shred where available.
Hard-linking that can't lose a file
In hard-link mode the copy is renamed aside before the link is created, never unlinked first. If the link can't be made — different volume, unsupported filesystem, permissions — the rename is undone and you still have your file. Both paths are checked for the same volume up front.
Licensing without a phone-home habit
Activation validates a key once and caches the result; if the server is unreachable later the cached tier is kept rather than downgrading a paying user. Air-gapped machines activate from a signed licence file bound to that device, with no network involved.
What we are not claiming.
Not a certified military standard
This is a genuine three-pass overwrite, not a certified DoD 5220.22-M implementation. If a compliance requirement specifically demands that certification, verify it independently before relying on this feature to satisfy it.
SSDs limit what overwriting can guarantee
On solid-state drives, wear levelling and copy-on-write filesystems mean an in-place overwrite is not guaranteed to reach the original physical blocks. It raises the cost of recovery substantially; it cannot promise erasure. For flash storage, full-disk encryption is the stronger control.
Permanent and secure modes are permanent
The recycle bin is the default because it is the reversible one. Choosing permanent delete, secure erase or hard-linking is choosing something with no undo, and the app says so in the confirmation before it acts.
Beta builds are not code-signed yet
The 1.0 beta ships unsigned on every platform, so SmartScreen will warn on Windows and Gatekeeper will warn on macOS. We would rather say so here than have you find out at install time.
Want the implementation details?
The matching model, the overwrite sequence, the hard-link rollback and the folder-signature algorithm are documented for technical review.