Security, plainly.

Who can see and control your screen

Nobody sees your screen until you share it. Sharing starts only when you choose to share your screen in a call, and ends when you stop or the call does. A script can share for you only if you turn on Settings › Advanced › Let the command line and scripts join calls, let people in and share my screen.

Everyone in a call can watch what you share, so it matters who is in it. Nobody joins a call unless someone in it lets them in, or someone in it rang them as a teammate. Anyone can knock under any name, so on a Mac each knock says whether your server vouches that it's your teammate, and anyone in a call can remove whoever joined after them.

Nobody can control your Mac unless you allow them. When someone wants control, Doubles asks you, and allowing them lasts for that call. In Settings you can instead let teammates your server vouches for control it without asking, or let nobody control it, and during a call you can allow or stop control for each person.

Even then, people can control your Mac only while you share your screen, and only after macOS gives Doubles Accessibility access. Your own mouse and keyboard always win: when you move or type, their input pauses and whatever they hold down is released. Control-Option-Command-period⌃⌥⌘. takes control back from everyone at once.

Clicks and keys from someone controlling your Mac never reach apps you hide from the share or the windows Doubles draws, and the shortcuts that lock the screen or log you out are never replayed. Locking your Mac or putting it to sleep pauses your share and stops remote control until you unlock it.

A browser can't be controlled: browser guests can control a Mac that allows them, but a browser never acts on anyone else's mouse or keyboard.

How calls are encrypted

Calls use WebRTC. Audio, video and your shared screen are encrypted with SRTP, using keys the two ends agree with DTLS (DTLS-SRTP). Pointers, ink, control input, reactions, transcript lines and copied text travel on WebRTC data channels, which DTLS encrypts too. A GIF reaction is a link, though: each Mac and browser in the call fetches the GIF from GIPHY or Tenor, which then see their network addresses.

Each pair of people in a call has its own encrypted connection: there is no media server that decodes your call. Media goes directly between you whenever the network allows. When it doesn't, it goes through a TURN relay, which forwards packets it can't decrypt.

Each end checks the other's encryption keys against a fingerprint that reaches it in the call setup, through the server. Doubles doesn't yet show a security code you could compare with the other person, so a malicious server could, in principle, swap those fingerprints and put itself in the middle of a call without anyone noticing. Use a server you trust, or run your own.

So that nobody else can read or change the call setup on the way, the Mac app talks to its server only over an encrypted connection (wss://), unless the server is on your own network or reached through Tailscale.

What the server sees and keeps

The server introduces the people in a call and passes their call setup along. It never receives your screen, your voice, your camera, your keyboard and mouse, or your transcript.

It does see the name and colour each person uses, who is in which team, who is available, away or in a call, call codes and who is in each call, and the network addresses people connect from, which the call setup also carries.

On disk it keeps accounts and teams: each account's name and colour, the public keys and names of its Macs and when each last signed in, and each team's name, members and invite link. It also keeps the calls in progress, so that restarting the server doesn't end them. It forgets an account that is in no team once nobody has signed in to it for 30 days, and keeps nothing for a Mac that has only signed in, until it makes or joins a team, or links another Mac.

Its log names calls by their codes and people by IDs, not by name, and records a network address when one hits a limit, such as too many connections at once. Credentials for the TURN relay go only to people in calls, and they expire after a day by default.

Signing in: a key on each Mac

Doubles has no passwords and no email addresses. The first time it runs, each Mac makes its own P-256 key pair and keeps the private key in its keychain. To sign in, it signs a one-time challenge from the server. The server stores only public keys.

Each signature names the server it's for, so a server can't pass yours on to sign in as you somewhere else. The Mac app signs in only to the server in its settings: a call link to another server joins that call without signing in, and a team link to another server asks before making that server yours.

To use your account on another Mac, choose Link Another Mac… under your name in the menu bar, or in Settings › Team, on a Mac you already use. It shows a code that works once, for 10 minutes; you enter it on the new Mac, then allow the new Mac on one you already use. The server limits wrong codes, so guessing one isn't practical. Settings › Team lists your Macs and removes any you no longer use.

What your share leaves out

The windows Doubles draws, such as the call panel and the pointers and ink over your screen, are left out of what you share. So are apps you hide in Settings: Messages, Keychain Access, Passwords, 1Password, Telegram and Signal start out hidden if you have them, and on your screen an outline marks each window the others can't see. When a hidden app starts, Doubles holds back new frames, for up to 3 seconds, while it leaves the app out. An app that takes longer to open its first window can show for a moment before it's left out, and if Doubles can't leave a window out in that time, it tells you and stops outlining it.

Notification banners are left out too, unless you turn that off.

Copied text is shared only if you turn clipboard sharing on, only as plain text, and only with someone who chooses to share with you too. Items that password managers mark as concealed are never sent.

Transcripts and notes are made on your Mac

Transcription runs on your Mac, with Apple's on-device speech recognition. Each person's Mac transcribes what its own microphone hears, while they have transcription on, and sends the text to the others over the call's encrypted connection, so everyone in the call on a Mac gets a transcript labelled by speaker. Nothing you say while muted is transcribed.

On speakers, a microphone also picks up the others, so their words can end up in that person's transcript as theirs. Doubles suggests headphones for that reason.

Doubles saves transcripts as Markdown in a folder on your Mac, and the server never receives them. If you choose a folder that iCloud syncs, such as Desktop or Documents, iCloud uploads them; the default folder isn't synced.

Call notes are written after the call by Apple Intelligence's on-device model (macOS 26 with Apple Intelligence turned on), so nothing is sent to a server to write them. Recordings are QuickTime movies saved on your Mac.

A coding agent in the call gets the transcript only if the person running it turns on Include transcript at the foot of the agent panel (or Agent › Include Transcript), and the others in the call are then told, if they use the current version of Doubles on a Mac. Each prompt then carries what that person says, as transcribed. What anyone else says goes too only if they're a teammate the server vouches for and they turn on Include what I say under their own agent panel: it's off until they do, and off again for each new agent. The lines that go include whatever those microphones picked up from the others, and an agent whose model runs in the cloud, as Claude Code's and Gemini CLI's do, sends them to its provider with the prompt.

Coding agents run in a folder you trust

A coding agent runs on the Mac of the person who starts it, as a program running as them, in a folder they choose. Doubles asks them to trust that folder before an agent first starts there, and again if the folder's agent settings, or what they run, change (another commit checked out included).

When the agent asks permission to run a tool, Doubles puts the question to the person running it. Doubles also asks them before each file the agent reads or writes through Doubles, and keeps those files inside the folder. Answering Allow for this call lets the same kind of request through without asking until the call ends or the agent stops: reading, editing, deleting or moving files inside the folder, the very same command line, or the same tool with the same title. A change to a file that can run commands always asks, and shows what would change.

An agent is still a program running as you: its own tools, and settings in the folder, can read and change files and run commands without asking. That's why Doubles asks you to trust the folder first. The agent doesn't get the macOS permissions Doubles has for the screen, the microphone, the camera or Accessibility.

Everyone in the call on a Mac sees the conversation. What the agent's tools print stays on that Mac unless the person running it shares it, and only they prompt the agent unless they let the others.

Everyone sees recording and transcription

When someone in a call records it or transcribes it with Doubles, everyone in the call sees that, on a Mac and in the browser. Doubles can't stop someone from recording their screen with another app, so share with people you trust.

Run your own server

You can run the server yourself. One script sets it up on an Ubuntu machine, with HTTPS and a TURN relay that can also work over port 443. Accounts, teams and call setup then stay on a machine you control.

A server with its own TURN relay uses it for STUN too, so no outside STUN server learns who is in your calls. Without one, calls use Google's public STUN server. Either way, GIF reactions come from GIPHY or Tenor. Self-hosting has the steps.

Signed updates, never mid-call

Doubles updates itself from the server it was packaged for, and installs an update only if it's signed with the key it was packaged with (Ed25519, through Sparkle). It checks once a day, and never installs during a call: it waits until the call is over and its notes and recording are saved, then restarts.

That signature doesn't cover your first download. Download Doubles over https; if you download it from a server on your network over plain http, compare its checksum as the download page explains.