Duly

A private AI assistant for your paperwork: it keeps every deadline, checks them each morning and drafts what you need. The personal details it finds are hidden before any model sees them.

Comment

Inspiration

Every home has a drawer of paperwork, and the deadlines in it cost money: a membership that renews because notice was a week late, a warranty that ran out unnoticed, a policy that lapsed. In a C+R Research survey of 1,000 consumers, 42% said they had forgotten they were still being charged for a subscription they no longer use. An AI assistant could keep track of all of it, but only if you hand it your documents, with your name, ID number, IBAN and phone number in them. In Cisco's 2024 privacy survey, 84% of generative AI users were concerned about the data they enter going public, yet 30% said they already enter personal or confidential information into these tools. I wanted an assistant that gets the work done without that trade.

What it does

Duly is a private assistant for your paperwork.

  • Reads your documents (text, Markdown or PDF) into dated obligations: renewals, expiries, payments, notice periods, warranty ends. Each date is shown with the document's own words.
  • Checks them each morning (as a scheduled task) and says what needs action, most urgent first, including what renews automatically if you do nothing. Dates go to your calendar with one click.
  • Does the work when you ask: "my laptop screen flickers, am I still covered?", "how do I cancel the gym before it renews?", "how do I renew my car insurance without a gap?". It follows a skill for each task, finds the official procedure with Tavily, and saves drafts and reminders. It never sends anything itself.
  • Remembers what you tell it, and forgets on request.
  • Shows its privacy work: your copy of each document next to the copy the model reads, the vault of placeholders, and a log of every call that left your computer, with the exact text sent.

How the privacy works

Before any text leaves your computer, plain code (no model) finds personal details and swaps them for placeholders such as [PERSON_1] or [IBAN_1]:

  • IBANs and payment cards, confirmed with their mod-97 and Luhn checksums, in any case or grouping;
  • e-mail addresses, phone numbers (one placeholder for +966 50 555 0134, 00966… and 0505550134; landlines too), Saudi national ID and iqama numbers, vehicle VINs;
  • labelled fields in English and Arabic (Policy No., D.O.B., Address, رقم الهوية), with or without a colon as text copied from PDF forms reads, on the lines under a label, and in table columns;
  • numbers and dates named in a sentence ("my passport number is …", "born on …"), and street addresses;
  • the names in your profile, and every known value wherever it reappears, including a person's first or last name alone.

Company names, dates and amounts stay, because the assistant needs them. The vault of real values stays in your data folder; real values come back only on your screen and in your drafts. Every model call and web search goes through one gateway that blocks the call if any vault value is in the payload, and logs the exact text sent, so anything the detectors miss is visible too.

I had the firewall attacked before submitting: an independent adversarial audit fed it realistic paperwork and found 13 kinds of details that still got through (labels written "Policy No.:", PDF form text without colons, an ID number before a full stop, Saudi landlines, a surname mentioned again later, file names used as titles, and more). A second round, run against my fixed version, found 10 more, including regressions of my own rewrite (a known surname could override a whole new name, and a heading like "Customer Contact Details" could be taken for a person). All 23 are fixed, each with a test; the suite has 113 tests, 91 of them for the firewall.

How I built it

  • Nemotron Super (on Nebius Token Factory) reads each document in a strict JSON schema, and runs the assistant with tool calling (nine tools): list deadlines, search documents, load a skill, web search, date arithmetic, save draft, add reminder, remember, forget.
  • Nemotron Nano picks the skill for each question in about a second, and writes the morning brief.
  • Skills are folders with a SKILL.md file (the open Agent Skills format). Only their names and descriptions go into the prompt; the steps load when needed.
  • Tavily finds official procedures; the queries pass the same privacy check.
  • MCP server: Duly's tools also run as an MCP server for agents such as Hermes Agent (which has a built-in Nebius Token Factory provider), and their results come back redacted. I tested the server with an MCP client; I have not yet run it inside Hermes itself.
  • Streamlit for the app, with a private copy of fictional samples for every visitor, spend caps, and recorded conversations when live AI is paused. 113 tests.

Challenges I ran into

  • Model-written dates. When Super wrote dates itself, it read 03/01/2027 (3 January) as 1 March, and once subtracted a 7-day notice period twice. So code now finds the dates written in a document (with a full year), numbers them, and Super only picks which ones matter and what they mean. A notice period is flagged "check this" unless code finds the number of days in a sentence of the document.
  • Structured output. With reasoning switched off, Super started its answer with the list and the strict schema pushed it into the summary field. The model's reasoning does not see the schema (only the decoder does), so sometimes it planned other keys and the forced answer came out empty. Brief reasoning plus the exact output shape in the prompt fixed both.
  • Skipped steps and invented links. In early runs the assistant answered from memory: it skipped the web search and wrote three plausible but made-up Dell URLs, and said a draft was saved when it was not. Now Nano picks the skill, and Duly asks the model again, up to twice, for any step the skill requires that it skipped; if a step still cannot be done (for example the day's web-search budget is used up), the answer says so. Any link or e-mail address that no tool returned is removed from the answer.
  • A greeting that looked like a person. "Dear Dell Support" in a model-written draft was first taken for a person's name, and the gateway then blocked the next call, which is the safe failure. Text written by the model is now only masked against known values, never scanned for new ones.
  • Rules miss things. The audit above showed how many everyday formats a first version of the detectors missed. Redaction now runs in two passes (find and register every value, then replace every occurrence), so a detail repeated later in a document is hidden too, and the app says plainly that the leak check can only stop what the detectors found.

Accomplishments that I'm proud of

  • On the four sample documents, read three times each, Duly found 18 of 18 deadlines with the right date and notice period, with no extra items.
  • On the four suggested questions, asked twice each, it used the right skill and all of the skill's required tools in 8 of 8 runs (in one run, after Duly asked again); no call was blocked and no link had to be removed. A question costs $0.002 to $0.01 in model fees, and reading a document about $0.0006.
  • The privacy work is visible, not promised: side-by-side copies, the vault, and the outbound log.

What I learned

  • Let code do what code can verify (dates, checksums, links), and let the model do what needs language (what a date means, what to write).
  • A small model is enough to route; the big model is worth its cost only where it acts.
  • The best privacy feature is the one users can check for themselves.

What's next for Duly

  • Run Nemotron Nano on the user's own GPU for reading documents, so even redacted text stays home.
  • Run Duly inside an NVIDIA OpenShell sandbox (through NemoClaw) with a network policy that allows only Token Factory and Tavily.
  • OCR for scanned documents, more detectors (other countries' ID numbers), and Arabic documents.

How it maps to the judging criteria

Impact. Missed renewals, notice periods and warranty ends cost households money every year, and the people who would benefit most from an AI assistant are the ones who should not paste their ID numbers and IBANs into one. Duly removes that trade-off for everyday paperwork: insurance, warranties, leases, memberships, subscriptions.

Technical implementation. Two Nemotron sizes on Token Factory, each used for its strength: Nano routes and writes the brief, Super reads documents in a strict JSON schema and acts with tool calling. Code does everything that can be checked: personal-detail detection with checksums, a gateway with a leak check, dates found by code in the document itself, required skill steps checked, links grounded in tool results. Measured: 18 of 18 deadlines right, 8 of 8 runs with the right skill and tools, about a cent per question in model fees.

Design. One app with five tabs that tell the whole story: ask, see what is due, see what the model saw, see what Duly remembers, see how it works. Every answer shows its steps, models, tokens, cost and sources. Drafts and reminders are ready to use, nothing is sent without you, and when live AI is paused the demo shows conversations recorded live instead of a blank page.

Why this idea is non-obvious. Most assistants ask for trust; Duly is built so you can check instead. The model works on placeholders, never reads a date out of a document itself, and cannot put a link in an answer that no tool returned; each of these is enforced in code you can read. Duly's tools also run as an MCP server for agents such as Hermes Agent, and their results come back redacted.

Built With

  • mcp
  • nebius-token-factory
  • nvidia-nemotron
  • plotly
  • pydantic
  • pypdf
  • python
  • streamlit
  • tavily
Share this project:

Updates

Submission history