It is worth being exact here, including about the limits, because a delete tool that oversells its safety net is worse than one that describes it accurately.
Recycle Bin only. The recycle flow uses the Windows shell file operation with the flag that makes the deletion undoable, so removed files land in the bin and can be restored through Explorer. There is no permanent-delete option in this path.
Four guards around every recycle. A non-absolute path is refused, because a relative path can bypass the bin. A path too long for the shell API is refused rather than attempted. The target volume is queried in advance to confirm it has a working Recycle Bin, and if it does not the file is skipped with a message explaining that Windows would delete it permanently instead. After the operation, an aborted shell result or a file still present on disk is reported as a failure.
Protected locations are refused, not merely hidden. The Windows directory, both Program Files trees, and ProgramData are resolved from the environment and treated as untouchable for recycling, moving, and hardlinking alike. The check compares whole path segments, so a folder like `C:\WindowsApps` is not mistaken for something inside `C:\Windows`. This refusal is independent of the scan setting that lets you look inside system folders — you can scan them, and destructive actions still decline. Separately, the Recycle Bin itself and System Volume Information are never enumerated, so already-recycled files cannot resurface as duplicates.
Nothing is deleted without a deliberate confirmation. Recycle and hardlink actions both arm an inline confirm step that you have to accept.
Now the limits, plainly. Keeping one copy per group is *encouraged and warned about, not enforced.* If your selection covers every copy in a set, you get a clear warning naming how many sets are affected — and then you may proceed. The backend deliberately permits it, on the reasoning that it is your data and your decision. So the honest statement is that DupeDoctor warns you before you wipe a whole set; it does not prevent it.
There is no dry-run and no undo of a completed action. The Undo control reverts a *selection*, not a deletion. Recovery after the fact is the Recycle Bin, and there is a button to open it — Windows does not expose a reliable programmatic un-recycle, so nothing here pretends to offer one.
One move caveat. Moving duplicates to a quarantine folder on the same volume is a rename and fully reversible. Across volumes it falls back to copy-then-remove, which means the original is unlinked without passing through the Recycle Bin. That is inherent to a cross-volume move, and worth knowing before you point quarantine at a different drive.
