Privacy Policy

About this policy

Twofold is an app for couples in long-distance relationships. This policy explains what we collect, why we collect it, who can see it, and what control you have over it. It covers the Twofold iOS app and twofoldapp.com.au.

Twofold is operated by Orange Finch. If anything here is unclear, email support@twofoldapp.com.au - we'd rather explain it than have you guess.

Information you give us

• Account details. You can create an account with Apple, with Google, or with an email address and a password. Sign in with Apple or Google and we receive an email address and a unique identifier from them, and never see a password. Choose email and password instead and your password is stored by our authentication provider as a salted hash - we can't read it, and it is never visible to us or to your partner.
• Your profile. Your first name, a profile photo, an accent colour, the city you call home, and the date you started dating. Your device also reports its timezone, so daily questions and streaks roll over at your local midnight rather than ours, and the language it is set to, so notifications we send from our servers can be written in it.
• Notes about your partner. A nickname and photo you can set for your partner, and - before you've connected - your guess at the city they're in. These are yours alone; your partner never sees what you've chosen.
• Things you create. Trips, memories (a title, note, emoji, date, place and photos), flights (flight numbers, dates and who's travelling, plus any boarding passes, itineraries or other travel documents you attach), drawings on the shared pad, and your answers to games and discussion prompts.
• Setup questions. During onboarding we ask how you found Twofold, your relationship situation, how often you travel, what you're hoping to get out of the app, and your and your partner's gender - the last of these only so the app can use the right pronoun in its own wording. These answers are not saved to your Twofold account. They are sent to our analytics provider and attached to your analytics profile there, so we can tell which kinds of couples get the most out of Twofold. See "Information we collect automatically" below.
• Support and sign-ups. If you use the support form - in the app or on the website - we receive your name, email address, the category you pick and your message. We store it, so a conversation can be picked up where it left off and so there is a record of what was asked and what we answered. Support records outlive the account they came from: if you write to us and later delete your account, the ticket stays. That is deliberate - otherwise asking us to delete your account would erase the request itself, along with any reply we still owed you. If you join the Android waitlist we store your email address and send you a confirmation. If you use the feedback board we store the requests you post, your votes, comments, bookmarks, and which requests you've chosen to follow.

Information we collect automatically

• Product analytics. The iOS app sends usage events to our analytics provider: account creation, sign-in and password-reset requests, redeeming a partner invite code, paywall views, purchases and restores, adding and deleting flights, trips and memories, starting and finishing games, saving a doodle, removing a partner, and the name of the screen you're on. Once you're signed in these are linked to your Twofold account identifier, along with the setup answers described above. We don't record your screen - session replay is switched off - and we never send the contents of your memories, notes, drawings or game answers as analytics.
• Analytics our provider adds by itself. Alongside the events above, their own software records the technical details of each one: your device model, iOS version, the version of Twofold you're running, your language and timezone, and when the app is opened and closed. It also derives an approximate location from the IP address the event arrives from - a country and region, not a street - which is separate from, and coarser than, the home city you set in the app.
• The website collects nothing automatically. There is no analytics, no tracking pixel and no advertising cookie on twofoldapp.com.au. The only cookie it sets is the one that keeps you signed in when you use the feedback board.
• Notification tokens. Apple issues a device token so we can send you push notifications, plus separate short-lived tokens for each Live Activity.
• Subscription status. Our subscription provider tells us whether you have an active Plus or Premium subscription, and when we last checked.
• Abuse prevention. We record a timestamped row when you redeem an invite code, and when you use the support form or the flight-email reader, so that a single account can't run those in a loop. These rows hold your account identifier and the time, nothing else, and they are deleted automatically - see "How long we keep it".
• Technical logs. Our hosting providers record standard request information - IP address, timestamps, error details - needed to operate and secure the service.
• When you last used the app. Once a day, when you open Twofold, we record that you opened it - a single timestamp, and nothing about what you did. It is what the two-year rule under "How long we keep it" reads. Each one replaces the last, so it is always a single date and never a history of your comings and goings.

Location

Location is optional, and only ever requested as "while using the app". Twofold never has access to your location in the background, or while the app is closed.

If you allow it, Twofold takes a single location fix and asks iOS to turn it into a city - when you first set your home city, when you tag a memory with where you are, and then automatically when you open the app, at most once an hour and only once you're connected to a partner. If you've moved to a different city, your home city is updated to match.

That means the city you're in is shared with your partner, and keeps up with you as you travel. What we don't do is follow your position. The reading itself never leaves your phone: it is turned into a city on the device, and what we receive is the city, the country, and a coordinate for that city rather than for you - the centre of the nearest large city we know of, or, where we don't know one nearby, your position rounded to about 11 kilometres. That coordinate is what draws the two of you on the globe and measures the distance between you, so we do need one; it is deliberately too coarse to identify a home. A new city replaces the last rather than building up a history of where you've been, and there is no live or continuous tracking at any point.

You can decline the permission and type your city in by hand instead, and you can change it at any time in iOS Settings. With location declined, your home city only ever changes when you change it yourself.

Sharing a flight email with Twofold

You can share a booking confirmation or boarding pass into Twofold from your mail app instead of typing a flight in by hand. When you do, the app holds the shared text on your device until you open it and ask for it to be read.

If you go ahead, the email's subject line and text - and, when those aren't enough to work from, text extracted from an attached PDF - are sent to OpenAI, which picks out the flight number, airports and departure time and sends them back to us. We send only what you shared into the app, and only at the moment you ask for it to be read. OpenAI processes it to answer that request and does not use it to train its models. Nothing is sent if you close the screen without confirming, and you can always add a flight by hand instead.

Camera, photos and the app lock

The camera is used only when you capture a boarding pass or travel document. Photos you attach to a memory are chosen through the standard iOS picker, which hands us only the photos you pick - Twofold never gets access to your photo library as a whole - and those photos are uploaded to your shared album. If you turn on the app lock, Face ID, Touch ID or your device passcode is handled entirely by iOS on your device: we never see it, the result never leaves the device, and whether the lock is on is stored only on that device.

How we use your information

• To run the core features: the globe, distance, trips, memories, flight tracking, games and widgets.
• To send the notifications you've asked for - partner activity, flight updates, streaks and reminders.
• To process and restore subscriptions, whether bought in the app or on this website.
• To read a flight email you've shared with us, when you ask us to.
• To answer your support requests, and to run the public feedback board.
• To diagnose faults, prevent abuse, and keep accounts secure.
• To understand which features are worth building on.

We don't show ads, we don't sell your information, and we don't use your content to train machine-learning models - ours or anyone else's.

What your partner can see

Sharing with your partner is the point of the app, so once you're connected they can see:

• The city you're in - either set by you, or updated automatically as you travel if you've allowed location access - your timezone, and the distance between you.
• Your trips, and your memories, including their photos, notes and places.
• Flights you've chosen to share, including live status and any boarding passes or documents attached to them. Every flight has a "share with my partner" switch, on by default; turn it off and that flight, its updates, its documents and its notifications stay yours alone.
• Your answers to games and prompts, and your shared streaks.
• Drawings you make on a shared pad.

These stay private to you:

• The nickname and photo you've set for your partner.
• Your answers to the setup questions, including gender.
• Flights you've switched sharing off for.
• Your notification preferences and app lock.
• Anything you send us in a support request.
• Which feedback requests you've bookmarked or followed.

The feedback board

The feedback board on twofoldapp.com.au is public, and it uses the same Twofold account you sign in to the app with. Anything you post there - the title and description of a request, and your comments - can be read by anyone, including people who aren't signed in and aren't Twofold users. So can the first name and profile photo from your Twofold profile, which appear next to what you post.

Nothing else from your account is exposed there. Your email address, your partner, your cities, trips, memories, flights and game answers are never visible on the board. Your votes are counted but not shown against your name, and your bookmarks and follows are private to you. If you'd rather not appear publicly, don't post or comment - reading and voting are enough to use the board.

Shared data, and who controls it

Content you and your partner create together belongs to the relationship rather than to one of you individually. In practice that means:

• While you're connected, either of you can see all of it.
• Ending a connection - by removing your partner, or by either of you deleting an account - archives it rather than deleting it. It stays readable to both of you in Settings → Help → Archived Data, but neither of you can change it any more.
• An archive is kept for 90 days, and is then permanently deleted for both of you. That happens automatically, on a date the app shows you on the archive itself. Neither of you can bring it forward and neither of you can put it off - there is no button anywhere in Twofold, for either partner, that deletes shared content early.
• If the two of you reconnect within those 90 days, you're offered your shared history back, and the deletion date goes away. This works when a connection was ended - it can't when either of you has deleted an account, because a deleted account can never be signed into again, and the archive is tied to the two accounts that made it.
• Either of you can hide an archive from your own list at any time. That affects only your own view - it deletes nothing, and your former partner still sees theirs.
• Either of you can export an archive while it lasts, which is how you keep what was in it. See Your rights below.

We settled on this because the alternative was worse in both directions. Letting one person delete the archive meant either of you could destroy the other's only copy of a history you both lived, without warning and without consent. Letting nobody delete it meant it lived forever. A fixed period that applies to both of you equally, that neither of you can aim at the other, is the one rule we could explain in a sentence - and the export means nobody has to keep the archive in order to keep what was in it.

Deleting your account

You can delete your account at any time from Settings → Delete Account. When you do:

• Your first name is replaced with "Deleted User", and your profile photo, home city, partner nickname and partner photo are erased.
• Sign-in is permanently disabled. You won't be able to sign back in, and the account can't be restored or recreated.
• Any active connection ends, and your partner is told you've left - the same as if you'd removed them.
• Your own uploads (your profile photo, your drawings) and all your notification tokens are deleted. The files themselves are removed from our storage provider within a day - the account is closed straight away, and the files follow on a job that runs daily.
• Shared content - trips, memories, photos, flights - is not deleted along with your account, because it is your partner's history too. Ending your connection starts the same 90-day archive clock described above, and it is permanently deleted for both of you when that runs out.
• Unlike simply removing a partner, this can't be undone by getting back together. An archive can be restored when the two accounts that made it reconnect, and deleting yours means one of them no longer exists - so the archive stays with your partner until its 90 days are up, and then goes.
• An empty profile record stays behind, holding no name, photo or city. It exists only so that the shared history above doesn't collapse along with it, and so the same account can't be signed into again.

Because you won't be able to sign in afterwards, export anything you want to keep before you delete your account. Deleting your account does not delete the shared archive, and neither you nor your former partner can delete it early - it goes when its 90 days are up. What is yours alone is removed straight away, as above, and cannot be recovered.

Deleting your account doesn't remove anything you posted publicly on the feedback board, since other people's discussions are built on it. Your name and photo stop appearing against it, and you can ask us to remove the posts themselves - email support@twofoldapp.com.au, including after you've deleted your account.

How we share your information

We do not sell your personal information, and never have. We share it only with the providers that make Twofold work:

• Our cloud platform provider - the database and your sign-in. Stored in Sydney, Australia.
• Our object storage provider - the photos, profile pictures, drawings and travel documents you upload. Held in the Oceania region.
• Apple - push notifications and Live Activities, turning a location fix into a city name, weather data, and App Store purchases.
• Google - only if you choose to sign in with a Google account.
• Our flight data provider - schedules and live status for the flights you track, in the United States. We send a flight number, never anything about you.
• OpenAI - reads a flight email you've shared with the app, and only then. See "Sharing a flight email with Twofold" above.
• Free community flight-tracking services - queried for an aircraft's live position and route. We send them a flight's callsign and nothing about you.
• A public airline-logo service - our servers fetch logos from it by airline code. Nothing about you is sent, and your device never contacts it directly.
• Our subscription management provider - keeps track of whether your subscription is active, across the app and the website. We send them your account identifier and your email address, so that somebody writing to us about a payment can be found in their records. United States.
• Stripe - payment processing for subscriptions bought on the website. You see Stripe by name at checkout.
• Our product analytics provider - usage analytics for the iOS app, held in the United States.
• Our email provider - sending and receiving support, waitlist and account email.
• Our website host - serving twofoldapp.com.au.
• Our content management provider - the website's marketing and legal pages. It holds no personal information.

Each of these processes data only as needed for that purpose. Where we've described a provider by what it does rather than naming it, that's to keep this list readable and to avoid it going stale every time we change supplier - email us and we'll tell you exactly who they are.

We may also disclose information where the law requires it, or to protect someone's safety - and we'll tell you when that happens unless we're legally prevented from doing so.

Twofold never sees or stores your card details. Those go directly to Apple or to Stripe.

Our legal bases for using your information

If you're in the EEA or the UK, we rely on the following bases:

• Performing our contract with you - running the app and your subscription.
• Legitimate interests - keeping the service secure, fixing faults, and understanding how it's used.
• Consent - location, push notifications and marketing email. You can withdraw it at any time.
• Legal obligation - records we're required to keep, such as those relating to purchases.

How long we keep it

• Your account and content are kept for as long as you use Twofold. If nobody opens the account for two years we close it and delete what's in it - we'll email you 30 days and 7 days beforehand, and opening the app is all it takes to stop it. This is based on use, not on whether you're subscribed: a lapsed subscription never starts that clock. If you're connected to someone, either of you opening the app keeps both accounts.
• After you delete your account, your identifying profile fields are cleared straight away. An empty profile record and a permanently disabled login are kept so the account can't be restored or recreated.
• Shared content is kept for as long as you're connected. Once a connection ends, the archive of it is kept for 90 days and then permanently deleted for both of you, automatically - unless you reconnect within that time, in which case it becomes live again and the deletion date goes away. An account closed for two years of inactivity ends the connection the same way, so the longest we hold shared content after the last time anyone opened the app is two years and 90 days.
• Invite redemption records are deleted automatically an hour after they're written.
• Rate-limiting records are deleted automatically, and none is kept longer than a day.
• Support records - your message to us, our replies, and any files attached - are kept even after the account they came from is deleted, so that a conversation is not destroyed by the request made inside it.
• Waitlist email addresses are kept until the Android app launches, or until you ask us to remove yours.
• Feedback board posts and comments stay up for as long as the board does, since they're part of a public discussion.
• Backups are kept for 7 days. Anything you delete goes from Twofold immediately - uploaded files within a day, as above - but can survive in a backup until that backup ages out, so for up to 7 days after you delete it, and no longer. The one exception is support records, which we keep as described above.
• Analytics events are kept for 30 days, and then deleted.
• Support email is kept for as long as we need it to handle your request and for our own records.

How we protect it

• Everything is encrypted in transit, and encrypted at rest by our hosting providers.
• Row-level security rules mean a request can only ever read data belonging to your own account or to your couple - this is enforced by the database itself, not just by the app.
• Uploaded files are namespaced per couple and per profile, under the same rules.
• Subscription status can only be written by our own servers in response to our subscription provider, never by a device claiming to have paid.
• You can lock the app behind Face ID, Touch ID or your device passcode.
• We're a small team, and access to production data is limited to what's needed to run the service.

No service can promise perfect security. If a breach ever affects your data, we'll contain it, investigate, and notify you and the relevant regulator as required by law.

Where your data is held

Twofold is operated from Australia, and the things that are most yours are stored close to home. Your account, your profile, and everything you and your partner create - trips, memories, flights and game answers - live in our provider's Sydney region, and anything you email us is held in Australia too. The files that go with them - your photos, your profile pictures, your drawings and any travel documents you upload - are held by our object storage provider in its Oceania region.

Some things are held in the United States: our website is served from there, our analytics provider stores its data there, and so do the providers that handle payments, flight information, and reading a flight email you've shared with us.

Where data leaves your country, we rely on the transfer safeguards those providers have in place, such as Standard Contractual Clauses for transfers out of the EEA and the UK.

Your rights

Wherever you live, you can ask us to:

• Give you a copy of the personal information we hold about you.
• Correct anything that's wrong.
• Delete your information.
• Export your information in a portable form.
• Restrict or object to how we use it.
• Withdraw a consent you've previously given.

Most of this you can do yourself in the app: edit your profile, delete individual trips and memories, or delete your account outright.

You can take a copy with you at any time, on any plan, from Settings → Help → Export your data: your trips, memories, flights and games as spreadsheets or as a data file, with the photos as ordinary image files. Nothing about it is charged for or held back.

Once a relationship has ended, the same export sits on its archive in Settings → Help → Archived Data - worth doing before that archive's 90 days are up. Premium subscribers can also export a Relationship Record: your story written out as a PDF or a Word document, from Settings → Your Relationship Record while you're together, or as part of an archive export afterwards. That one is a keepsake rather than a copy of your data, and nothing in it is missing from the exports above. If you want anything we hold that none of these covers, just ask.

For anything else, email support@twofoldapp.com.au. We'll respond within 30 days.

If you're in the EEA or the UK you can also complain to your local data protection authority. In Australia you can complain to the Office of the Australian Information Commissioner at oaic.gov.au. If you're in California, you have the right to know what we collect, to have it deleted, and not to be treated differently for exercising those rights - and, as above, we don't sell personal information.

Children's privacy

Twofold isn't intended for children. You must be at least 16 to create an account. If we learn that we've collected information from someone younger, we'll delete it. Parents and guardians can contact us at the address below.

Changes to this policy

We'll update this page as the app changes, and revise the date at the top. If a change materially affects your rights, we'll tell you in the app or by email before it takes effect.

Contact us

Questions, requests, or anything that doesn't look right: support@twofoldapp.com.au.

You can also use the support form at twofoldapp.com.au/support.