Privacy Policy

Last updated: 23 August 2026

This policy explains what personal data Twinpact collects, why, and what rights you have. Twinpact is operated by Twinpact, based in Portugal ("we", "us"). For any privacy question, contact us at support@twinpact.app. We are the data controller for the data described below.

1. Information we collect

Account and sign-in

When you create an account by signing in with Google, we receive your name, email address, and profile picture from Google. We do not receive or store your Google password.

Waitlist

If you join the waitlist before launch, we store your email address and the language of your browser, so we can email you when the app is available.

Couple profile and activity

• Your couple's name, optional photo, and "together since" date.
• Challenges you complete, points, levels, streaks, and badges you earn.
• Important dates you choose to save and be reminded of.
• Notes you write on a challenge (a private exchange between you and your partner).
• Optional memory photos you attach to a completed challenge.

Preferences and device data

• Your language, notification settings, and whether you have enabled the optional adult content category.
• A push notification token, app version, device type, and basic technical logs needed to run and secure the service.

Purchases

If you make a purchase (for example, a one-time purchase to remove ads), payment is processed by the Apple App Store or Google Play. We receive a confirmation that the purchase was made, but never your card or bank details.

2. How we use your data and our legal basis

• To provide the app - accounts, couples, challenges, progress, memories (performance of our contract with you).
• To send the launch and product emails you signed up for (your consent, which you can withdraw at any time).
• To send reminders and notifications about dates, streaks, and your partner's actions (your consent / our legitimate interest in a working app).
• To keep accounts secure and prevent abuse (our legitimate interest).
• To process purchases and show or remove ads (performance of contract / consent, as applicable).
• To comply with the law when we are legally required to.

3. The honor system

Completing a challenge is self-declared. We never ask for proof and we do not analyse your memory photos. There is no public or global leaderboard.

4. Who we share data with

We never sell your data. We share it only with the service providers that make the app work, acting on our instructions:

• Supabase - hosting, database, authentication, and file storage.
• Google - sign-in, and Firebase Cloud Messaging for push notifications.
• Resend - delivery of our emails.
• Cloudflare - this website and bot protection on our forms.
• Apple and Google - processing of in-app purchases.
• An advertising provider - to show ads in the free version (you can remove ads with a one-time purchase).

Your memory photos, notes, and the optional adult content category are private to your couple. They are never made public and never enter any sharing or social feature.

5. International transfers

Some of these providers operate outside the EU/EEA (for example, in the United States). When data is transferred outside the EU/EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

6. How long we keep it

We keep your account data while your account is active. If you delete your account, we delete or anonymise your personal data, except where we must keep some of it to meet a legal obligation. Waitlist emails are kept until launch or until you unsubscribe.

7. Your rights

Under the GDPR you have the right to access, correct, delete, restrict, or port your data, to object to certain processing, and to withdraw consent at any time. To exercise any of these, email support@twinpact.app. You also have the right to lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD).

8. Children

Twinpact is not intended for children under 16. The optional adult content category requires you to confirm you are 18 or older.

9. Security

We protect your data with encryption in transit, access controls, and row-level security, so that no other user can read your couple's data. Private memory photos and chat media live in private storage, never public, and are served only through short-lived signed links to the couple they belong to.

To be clear about the limits: this is not end-to-end encryption. As the operator of the service we hold the technical ability to access what is stored, and we use it only to keep the service running, to help you when you ask us to, or where the law requires it. We do not browse your memories, and we never use your photos for advertising or to train models. If we add end-to-end encryption, we will say so here.

10. Changes to this policy

We may update this policy as the app evolves. When we do, we will change the "last updated" date above and, for material changes, let you know in the app or by email.

11. Contact

Questions about your privacy? Email support@twinpact.app.