Privacy policy
Last updated: 1 November 2026
TwoIn is an app for two people: each designs the other's wallpaper. This page explains what data the app uses, why, where it is stored, for how long, and how to exercise your rights. TwoIn has no ads, no advertising trackers and no audience analytics. The rules for using the service are set out in the terms of use.
Who is responsible for your data
The data controller is [publisher or company name, address]. Contact: [contact email].
The data we use
| Data | Why |
|---|---|
| Phone number, or email address, or Google account | To sign you in and secure your account (code by text message or email). |
| Display name, profile photo, status message | To introduce you to the people in your Duos. |
| Fingerprints of your contacts' numbers | To find your people who already use TwoIn. Numbers are turned into unreadable fingerprints (SHA-256) on your phone: no number is sent in plain text. We only keep the list of registered contacts you found, for the "invitations from my contacts only" setting. |
| Wallpapers, photos, doodles, music, capsules (text, photo, audio) | To share them with the person in your Duo and keep them in your history. |
| Presence (online, last seen) | To show your Duo whether you're around. Can be turned off in settings. |
| Device notification identifier | To tell you about a new wallpaper, capsule or invitation. Adjustable per notification type. |
| Invitations, blocks, reports | To run Duos and protect users. |
| Sign-in codes sent by email | To verify your sign-in. Only a fingerprint of the code is stored; it is valid for 10 minutes. |
Wallpapers you send are fresh images made by the app: your photos' location data is not transmitted. Profile and capsule photos are recompressed without their metadata.
Legal basis
This processing is necessary to provide the service you ask for when you create an account (performance of a contract). Access to your contacts, notifications, camera and microphone relies on your consent, given in your phone's settings and revocable at any time.
Who has access
What you create is only visible to the person in your Duo. We do not sell or rent your data. We use technical providers who process it on our behalf:
- Google Firebase: sign-in, notifications and real-time sync.
- Neon: database, hosted in the United States (Amazon Web Services, Ohio).
- Cloudflare R2: storage of images and audio files.
- GIPHY: sticker search in the editor. Your searches go through our server; sticker images are loaded from GIPHY's servers.
- Server host: [host name and country].
- Email delivery: [email service used].
Some of these providers may process data outside the European Union; such transfers rely on the European Commission's standard contractual clauses or an equivalent mechanism.
How long
Your data is kept as long as your account exists. When you delete your account (Settings > Account > Delete my account), your data is erased, your Duos end and your sign-in account is deleted. Unaccepted invitations expire automatically. A report may be kept as long as needed to handle it.
Your rights
You can access, correct, erase, restrict, object to and port your data. The app lets you edit your profile, delete your account and export your data as an encrypted file that TwoIn can read back. To get a readable copy of your data or exercise any other right, email [contact email]. To delete your account without the app, see Delete your account. You may also lodge a complaint with your data protection authority (in France, the CNIL: cnil.fr).
Security
Traffic with our servers is encrypted. Every request is authenticated, and a Google sign-in must be confirmed with a code sent by email. Export files are encrypted (AES-256-GCM) and tied to your account.
Minors
TwoIn is only for people aged 15 and over. If you learn that a child under 15 is using the app, email us and the account will be deleted.
Changes
We will update this page as the app evolves. The date at the top shows the latest version.