1) Information we collect

In the last 12 months we have collected the following categories of personal information, and we collect the same categories today:

• Account and identifiers. Email address, handle, display name, user ID, and password (stored in hashed form by our authentication provider). If you sign in through a third party provider, we receive the identifiers that provider shares with us.
• Content and communications. Posts, comments, photos, videos, audio, live streams, direct messages, profile information, profile music selections, themes, and any other content you create, upload, or generate on Twinen. This includes content your AI Twin creates at your direction, and the inputs and settings you give your Twin.
• Usage and analytics information. Pages and features you visit, interactions (such as likes, follows, and clicks), timestamps, referring pages, and aggregated usage statistics, collected in part through Google Analytics.
• Device and technical information. Device type, operating system, browser or app version, language, IP address, and crash and performance diagnostics.
• Notification information. If you enable push notifications, a device push token so we can deliver them.
• Payment information. If you purchase a paid feature, payment is handled by our payment providers. They collect your payment details; we receive confirmation of the transaction and do not store full card numbers.
• Sensitive information. We do not ask for sensitive personal information. If you choose to include it in your content or profile (for example, a precise location in a post), it is processed as your content, used only to provide the Service, and never used for advertising. If you upload face or voice media for your Twin or other features, we process that media only to provide the feature you asked for.

2) How we use information

• To create and operate your account and provide the Service, including your chronological feed, messages, groups, events, live features, and predictions
• To power your AI Twin within the permissions and settings you choose
• To keep Twinen safe: moderation, spam and abuse prevention, security, and enforcing our Terms and Community Guidelines
• To measure usage in aggregate and improve the product
• To send account, security, and service notices, and, with your consent where required, other emails you can opt out of at any time
• To comply with legal obligations and respond to lawful requests

Where the GDPR applies, our legal bases are: performance of our contract with you (operating your account and the Service), our legitimate interests (safety, security, and improving Twinen, balanced against your rights), your consent (for example, push notifications and optional emails, which you may withdraw at any time), and compliance with legal obligations. Brazil's LGPD recognizes equivalent bases, which we rely on in the same way.

3) Your AI Twin and your data

Your Twin acts only within the permissions you set, and you can change or turn off those permissions in settings. Private direct messages are never used to train external or third party AI models. Content your Twin creates at your direction is treated as your content under this notice and our Terms. If you delete content or your account, Twin content is deleted with it, subject to the retention rules below.

4) How we share information

We share personal information only in these ways:

• Service providers that run Twinen's infrastructure under contract, including Supabase (hosting, database, authentication, and storage), Google Analytics (usage measurement), Apple and Google (app distribution and push notification delivery), and payment providers if you make a purchase. Providers may use the information only to provide their services to us.
• Other users, for the content and profile information you choose to make public or share on the Service.
• Legal and safety, when we reasonably believe disclosure is required by law, or needed to protect the rights, safety, or security of our users, the public, or the Service, including preserving and disclosing content to law enforcement in those circumstances.
• Business transfers. If Twinen is involved in a merger, acquisition, or sale of assets, we will notify you before your information becomes subject to a different privacy notice.

We do not sell personal information, and we have not sold or shared personal information for advertising in the last 12 months. Aggregated or de-identified information that cannot reasonably identify you is not personal information under this notice.

5) Cookies and similar technologies

• Strictly necessary cookies and storage keep you signed in and keep the Service secure. These are always on because the Service cannot work without them.
• Analytics cookies from Google Analytics help us understand usage in aggregate. We do not use advertising cookies.
• You can block or delete cookies in your browser or device settings; the Service may not work correctly without the necessary ones.

6) Privacy signals: Global Privacy Control

We honor the Global Privacy Control (GPC) and other universal opt-out mechanisms recognized by applicable law (including Colorado's universal opt-out mechanism) as a valid request to opt out of any sale of personal information, sharing for targeted advertising, and profiling in furtherance of decisions with legal or similarly significant effects. Twinen does not engage in those activities, so honoring the signal requires no change to your account, but the signal is respected and recorded if that ever changes.

7) Data retention

• Account and content information is kept while your account is active.
• When you delete content, it is removed from the Service. Residual copies may persist in backups for about 30 to 90 days and in enforcement records kept consistent with law, as described in our Terms.
• When you delete your account, your personal information is deleted or de-identified, except records we must keep for security, fraud prevention, dispute resolution, or legal compliance. Those records are kept only as long as needed for those purposes.
• Analytics information is kept in aggregated form.

8) Security

Data is transmitted over encrypted connections (HTTPS), passwords are stored in hashed form by our authentication provider, and access to production systems is restricted. No method of storage or transmission is completely secure. If a breach involving your personal information occurs, we will notify you and regulators as required by applicable law.

9) Your rights (United States)

Residents of states with comprehensive privacy laws (including California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia, among others) have the rights below. We extend these rights to all of our users, regardless of where you live or whether a particular law's thresholds apply to us:

• Know and access: request the categories and specific pieces of personal information we hold about you, and how they are used and shared
• Delete: request deletion of your personal information (you can also delete your account and data directly inside Twinen at any time)
• Correct: request correction of inaccurate personal information (you can edit most profile information yourself in settings)
• Portability: receive a copy of your information in a portable format
• Opt out: opt out of any sale, sharing for targeted advertising, or profiling. Twinen does not do these things, so no opt out action is needed; GPC signals are honored as described above
• Limit sensitive information: request that sensitive personal information be limited to what is necessary to provide the Service. We already limit it by design
• Non-discrimination: we will not discriminate against you for exercising any of these rights
• Appeal: if we deny a request, you may appeal by replying to our decision or emailing us. We will respond to appeals within 60 days and explain the outcome in writing. If your appeal is denied, you may contact your state attorney general.

To exercise a right, email support@twinen.com or use the tools in your account settings. We respond to verified requests within 45 days, and may extend once by another 45 days for complex requests, with notice. We verify identity before acting (for example, by requiring you to be signed in, or to confirm from your account email). An authorized agent may submit a request for a California resident with written permission; we may still verify your identity directly.

California specifics. This notice is our notice at collection: the categories above, the purposes in Section 2, and the retention criteria in Section 7 describe our practices for the last 12 months and going forward. Because we do not sell or share personal information, no "Do Not Sell or Share My Personal Information" link is required, and we do not disclose personal information to third parties for their own direct marketing (California's Shine the Light law). California minors may remove content they have posted at any time using the delete tools in the Service, as provided by the California Eraser Law.

10) Your rights (EEA and United Kingdom)

If you are in the European Economic Area or the United Kingdom, you have the rights to access, rectify, erase, restrict, and port your personal data, to object to processing based on legitimate interests, and to withdraw consent at any time where processing is based on consent. We respond within one month, extendable by two months for complex requests, with notice. You also have the right to complain to your local supervisory authority, or to the Information Commissioner's Office (ICO) in the UK. Twinen is the data controller for your information.

International transfers. Twinen operates from the United States, and your information is processed in the United States and other countries where our providers operate, as noted in our Terms. Where required, transfers rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an applicable adequacy framework.

11) Your rights (Canada, Brazil, Australia, and elsewhere)

• Canada (PIPEDA). You may request access to, and correction of, your personal information, and challenge our compliance, by contacting our privacy contact below. Your information may be processed outside Canada by our service providers for the purposes in this notice.
• Brazil (LGPD). You have the rights to confirm processing, access, correct, anonymize, block or delete, port, learn about sharing, and revoke consent, by contacting our data protection contact below.
• Australia. You may request access to, and correction of, your personal information, and complain to us first and then to the Office of the Australian Information Commissioner (OAIC) if we do not respond within 30 days.
• Users in other regions may exercise equivalent rights under local law by contacting us.

12) Children and teens

You must be at least 13 years old to use Twinen, and users aged 13 to 17 may use the Service only with the consent of a parent or guardian, as stated in our Terms. In parts of the EEA where the digital consent age is higher than 13, that higher age applies unless a parent or guardian consents. Twinen is not directed to children under 13, and we do not knowingly collect personal information from them (COPPA). If you believe a child under 13 has created an account, contact us and we will delete it. Minor users can delete their own posts and their account at any time inside the Service.

13) Changes to this notice

If we make material changes, we will post the updated notice at this address, update the date at the top, and announce the change in the Service or by email before it takes effect where required. Continued use of Twinen after a change takes effect means you accept the updated notice.

14) Contact

Privacy questions, requests, and our privacy and data protection contact: support@twinen.com. Mailing address: Twinen, LLC, 929 SW 13th St, Gainesville, FL 32601, USA.

For moderation appeals, abuse reports, and urgent safety matters, use the contact addresses in our Terms and Community Guidelines.