Privacy Policy

Your name and the email address on the account you sign in with (Google or Apple). The board you share: its spaces, cards, notes, steps, due dates, calendar entries, and any photos or files you attach. Your weekly check-in answers. Your conversations with Juno, and the memory Juno builds from them. Your timezone, quiet hours, and, if you turn nudges on, a push token for each device. If you subscribe, your subscription status and a Stripe customer reference.

We also keep an event log of changes on your board (who moved what, when), because Juno reasons from it, and minimal operational logs (errors, request timing) to keep the service running. We do not collect your precise location, your contacts, or your browsing elsewhere, and there are no advertising or analytics trackers in the app or on the site.

The two people on a board can see everything on that board: the cards, the check-in answers, the shared room, the photos. That is the point of it. When you invite your partner, or accept an invite, you are choosing that sharing.

Your private thread with Juno is the exception. Your partner cannot read it. It is not returned to their client, the database rules deny it outright, and when Juno assembles context it is only ever given the memory belonging to whoever it is speaking to.

Other Twofold users cannot browse your board. Boards are not public, there is no directory, and files are served through temporary links. The service providers below process data to run the app; authorized operational access may be needed for support, security, and maintenance.

We use a small number of service providers, each only for its job, each bound by its own contractual privacy obligations:

Anthropic processes the text Juno needs to answer you: your message, the relevant board content, and the relevant memory. Before it is sent, your names and email addresses are replaced with codenames, and the real names are put back only in what you see. Anthropic does not train its models on this data. Juno is an AI assistant, built on Anthropic's Claude models; Juno's replies are generated by a machine.

TypeSafe runs Jev, a small model that makes quick yes-or-no decisions so Juno stays fast and quiet: whether a reminder is worth sending now, and, once both of you have agreed to it, whether a message needs Juno to reply, look something up, or just answer briefly. For reminders Jev is sent only numbers, such as how many cards are due and how long since anyone was active, never card text or names. For chat decisions it is sent the message and a line of context, with your names replaced by codenames. It never writes to you.

When you import a note and ask Juno to read it, the text of that note is processed the same way, once, to suggest cards. We do not keep the note itself; only the cards you choose to add are saved. In the iPhone app, text in a photo is recognised on your device and the photo is not uploaded.

The iPhone app sends us crash and hang reports produced by iOS, and a short list of named actions such as creating a board, sending an invitation or opening the subscription screen, together with the app version, iOS version and device model. We use them to fix faults and to see where the app is confusing. They never contain what you typed: no card titles, messages, notes or calendar entries. They are stored on our own servers, are not shared with advertisers or analytics companies, and are not used to track you across other apps or websites.

If you subscribe inside the iPhone app, Apple takes the payment. We receive a signed record of the subscription (the product, its dates and an identifier for the purchase) so that Juno can be switched on for your board. We never see your card or Apple ID details.

If you connect Apple Calendar in the iPhone app, your calendar events are read on your device so they can be shown beside your shared plans. They are not sent to us, to your partner, or to Juno. An event reaches the board only if you choose to share it, and then only its title, date and time. The Twofold calendar the app keeps on your phone holds a copy of your board's dates and is removed when you switch the option off.

Both people must join the board and explicitly enable Juno before new Juno requests or background processing can use your board content, messages, and check-ins. Either person can turn this permission off in Settings. This blocks new processing, but cannot undo processing already started and does not by itself delete existing conversations or memory. Deletion controls are described below.

Google Cloud and Firebase host the app, the database, the files and sign-in. Apple delivers push notifications to iPhones. Resend delivers our emails (invites and nudges). Stripe processes payments if you subscribe; your card details go to Stripe directly and are never stored by Twofold.

When Juno looks something up it performs a web search. What it searches for is derived from what you asked and relevant board context. Queries are processed through Anthropic's hosted research tools and may contain details you supplied. We do not promise that research queries are anonymous.

We do not sell or rent your data, we do not share it for advertising, and we disclose it beyond the providers above only if the law genuinely requires it. If that ever happens, we will tell you unless we are legally barred from doing so.

Board content, check-ins, and Juno's memory are kept for as long as the board exists, because the product's value is the history. Push tokens are pruned when a device stops accepting them. Operational logs and any backup copies follow the retention settings of the systems that hold them. Feedback you send us is retained for support and account requests. Deleting live data does not necessarily remove every residual provider log or backup immediately. Contact us through Feedback if you need details about retention or deletion for your account.

All traffic is encrypted in transit (TLS), and data is encrypted at rest by Google Cloud. On top of that, what you write (cards and their notes, messages, check-in answers, reminders, calendar entries and what Juno remembers) is encrypted again with a key for your board, which is itself locked by a key in Google Cloud's key management service that only our server can use. The database stores scrambled text, so we do not browse it, and every use of that key is recorded in an audit log. Access is gated by verified sign-in tokens on every request; database rules deny anything not explicitly allowed, including your partner reading your private thread. Secrets and keys live in server configuration, never in the apps. No system is perfectly secure, and we cannot guarantee absolute security. If we learn of a breach affecting your data we will notify you without undue delay, as the law requires.

Wherever you live, we honor the substance of modern privacy law (including GDPR and CCPA-style rights): you can access what we hold about you, correct it, export it, delete it, and object to processing that is not needed to run the service. Most of this you can do yourself in the app; for the rest, use the Feedback button and we will handle it within 30 days. We do not discriminate against you for exercising any right. Since we do not sell data or run ads, there is nothing to opt out of on that front.

Push and email notifications are optional. Proactive Juno nudges are capped at two per day; requested reminders, partner mentions, task assignments, and service messages are separate. Quiet hours can defer reminder delivery. Juno permission and notification preferences can be changed in Settings. Cookies: we use only what sign-in requires and a little local storage for your preferences, with no tracking cookies.

In Settings, Delete my account removes your sign-in, your private thread with Juno, and Juno's private memory of you, permanently. You can also request deletion through the Feedback button (choose "Delete my account") and we will do it for you.

If your partner is still on the board, the board itself and the cards and check-ins you built together survive, because that history is theirs as much as yours. If nobody is left, the entire board and everything under it is deleted.

Make Juno forget everything clears what Juno has learned without touching your board.

One thing is kept after an account is deleted: a one-way fingerprint of the email address, made with a secret key. It cannot be turned back into your email. Its only use is to recognise an address that has already had the free trial, so a new account on the same address starts without one.

Twofold runs on Google Cloud in the United States, and our providers process data there. If you use Twofold from elsewhere, you are choosing to have your data processed in the US under this policy, with the safeguards described above.

Twofold is for adults and is not directed at children under 13. We do not knowingly collect data from children under 13; if we learn we have, we delete it.

If we change what we collect or who we send it to, we will update this page and, for significant changes, tell you in the app or by email before the change takes effect. The "last updated" date above always tells you the current version.

Questions, or a request to see, export, or remove your data: use the Feedback button, bottom right of ourtwofold.com or in the app's Settings. It reaches a human.