1. Who we are
TwoHugs is operated by Ivan Kupriienko ("we", "us"). This policy covers the TwoHugs iOS app, its widget, and this support website. For privacy questions or requests, email brokenarrovv@proton.me.
2. What we collect
Account and profile
Your app account identifier, the Apple sign-in identifier and email Apple provides (which may be a private relay address), your chosen display name, status, and mood. Apple may provide your name when you first sign in. We do not receive your Apple password.
Your shared space
Who you connect with, invitation records, and content you choose to share: drawings, photos, captions, answers, secrets, coupons, game moves and results, confirmations, and activity history. Photos or text can contain personal information you choose to include.
Subscriptions and coins
Subscription product, purchase and renewal information, trial eligibility, expiry and access status, and your in-app coin balance and transactions. Apple processes payment details. We and RevenueCat receive subscription records, not your full payment-card details.
Device and service information
Time zone for daily activities, notification tokens if you enable notifications, widget identifiers, app/platform information, and technical request logs that may include IP addresses and error information. We record service events such as pairing, a first exchange, and subscription milestones with account or pair identifiers and times.
Support and this website
If you email us, we receive your email address and what you send. Our website host processes requests and technical logs needed to deliver and secure these pages. This website does not use advertising scripts, analytics cookies, or a contact form.
Unshared drawing drafts and appearance preferences are stored on your device. The app also caches shared content locally so it can display in the app and widget. We do not request access to your address book or GPS location.
3. How we use this information
We use information to sign you in, connect your pair, synchronize the content you choose to share, run games and daily activities, calculate coins, display widgets, and send enabled notifications. Purchase records verify access, restore purchases, and help prevent billing fraud.
We use technical logs and limited service events to diagnose problems, secure the service, and understand use of pairing and subscriptions. Service-event analytics do not contain the text of your messages, answers, or secrets. We use support correspondence to respond to your request.
We do not sell your personal information or use it for cross-app advertising tracking. TwoHugs does not send your shared content to an AI model. Where applicable, we process information to provide the service you request, with your permission for optional features, for service security and operation, and to meet legal obligations.
4. Who can see your information
Your linked partner can see the profile and content you share with them, subject to the activity's rules. For example, a daily answer remains hidden until both people answer. The shared widget can display content on your partner's Home Screen, where other people looking at their device may see it.
Share only what you are comfortable sharing. Your partner can take screenshots or keep copies. TwoHugs cannot retract copies that someone has already saved outside the service.
Our providers process information needed to deliver the service:
- Supabase: sign-in sessions, application database, shared files, and server functions.
- Apple: Sign in with Apple, App Store purchases, and notifications.
- RevenueCat: subscription validation, purchase history, access management, and subscription analytics. We use your app account ID to associate purchases with your account.
- Netlify: hosting this support website and its technical delivery logs.
- Proton Mail: support emails you send to our published address.
We may access or disclose information when necessary to investigate a support or security issue, comply with a lawful request, or protect people and the service. We do not publish your pair's content in a public feed.
5. Storage, transfers, and security
Our primary application database is hosted in Canada. Providers may process information in other countries, including the United States, where local laws and lawful government-access rules may differ. Contact us for information about our providers and processing arrangements.
We use HTTPS, account-based access controls, private media storage, and temporary media links. Shared content is not end-to-end encrypted. The service and authorized providers process it to run the app. No method of storage or transmission can eliminate every security risk.
6. Keeping and deleting information
We retain account information and shared content while your account remains active and as needed to provide the service. Activity history and earlier versions of shared content may remain in storage. Replacing a moment, signing out, cancelling a subscription, or disconnecting a pair does not by itself delete all server records.
You can initiate account deletion in Settings → Your account → Delete account and confirm your Apple identity. Successful deletion removes your sign-in account, profile, and uploaded content from our active application backend and disconnects the pair. Your partner has a separate account; their own records may remain, while joint items can also be removed. See the account deletion guide.
Some purchase, service-event, security, or support records may be retained separately where needed for billing, resolving disputes, preventing abuse, or legal obligations. Provider logs and any backup copies follow their applicable retention cycles. Apple maintains its own purchase records. If you need help with deletion or a request involving a provider, contact us.
7. Your choices and requests
You can edit your name, status, and mood; choose what to share; disconnect your pair; and initiate account deletion. Camera and notification permissions can be changed in iOS Settings. You can remove the widget from your Home Screen at any time.
Depending on where you live, you may have rights to access, correct, obtain a copy of, delete, restrict, or object to processing of your personal information, and to withdraw consent for optional processing. Email brokenarrovv@proton.me. We may need to verify your identity before acting and will respond within the time required by applicable law. You may also contact your local privacy authority.
8. Children
TwoHugs is not directed to children under 13. You must also meet any higher minimum age or consent requirements that apply where you live. If you believe a child has provided personal information inappropriately, contact us so we can investigate and address it.
9. Changes and contact
We may update this policy as the service changes. We will update the effective date and provide any additional notice or choices required by law for material changes.
Privacy contact: Ivan Kupriienko, operator of TwoHugs.
brokenarrovv@proton.me