1. Who is responsible for your data
The controller for Twyn is Twyn, 90 Atekong Drive, Nigeria. You can contact us at legal@twynd.de. Additional company and register information is available in our Imprint.
This policy is version 2026-08-25 and applies to the Twyn website, mobile app, and related services.
2. Scope and where data comes from
We receive personal data from four main sources:
- From you, when you create an account, complete a profile, verify an email address, publish content, communicate, join a collaboration, enable notifications, or buy a subscription.
- From GitHub, when you choose GitHub sign-in. This can include your GitHub identifier, username, avatar, profile URL, and verified email address.
- From other members, when they interact with you, invite or vouch for you, or submit a safety report involving your account or content.
- Automatically, from your browser, app, and our infrastructure when you use Twyn.
3. Data we process
- Account and authentication: name, email, password hash, verification status, session data, password-reset and verification tokens, GitHub account details, account status, and creation time.
- Builder profile: avatar, headline, biography, skills, collaboration intent, current focus, availability, city, primary and sought roles, collaboration type, project stage, weekly commitment, timezone and UTC offset, working rhythm, commitment duration, start timing, compensation preference, and—if provided—coordinates used for location matching.
- Student profile and verification: persona, institution, field of study, expected graduation year, interests, campus-discovery preference, academic email address, verified domain, and verification time. Verification shows control of an address on that domain; it is not proof of current enrollment or institutional endorsement.
- Content and relationships: posts, comments, messages, connection requests, collaboration asks and interests, founder-curated introductions and responses, follow-up notes and recorded outcomes, community activity, files and images, vouches, blocks, reports, and moderation records. Private founder follow-up notes are not shown to matched members.
- Rooms and projects: membership, roles, presence, chat, notes, tasks, links, call state, signaling messages, and AI-generated recaps.
- Technical and security data: IP address, user agent, request and error data, rate-limit records, device or push tokens, notification subscriptions, and timestamps.
- Usage and sponsored-content events: first-party product events and campaign impression or click counts. Twyn does not use a third-party advertising network or cross-site advertising tracker.
- Billing: Stripe customer and subscription references, plan status, and transaction status. Stripe receives payment details; Twyn does not store full card numbers.
4. Why we process data and our legal bases
| Purpose | Typical data | Legal basis under the GDPR |
|---|---|---|
| Provide accounts, profiles, discovery, matching, messaging, communities, rooms, projects, notifications, and support | Account, profile, content, relationships, and device data | Performance of our contract with you (Art. 6(1)(b)) |
| Provide Pro subscriptions and administer payments | Account, plan, Stripe references, and transaction status | Contract (Art. 6(1)(b)); legal obligations for required financial records (Art. 6(1)(c)) |
| Secure Twyn, prevent fraud and abuse, enforce rules, investigate reports, and protect members | Technical data, content, reports, blocks, and account status | Our legitimate interests in a safe and reliable service (Art. 6(1)(f)); legal obligations where applicable (Art. 6(1)(c)) |
| Measure and improve product reliability and collaboration outcomes | First-party usage events, errors, and aggregated campaign events | Our legitimate interests in improving Twyn (Art. 6(1)(f)) |
| Send optional email digests or push notifications | Contact details, preferences, push subscriptions, and relevant activity | Your choice/consent where required (Art. 6(1)(a)); service communications necessary for the contract (Art. 6(1)(b)) |
| Establish, exercise, or defend legal claims and answer lawful requests | Relevant account, content, billing, and audit records | Legal obligation (Art. 6(1)(c)) or legitimate interests (Art. 6(1)(f)) |
Where we rely on legitimate interests, we assess those interests against your rights and reasonable expectations. You may object as described below.
5. What is public and what is shared
Twyn is designed for discoverability. A profile page may be visible without signing in and can show your name, avatar, headline, biography, skills, city, collaboration intent, current focus, availability, primary and sought roles, collaboration type, project stage, weekly commitment, timezone, working rhythm, GitHub username, student profile fields, verified academic domain, and vouches. We do not display your login email, academic email address, precise coordinates, UTC offset, or password data publicly.
Posts and collaboration asks may be visible to other members or publicly where the interface says so. Messages, private-community content, room materials, projects, and calls are shared with the participants or members shown in that space. Anything you share can be copied or re-shared by recipients, so do not upload secrets or information you are not authorized to disclose.
Uploaded images and attachments can be delivered through public object URLs. A private-space membership check protects discovery through Twyn, but anyone who obtains an object URL may be able to open it. Treat file links as shareable and do not use Twyn as a vault for credentials or confidential source material.
6. AI matching and session recaps
Twyn uses Anthropic models for collaborator recommendations, collaboration-ask recommendations, and requested room recaps. Depending on the feature, we send the profile fields of you and candidate members, or recent room chat, notes, tasks, and room name. Inputs are limited in length and selected for the requested result.
AI scores and explanations are recommendations, not facts about a person. Twyn does not use them to make decisions that produce legal or similarly significant effects. When the provider is unavailable, matching may fall back to Twyn's own profile and intent signals. Do not place confidential or special-category personal data in content you ask Twyn to summarize.
7. Calls, media, and device permissions
If you enable a room call, your browser or phone asks for microphone, camera, screen-share, and related device permissions. Audio, video, and screen media are sent directly between authorized room participants through WebRTC where possible, or through a configured relay when direct connection is unavailable. Twyn handles limited signaling and call-presence metadata needed to establish and operate the call.
Twyn does not record room audio, video, or screen shares as part of the current service. Other participants may use their own tools; obtain consent before recording and follow applicable law.
8. Cookies, app storage, and similar technology
The website uses strictly necessary, HTTP-only cookies for sign-in and short-lived GitHub OAuth security state. The interface also stores limited preferences locally, such as sidebar state and dismissed sponsored cards. The mobile app stores the session token in the device's secure storage and may store small caches or preferences needed for the app.
These technologies are required to provide a service you request or remember an interface choice. We currently do not use non-essential analytics cookies or third-party advertising cookies. If that changes, we will update this policy and request consent where required.
9. Recipients and service providers
We disclose data only as needed to operate Twyn, follow your instructions, protect the service, or comply with law. Key providers include:
- Neon for hosted PostgreSQL databases.
- Vercel for application hosting, delivery, and public image/file storage.
- Anthropic for the AI functions described above.
- Stripe for checkout, subscriptions, billing portal, and payment records.
- Resend for verification, password-reset, service, and optional digest emails.
- GitHub when you choose GitHub sign-in.
- Apple, Google, and Expo push infrastructure when you enable mobile push notifications; browser push services when you enable web push.
- Call relay infrastructure if a WebRTC connection needs a configured TURN relay.
We may also disclose data to professional advisers, authorities where legally required, or a successor in a merger, financing, reorganization, or sale, subject to applicable safeguards. We do not sell personal data.
10. International data transfers
Some providers or their subprocessors may process data outside your country or outside the European Economic Area. Where the GDPR requires a transfer mechanism, we use an adequacy decision or appropriate safeguards such as the European Commission's Standard Contractual Clauses, together with supplementary measures where appropriate. Contact us for information about the mechanism relevant to your data.
11. Retention and account deletion
We keep data only as long as needed for the purposes above:
- Account and profile data are kept while your account is active. Session tokens expire, and verification or reset tokens expire after a short period.
- Messages, room materials, community content, projects, and other shared work remain while the relevant space or content remains available.
- Security, rate-limit, moderation, and audit records are retained for a limited period appropriate to abuse prevention, dispute handling, and legal claims.
- Billing and transaction records are retained for the period required by tax, accounting, and commercial law.
- Provider backups expire on their normal backup cycles.
You can delete your account from settings. Twyn removes personal-only records, authentication access, push tokens, matching cache, and profile identity. To avoid destroying other people's work, shared content can remain attributed to “Deleted user” after identifying account fields are scrubbed. We may retain limited records where required by law or necessary for legal claims, fraud prevention, and enforcement.
12. Your privacy rights
Subject to applicable law, you may ask us to:
- confirm whether we process your personal data and provide access to it;
- correct inaccurate or incomplete data;
- delete data, restrict processing, or provide portable data;
- object to processing based on legitimate interests or to direct marketing;
- withdraw consent at any time, without affecting earlier lawful processing; and
- explain the safeguards used for an international transfer.
Use profile/settings controls where available or email legal@twynd.de. We may verify your identity before fulfilling a request. You may also complain to the data-protection authority in your habitual residence, place of work, or where you believe an infringement occurred. You will not be treated differently for exercising a privacy right.
13. Security and incident response
Twyn uses encrypted transport, hashed passwords, HTTP-only session cookies, secure mobile credential storage, access checks, rate limits, file validation and metadata stripping, provider access controls, and restricted moderation tools. No service can guarantee absolute security. If a personal-data breach creates a legally reportable risk, we will notify the relevant authority and affected people as required.
14. Age requirement
Twyn is not intended for anyone under 16. If you believe a person under 16 has provided personal data, contact us so we can investigate and take appropriate action.
15. Changes and contact
We may revise this policy as Twyn, its providers, or applicable law changes. We will change the effective date and provide an in-product or email notice before a material change where required. Questions, requests, or complaints can be sent to legal@twynd.de or to the service address in our Imprint.