Zero Knowledge Principle: Messages and shared media in Twosome are end-to-end encrypted on your device using libsodium. We do not hold the decryption keys and cannot read or inspect your private conversations.
1. Information We Collect
We believe in absolute data minimization. We collect only what is strictly required to operate your private space:
Account Identifier: Phone number in E.164 format (used as your account identifier; no SMS verification is triggered) and optional recovery email.
Age Confirmation: Year of birth confirmation confirming you are 18 years or older.
Public Keys: Public encryption keys (X25519) required to establish the end-to-end encrypted channel between paired devices.
Encrypted Content: Ciphertexts of messages and media blobs. The server never receives plaintext.
Zero Third-Party Cloud Tokens: We do not require Firebase or external third-party cloud services. Real-time updates occur directly via private server polling and local device alerts.
2. How We Use Information
To establish secure cryptographic pairing between two partners.
To relay encrypted messages and files.
To deliver generic, privacy-safe notifications ("New message", "Partner answered") without message content.
To enforce security limits (rate limiting against brute force attempts).
3. Third Parties and Subprocessors
Zero Third-Party Processors: We do not sell, rent, or trade your personal information. Twosome operates on a 100% self-hosted architecture with zero third-party advertising networks, zero third-party analytics trackers, and zero required external cloud providers (No Firebase or Google Cloud). All communication runs strictly between your device and your private hosting server.
4. Data Retention and Deletion
Couples may enable disappearing messages (1 hour or 24 hours). Expired messages and temporary pairing codes are purged regularly.
You can delete your account and all associated data at any time from within the app settings or via our Account Deletion Page.
5. Contact Information
For questions or data inquiries, contact us at [YOUR_EMAIL@YOURDOMAIN.COM], operated by [YOUR_COMPANY_OR_NAME].