Privacy policy
Last updated: 2 November 2026
Twine is made by ENA Apps, Izmir, Türkiye ("we"). This policy explains what Twine collects, why, who else handles it, and what you can do about it. Questions: support@enaapps.com.
What Twine collects
| What | Why | Where it comes from |
|---|---|---|
| Your phone number | To sign you in with a one-time code by SMS | You type it |
| Your profile: name, colour, time zone | So your group knows who wrote what, and reminders fire at your local time | You choose the name and colour; the time zone is your phone's |
| What you create: messages, photos, captions, reactions, mentions, todos, dates, the place you type for a date, notes, lists | That is the app | You |
| Group facts: which groups you're in, your role, when you joined, which messages you've read, who is assigned which todo | To show the right things to the right people | The app, as you use it |
| A push token for each phone, and whether it's iOS or Android | To send you notifications | Your phone, once you allow notifications |
| Usage events: 18 kinds of action, such as "message sent" or "todo completed", with the time and the group | To learn which parts of Twine people use | The app. Events never include what you wrote: only the action, ids and yes/no flags |
| Wrong invite codes you enter | To stop people guessing codes (10 an hour) | The app |
Twine does not collect your contacts, your location or your microphone. It uses the camera and photo library only when you choose to send a photo. It does not show ads, does not track you across other apps or websites, and does not sell or share your data for advertising.
Who can see what you create
- Your group. Everything in a group's open topics is visible to the people in that group (at most 8).
- Private topics are visible only to the people added to them. The group's owner cannot see a private topic they aren't in.
- People who leave or are removed lose access to the group from then on. Their phone deletes its copy of the group.
- We (the people who run Twine) can technically access the database to operate and fix the service. We look at content only when needed to keep Twine working, to answer a request from you, or when the law requires it.
Who else handles your data
We use these companies to run Twine. They process data only on our behalf.
| Company | What it does for Twine | What it receives |
|---|---|---|
| Supabase | Database, sign-in, photo storage, server functions | Everything above. Stored in the EU (Frankfurt, Germany) |
| Twilio | Sends the sign-in code by SMS | Your phone number and the code |
| Expo, then Apple (iOS) or Google Firebase (Android) | Deliver notifications | Your push token and the notification text: the topic name, the sender's name and the start of the message (or "Photo"), or the todo title |
| Google Maps | Only when you tap "Directions" on a date | The place text of that date, sent by your phone to Google |
Notifications can show on your lock screen, including the start of a message.
On your phone
Twine keeps a copy of your groups on your phone so it works offline. On iOS and Android that copy is encrypted. Signing out or deleting your account removes it from that phone.
How long we keep it
- While you have an account, we keep what you create until you or someone with the right to do so deletes it.
- Deleted messages lose their text and photo straight away. A deleted todo, date, note or topic is removed with everything in it.
- Photo files whose message or topic has been deleted are removed from storage within about a day.
- Usage events are kept for 13 months.
- Technical logs (sync records and security events, which hold ids but no content) are kept for 90 days.
- Wrong invite codes are kept for a day.
Deleting your account
In Twine: Settings → Delete account. This cannot be undone. See Delete your account for exactly what is deleted and what stays, and how to ask us if you can no longer use the app.
Your rights
You can get a copy of your data in the app (Settings → Export my data, a file of everything you can see). You can change your name and colour in Settings. You can delete your account as above.
If you are in the EU or UK, the GDPR also gives you the right to restrict or object to processing, and to complain to your data protection authority. Our legal basis is performing our contract with you (running Twine), and our legitimate interest in keeping Twine secure (rate limits) and improving it (usage events).
We do not sell or share personal information as defined by the California Consumer Privacy Act.
Children
Twine is not meant for children under 13. If you learn that a child has given us data, contact us and we will delete it.
Changes
If we change this policy in a way that matters, we will say so in the app before the change takes effect.