Twogether is an app for two people who share a household. This policy says what it holds about you, why, who else can see it, and how to get it back or get rid of it. It is written to be read rather than to be complied with.
Who is responsible
[IDENTITY]
If anything here is unclear, or you want to exercise any of the rights below, write to the address above and you will get an answer from a person.
What is held about you
Your account. Your email address, the name you chose to be shown as, and — if you signed up with a password — a one-way hash of that password, never the password itself. If you signed in with Google, the identifier Google gives us for you and the address on that Google account. Also the language you prefer to receive email in.
Your sessions. One row per device you are signed in on, holding the device's browser description and the IP address it last connected from, so that you can see your devices and sign a lost one out.
Your household's records. Everything the two of you put in the app: expenses, income, transfers and settlements with their amounts, dates, categories and notes; savings goals and contributions; the shopping and wishlist entries, including any photo you upload and any link you paste; chores and when they were done; meals; and calendar events.
Technical records. One line per request reaching the server, holding the time, the method and path, the response status, how long it took and the calling IP address. The contents of a request are never written to a log. If error tracking is enabled on the deployment you use, an unexpected failure also sends a stack trace and the request's id.
Addresses that bounce. If email to your address is rejected permanently, the address is kept on a list so nothing is sent to it again.
What is not held
- No advertising identifiers, no analytics, no tracking pixels, no third-party scripts on the page.
- No payment details. There is nothing to pay for yet, and when there is, the card details will go to the payment provider and never through this app.
- No location, no contacts, no calendars other than the events you type in yourself.
- Nothing is sold, rented or handed to anybody for their own purposes. Ever.
Why it is held
- To run the app you asked for — your account, your household's records, your sessions. In legal terms this is the performance of a contract with you: without it there is no app.
- To keep the app safe — the technical records, the rate limits and the bounce list. This is a legitimate interest, and it is a narrow one: it exists to stop somebody guessing your password and to stop the sending domain being burned.
- To send you a notification — only if you turned notifications on, and you can turn them off in Settings at any time.
Who else can see it
The other person in your household sees your household's records. That is what the app is. Both of you can see and change every expense, chore, meal and list entry in the room you share, and each of you can see the other's name and emoji. Only one thing is different: a savings goal marked as personal, while the household has private goals switched on, is not shown to the other person and cannot be read by them.
The companies that hold the data on our behalf. They act on instructions and for no purpose of their own:
[PROCESSORS]
Nobody else, unless the law obliges it — a court order, a criminal investigation. If that ever happens and it is lawful to tell you, you will be told.
Where it is held
In the European Union. Where a company above operates outside it, the transfer rests on the European Commission's standard contractual clauses.
How long it is kept
- Your account and your household's records: for as long as the account exists, and then as described under deletion below.
- Sessions: until they expire, which is 60 days after last use, or until you revoke them.
- Technical records: days, not years. They exist to diagnose a failure that is happening now.
- Bounced addresses: indefinitely, because the fact stays true. It is the address and nothing else.
- Your acceptance of this policy: kept, including after the account is deleted, because it is the record of what you agreed to and when.
Deleting your account — read this part
You can delete your account from Settings, whenever you like, without asking anybody.
When you do: your account and your personal details go. The email address, the name, the password, every session and every way of signing in are deleted, and you cannot sign in again. Your name is removed from your household's records.
What stays is the money history you shared. The expenses, transfers, settlements and goals in your household are not deleted, because they are as much the other person's record as yours — every past month's split is built from them, and removing your half would silently rewrite their history. They stay with your name taken off them, attributed to an unnamed former member of the household.
If you were the only person in your household, the household is closed with the account and nobody can reach it again.
If you would rather take the records with you before deleting, export them first — the button is on the same screen.
Your rights
- See it — ask, and you get a copy.
- Take it — the export button in Settings hands you everything tied to your account as a JSON file, at once, without asking anybody.
- Correct it — the name and address are editable in Settings; anything else, write and it gets fixed.
- Delete it — as described above.
- Object, or ask us to stop — to the parts held on a legitimate interest.
- Complain — to the Comissão Nacional de Proteção de Dados (CNPD, www.cnpd.pt), or to the supervisory authority where you live. You do not have to talk to us first, though it is usually quicker.
Cookies
One cookie, holding your session so that the app knows you are signed in. It is httpOnly, so no script can read it, and it goes when you sign out. There are no analytics cookies and no consent banner, because there is nothing to consent to.
Children
The app is not intended for children under 16, and no account should be created for one.
Changes
This is version 1. If it changes, the new version gets its own number and its own date, this one stays readable, and you are asked to accept the new one. A change that materially affects you will be announced in the app rather than quietly published.