Privacy Policy

Twotic is the controller of the personal data described here. Contact: support@twotic.dev.

This version was published on 17 September 2026. For accounts created before then, it takes effect on 1 October 2026. For accounts created since, it applies from sign-up.

What we collect

Account data. Your name, email address and profile image, received from Google when you sign in. We do not collect or store passwords. Authentication is handled entirely by Google.

Sign-in sessions. A session record that keeps you signed in and expires after seven days. We do not store your IP address or browser details with it.

API keys and connected apps. A cryptographic hash of each key, its first characters for display, and when it was last used. The key itself is never stored. If you connect an AI assistant such as Claude, ChatGPT or Cursor, we store a hashed access token, the app's name and when it was last used.

Usage data. For each API call: the API and endpoint, HTTP method, request path, status code, response time, amount charged, time, and whether it came from an API key or the in-browser playground. When a call fails we also store the error code and the error message we returned, which can include the host name of a web address you asked an API to fetch. Calls are also totalled per day.

We do not store request or response bodies. What you send through an API is processed to produce your response and is not kept.

Billing data. Your credit balance and every movement of credit (top-ups, free credit, bonuses and referral rewards), plus the identifier, amount and status of each checkout, including checkouts you start but do not finish. Card and bank details never reach us. Dodo Payments collects and processes them directly, and we receive only the outcome.

Referral data. Your referral code, whether you signed up through someone else's referral link and who that was, and any rewards paid. To remember a referral link before you sign in, your browser keeps the code for up to 30 days.

Email data. A record of which emails we have sent you and when, and whether you have unsubscribed from product emails.

API requests you post. The title and description of any API you request on our public requests board, and the requests you vote for. Titles and descriptions are public.

Why we process it

• To provide the service, authenticate you and your calls, and show you your usage: performance of a contract.
• To meter usage, take payment and pay bonuses and referral rewards: performance of a contract.
• To secure the platform against abuse and to diagnose failed calls: legitimate interests.
• To send account notices, such as receipts, failing or refused calls and a low balance: performance of a contract.
• To send product emails, such as getting-started help, a weekly usage summary, new APIs you asked for, invitations to refer others or to review us, and occasional questions about your experience: legitimate interests. You can unsubscribe at any time.
• To measure whether our advertising brings people to Twotic, using the Google Ads tag described under Cookies: your consent where the law requires it, otherwise legitimate interests.
• To meet accounting and tax obligations: legal obligation.

Emails we send

Account notices are about your money and your integration: receipts, calls that are failing or being refused, a free allowance nearly used up, and a low balance. They are sent while your account is open.

Product emails help you get value from Twotic and ask for your feedback. Every product email has an unsubscribe link, and you can change your choice at any time from that link. Unsubscribing does not stop account notices.

Who we share it with

• Google: sign-in, and advertising measurement through the Google Ads tag.
• Dodo Payments: our merchant of record and payment processor, under its own privacy policy.
• Trustpilot: if we invite you to review us, your email address and first name are shared with Trustpilot so it can send a verified review invitation.
• Our email provider: to deliver the emails described above.
• Our hosting and database providers: to run the service.
• People who referred you: if you signed up with someone's referral link, they can see your first name, a partly hidden email address, when you joined, and the reward they earned from your first top-up.
• AI assistants you connect: responses from our APIs are delivered to the app you connected, under that app's own privacy policy.

We do not sell personal data, and we do not share your account details with advertisers.

Where it is processed

Our database and servers may be located outside your country, including in the United States. Our providers process data under their own safeguards for international transfers.

How long we keep it

• Account, session, API key, usage, billing, referral and email records: while your account is open.
• When you ask us to close your account, we delete your data within 90 days, except records we must keep for tax and accounting. Dodo Payments, as merchant of record, also keeps the payment and invoice records the law requires.
• Referral code in your browser: 30 days.

Cookies and browser storage

Strictly necessary. A session cookie keeps you signed in, a short-lived cookie caches your session so pages load faster, and a cookie remembers your cookie choice for 180 days so we do not ask on every page.

Preferences you choose. The programming language you pick for code examples, stored in your browser.

Optional. These are only used with your consent where the law requires it:

• Google Ads cookies. The Google Ads tag may set cookies and send information about your visit, such as the pages you view, to Google so we can measure how well our ads work. We have turned off ad personalisation, so it is never used to show you personalised ads.
• Referral link memory. If you open someone's referral link, your browser remembers the code for up to 30 days so the referral can be credited when you sign up.

How your choice works. If you are in the European Economic Area, the United Kingdom or Switzerland, optional cookies stay off until you accept, and we ask when you first visit. Elsewhere they are on by default and you can turn them off at any time. If your browser sends a Global Privacy Control signal, we treat it as a refusal. You can accept, refuse or withdraw your choice whenever you like from Cookie settings at the bottom of every page, and refusing removes the optional data from your browser. You can also block cookies in your browser settings.

Your rights

Depending on where you live, you may have the right to access, correct, delete, port or restrict processing of your data, to object to it, and to withdraw consent. You can withdraw cookie consent yourself from Cookie settings at the bottom of any page. For everything else, email support@twotic.dev and we will respond within 30 days. You may also complain to your local data protection authority.

Changes

Material changes will be announced by email to account holders at least 14 days before taking effect.