Twinly Privacy Policy
Twinly helps parents of twins track feeds, sleep, nappies, growth and related records, and share them with their partner. This policy explains what it stores, where that goes, and how to get it back or remove it.
The data controller is Stephen O'Keeffe. For any privacy question or request, contact hello@twinly.ie.
What we store
Held in your household's account, visible to you and any partner who joins with your invite code:
- Account: your email address and an encrypted password, handled by our authentication provider. We never see your password.
- Household: name, invite code, pregnancy or postnatal stage, due date, reminder settings.
- Your twins: names if you add them, birth dates, and sex where you provide it for growth charts.
- Logs you create: feeds, breastfeeding and pumping, sleep, nappies, growth, pregnancy symptoms, contractions, milestones, vaccines and medications, appointments, gift list, budget, hospital-bag checklist and shift plans.
- Notifications: if you enable them, an identifier for your device: a push subscription from your browser's push service, or in the iPhone app, a device token from Apple.
Some things never leave your phone: which Learn articles you have read, your slider defaults, a running sleep timer, your chart preferences, and an offline copy of your household's data.
Legal basis
We process your data to provide the service you asked for (performance of a contract), and on your consent for optional features such as notifications, which you can withdraw at any time.
Some of what you can record (growth, vaccines, medications, pregnancy symptoms and contractions) is health data, which the GDPR protects more strictly as a special category. For that we rely on your explicit consent, asked for when you create your account, never pre-ticked, with the date recorded. Accounts created before we added that step, including in earlier versions of the iPhone app, were not asked and will be. These features are optional: you can use Twinly for feeds, sleep and nappies without them, and withdraw consent by deleting the entries, or the account, in the app.
How long we keep it
Until you delete it or delete your account. Deletion is immediate and permanent, and any backup holding a residual copy is rotated out within 30 days.
Who else processes your data
- Supabase: database, authentication and notification delivery. Stored in the EU, Ireland region.
- Resend: sends our account emails, the confirmation message and password resets. It processes your email address for that purpose only.
- Vercel: hosts the app and the website.
- Your browser's push service (Apple, Google or Mozilla, depending on your device) delivers notifications you have enabled on the web. They are encrypted on our server and only your device can read them.
- Apple delivers notifications you have enabled in the iPhone app, through its Apple Push Notification service. Unlike on the web, their text passes through Apple in a form Apple can read. Feed and sleep reminders include your twin's name; appointment reminders give only the day and time, never what the appointment is or where.
There is no advertising, no analytics or tracking, and no profiling in Twinly. We do not sell or share your data with anyone else, we do not use it to train machine-learning models, and no decisions about you are made automatically.
Where it is held
Your account and everything in your household are stored by Supabase in the EU, Ireland region, and stay there. Vercel and Resend are based outside the EEA; where they process personal data there they do so under the European Commission's Standard Contractual Clauses, and it is limited to page requests in Vercel's case and your email address in Resend's. Your household records are not transferred outside the EU. The exception is the text of a notification you have enabled in the iPhone app, which Apple delivers and may process outside the EEA under Standard Contractual Clauses.
Sharing with your partner
Anyone who joins your household with your invite code can see and edit everything in it, and can see which entries you created. Treat the invite code like a password.
You can take that access back, under More → Partner access: change the household code so nobody can join with the old one, and remove someone who has already joined. Removal takes effect immediately, changes the code so they cannot rejoin with it, and stops their devices receiving this household's reminders. Entries they made stay in the household, without their name on them.
Partner access is in Twinly on the web today. If you are using the iPhone app from the App Store it arrives in the next update, and until then email hello@twinly.ie and we will change your code or remove someone for you.
Your rights
Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to how it is processed, to data portability, and to withdraw consent at any time. Most of these are built into the app, under More → Your data & account:
- Access and portability: "Download all my data" exports everything your household holds as a JSON file.
- Rectification: entries can be edited or deleted at any time.
- Erasure: "Delete my account" deletes it permanently. If you are the household's only member, all of its data goes with it; if your partner is still a member, the shared records stay with them and your account and authorship are removed.
- Restriction, objection and withdrawing consent: turn off the optional feature in the app, or email hello@twinly.ie and we will action it.
You also have the right to complain to your data protection authority. In Ireland that is the Data Protection Commission.
How we protect it
Everything is encrypted in transit and at rest. Access to your household is enforced by the database itself, row by row, so a request from outside your household returns nothing rather than relying on the app to hide it. Passwords are hashed by our authentication provider and are never visible to us.
Children's data
Twinly is used by parents and carers, who hold the accounts. Children do not have accounts and cannot sign in. Records about your children belong to your household, and your children have data protection rights of their own which you exercise on their behalf as their parent or guardian: the export, correction and deletion tools above cover their records as well as yours.
Not medical advice
Twinly is a personal record-keeping tool, not a medical device, and nothing in it is medical advice. Growth charts show WHO population reference curves for context only. Always follow your GP, public health nurse, pharmacist or maternity team.
Changes to this policy
If this policy changes materially we will update the date above and notify you in the app before the change takes effect.