Privacy policy · Twincode

Who we are

Twincode Authenticator and gettwincode.com are run by [BUSINESS NAME - Ismail to add] (“we”, “us”), [BUSINESS ADDRESS - Ismail to add, a virtual address rather than home]. We’re the controller of the personal information described here, under the UK GDPR and the Data Protection Act 2018. Our ICO registration number is [ICO REGISTRATION NUMBER - Ismail to add].

Questions about privacy: support@gettwincode.com.

The short version

Your 2FA codes stay on your computer, locked with a password only you know. We never receive them, not even locked.
If you use Send from phone, our relay passes on sealed pieces it can’t open, and deletes them within 10 minutes.
No ads, no tracking and no selling your data. This website has no cookies.
You don’t need an account to use Twincode Free.

Your codes

Twincode keeps your accounts (the secret keys, names, emails, notes and backup codes you add) in your browser’s storage for extensions, on your computer, locked with AES-256-GCM encryption. The key is protected by your password and your recovery code. We have neither, and we never receive your accounts.

Settings and other details that aren’t secret, such as your theme or when you last saved a backup, also stay on your computer. Uninstalling Twincode removes them from that computer.

Browser sync

If you turn on sync, your browser’s own sync service (for Chrome, your Google account) carries a locked copy of your accounts between your computers. It’s locked with a key that comes from your recovery code, so neither we nor your browser provider can open it. We never receive this copy. Your browser provider’s privacy policy covers its sync service.

Send from phone

When you send screenshots or a backup file from your phone, our relay at api.gettwincode.com handles:

the sealed pieces of your files, which only your computer can open;
the public keys your computer and phone use to set up the session;
when the session started, its state, and the size of the pieces;
the rough location (city and country) of the computer that started the session, from our host’s network data. It’s shown only on your phone’s Send from phone page, so you can check the session is yours.

Each piece is deleted as soon as your computer picks it up. Everything about a session, including the location, is deleted when the session ends, at most 10 minutes after it starts. The phone page at send.gettwincode.com uses no cookies and no analytics.

Install tokens

The first time you use Send from phone, Twincode gets a random install token, so only real Twincode installs can open sessions. We keep a fingerprint of the token (not the token itself), when it was made, and a shortened part of the internet address it came from. We use these to stop abuse, such as one computer opening too many sessions, and we can switch a token off if it’s misused. We keep these records for [HOW LONG unused install token records are kept - Ismail to decide].

Clock check and rate limits

Twincode asks our server for the correct time, so your codes stay right even if your computer’s clock is out. It may also read a short public list of features we’ve switched off. Neither request sends anything about you or your codes, but like any internet request, they carry your internet address.

To stop abuse, our servers count requests by internet address (IPv6 addresses by their /64 block) for an hour at a time. We don’t log addresses or keep them beyond that.

This website

gettwincode.com uses no cookies and no third-party scripts, and today it has no visitor statistics at all. It’s hosted by Cloudflare, which processes internet addresses and request details to deliver and protect the site.

We may later add Cloudflare Web Analytics, which counts visits without cookies and without following individual people. We’ll update this page before we do.

Emails to us

When you email us, we use your email address and what you write to reply and to help you. We keep support emails for [HOW LONG support emails are kept - Ismail to decide]. Our email is provided by [EMAIL PROVIDER for support@gettwincode.com - Ismail to add].

Please never send us your codes, QR screenshots, backup files or password. We’ll never ask for them.

Payments

Twincode Free costs nothing, so we hold no payment details. Plus isn’t on sale yet. When it is, Stripe will handle payments, and we’ll update this policy before anyone can buy. Stripe will see your card details; we won’t.

Why we’re allowed to use this information

Legitimate interests: running Send from phone and the clock check safely, stopping abuse, keeping the website working, and answering your emails.
Contract: once Plus is on sale, providing the plan you’ve paid for.

Cloudflare hosts this website, the Send from phone page and our relay, and processes data on our behalf.
[EMAIL PROVIDER for support@gettwincode.com - Ismail to add] handles our email.

We don’t sell personal information, we don’t show ads, and we don’t share data with advertisers or data brokers.

Cloudflare runs a worldwide network, so a request may be handled outside the UK. Safeguards for those transfers: [TRANSFER SAFEGUARDS - Ismail to confirm from Cloudflare’s data processing terms].

Chrome Web Store

The use of information received by Twincode will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Your rights

You can ask to see the personal information we hold about you, have it corrected or deleted, limit or object to how we use it, or receive a copy to take elsewhere. Email support@gettwincode.com and we’ll reply within one month. We hold very little, so most requests are quick.

If you’re unhappy with how we’ve handled your information, please tell us first. You can also complain to the Information Commissioner’s Office at ico.org.uk.

Twincode isn’t meant for children under 13.

Changes and contact

If we change how we handle information, we’ll update this page and the date at the top first. For anything about privacy, email support@gettwincode.com or write to [BUSINESS NAME - Ismail to add], [BUSINESS ADDRESS - Ismail to add, a virtual address rather than home].