About your data
This page says plainly where your things are kept, who can see them, what happens each time the twin speaks, and how to delete.
Where it's kept
Every version you write, the feelings at the time, the place, your own words while telling, the photos you upload and their thumbnails are encrypted on our servers before they're written (AES-256-GCM, one key per couple). The database is in the US.
Who can see it
Only the two of you. Your card is never shown to your partner. No one else, no training, no selling.
What happens when the twin speaks
The twin speaks only inside memories: while you tell, it only asks; it turns your telling into your own words and checks the result against what you said; when it answers your partner's one question about one of your memories, it uses only your words from that memory and says it hasn't got to that part otherwise. Each call sends only that memory's material and your way of speaking to the model provider (Anthropic, the company whose model we use; it receives only the few lines needed for that one call and doesn't train on them; it normally deletes them within 30 days, and keeps them longer only if they break its usage policy or the law requires it), never the whole archive.
Photos
Photos lose their camera data (device, coordinates) on your phone; only the picture leaves it, and you're asked before the date and place are used. What's stored is an encrypted file. No face recognition, and no library that does it.
Maps
The map on a memory page is drawn with tiles from OpenStreetMap's servers: when it loads, their servers see your IP address and the area the map shows. When you search for a place, the request goes through our server to OpenStreetMap's Nominatim, so only the text you typed leaves. The place itself is stored encrypted with us.
When you tap “Use where I am” (the first time, your phone asks you first), the coordinates it gives go through our server to OpenStreetMap's Nominatim to get a place name; our server keeps the result of that lookup in memory for at most a day and never writes it to the database. Nothing reads your location unless you tap. When you save the memory, the place name and the coordinates (the pin on the map) are stored encrypted with it.
Who runs it for us
The site runs on Vercel, the database is Neon, and photo files are stored in Vercel Blob (encrypted before they get there). Letters are sent by Resend, which sees the address and the words in the letter. The model is Anthropic's, and maps and place names come from OpenStreetMap; see the sections above.
Pause and delete
Pause: your partner loses access to your twin at once, nothing is deleted, turn it back on any time. Delete permanently: within 24 hours your card, every memory you told, the photos and thumbnails you uploaded, everything your twin ever said and every index derived from them are deleted from our servers. If you chose to leave your memories with them: your twin and everything it said are still deleted; your original words and photos stay with them, except the parts you marked archive only, which are deleted too. Deleted, not hidden.
We never
Read your chat logs, pull data from elsewhere, train on your things, run face recognition, or show them to anyone but the two of you.
We keep two kinds of numbers only: how often things were used (time and type), and how many tokens each model call cost. There is no content in those numbers.