Legal

Privacy Policy

Status: draft, not yet in force Effective: EFFECTIVE DATE Applies to: the Two of Us iPhone app and this website

Not yet a finished document. Every factual statement below describes the app as it is actually built — the tables, the fields, the rounding and the deletion behaviour were all read out of the source before this was written, and they are accurate. What is not settled is everything marked LIKE THIS: the identity of the data controller, the hosting region, retention windows and the contact address. Those must be filled in, and the whole document reviewed by a qualified adviser, before the app is submitted to the App Store. The full list is kept in CLAUDE.md.

The short version

Your photographs and videos never leave your phone. The Map reads the date and location stamped on each one, on your device, and uploads a short list of place names and dates — never an image, a thumbnail, or a file.
Coordinates are blunted before they are sent. Rounded to about a kilometre: enough to recognise a city, not enough to find a house.
There are no analytics, no advertising, no trackers and no third-party SDKs. The app talks to exactly two places: Apple, and our own database.
Location is off unless you switch it on for the distance widget — and then only while the app is open, rounded to about a kilometre, overwritten each time. No trail is ever kept.
Only your partner can see what you share, and the database enforces that rather than the app asking nicely.
Nothing here is sold or shared for advertising, ever, and there is no mechanism in the app that could.

This summary is written to be read. The sections below are the ones that actually govern.

1. Who we are

Two of Us is an iPhone app for two people. The data controller — the person legally responsible for the decisions described in this policy — is LEGAL NAME, of REGISTERED ADDRESS, registered with the Information Commissioner's Office under ICO REGISTRATION NO..

You can reach a human at SUPPORT EMAIL. There is no separate Data Protection Officer; the controller handles these requests personally.

This policy covers the iPhone app and this website. It does not cover Apple, whose own privacy policy governs your App Store account, your Apple ID and your payments.

2. What is collected

The whole list. If something is not in this table, the app does not collect it.

What	Why	Where it is held
An account identifier	To know which rows are yours, and to join you to your partner. A random identifier, created when you sign in.	Our database
Your Apple sign-in details	If you sign in with Apple, we receive the email address Apple gives us — which is a private relay address unless you chose to share your real one. If you decline Apple sign-in, the app creates an anonymous account instead and we hold no email at all.	Our database (authentication)
The two names you choose, and your anniversary if you set one	They appear throughout the app. They are whatever you type — a first name, a nickname, anything.	Our database
Your invite code	Six characters, so your partner can join your couple.	Our database
Places you have been — a place name, a country code, a coordinate rounded to two decimal places (about a kilometre), a start and end date, and how many of your photographs were taken there	This is the Map. Where your list and your partner's list agree on a place and a set of dates, you were there together.	Our database
Places you would like to go, and any note you attach	The shared wishlist. The coordinate here is not rounded, because it is a place you have chosen on a map rather than a place you have been.	Our database
Where you are — one coordinate, rounded to two decimal places (about a kilometre), and the time it was taken	Only if you turn on the distance widget. It is what lets the two of you see how far apart you are. Your row is overwritten, never appended to: there is no history of where you have been, and no table that could become one. Switching it off deletes the row. See section 5.	Our database
A note you put on their screen	One short sentence at a time, replaced when you write another. It is shown on your partner's widget, so treat it as readable by anyone who picks up their phone. See section 5.	Our database
A profile picture, if you set one	One square image per person, shown throughout the app and on your widgets. It is the only image the app uploads, and it is uploaded precisely because its purpose is that your partner sees it. It is shrunk on your phone before it is sent, stored in a private bucket readable only by the two of you, and deleted when either of you leaves the couple. Setting one is optional; the app uses the first letter of your name until you do. See section 5.	Our database (file storage)
Your answers to questions	The questions deck. Free text, or an option you picked, plus which question it answers.	Our database
Your answers in a round of a game	Which side of each prompt you chose in Would You Rather or Who's More Likely, and which set of prompts you were given. Your partner's answers are not readable by you until your own are written — see section 6.	Our database
Things you are counting down to	A short title, a date, what kind of thing it is, and whether it comes round each year. You write these yourself — "Together again", a birthday, a trip — so treat the title as something your partner will read and as something that appears on a Lock Screen widget.	Our database
Whether your couple has an active subscription	To unlock the app for both of you, and to show the person who pays where to manage it.	Our database
Presence, while the app is open	Each phone tells the other that it is open, so the app can say whether your partner is there. This is relayed and discarded; it is never written to the database. The games no longer use it — every one of them is now answered a person at a time — and it remains only for the shelved live games, which are not on the launcher.	In transit only
Technical request data	Like any internet service, our hosting provider records the IP address, timestamp and rough shape of requests in its server logs, to keep the service running and to spot abuse.	Hosting provider's logs
Photographs and app state on your own phone	Rounds you played before pairing, photographs from the shelved Colour Hunt, and a cache of place names are stored in the app's private storage on your device and are not uploaded anywhere.	Your phone only

3. What is never collected

Your photo library. Not the files, not thumbnails, not copies, not identifiers pointing at them. Two exceptions, both of which are a single picture you choose by hand and both described in section 5: a profile picture, and a photograph you send your partner to play a game with. Nothing is ever taken from your library without you picking it.
Your location in the background — unless you go and switch it on. The app asks for "While Using the App", the weakest location permission there is, and with only that it cannot read your position while it is closed or while the phone is in your pocket. One setting changes that, and nothing else does: Keep it up to date on its own, in Settings under Distance, which asks for "Always" and is described in full in section 5. Until you turn it on it is not on, and turning it off puts things back. Nothing on the Map uses location either — the Map is built entirely from stamps already sitting on photographs you took in the past.
A location history. Your position is one row that is overwritten. There is no trail, no log, and no table that could be turned into one.
Your contacts, calendar, health data, microphone or messages.
Advertising identifiers. There is no advertising in the app and no tracking across other apps or websites. The App Tracking Transparency prompt never appears because there is nothing it would be asking about.
Analytics. No usage analytics, no crash reporting service, no session recording, no heatmaps, no product telemetry of any kind. We do not know which screens you open or how long you spend in them.
Third-party code. The app contains exactly one third-party library — the client for our own database. No advertising, attribution, analytics or social SDK is present in the binary.

4. Your photo library, in detail

This is the part worth being precise about, because it is the biggest thing the app ever asks for.

What happens when you tap "Scan my photos"

iOS asks your permission. If you grant it, the app walks your library and reads two things from each photograph and video: the date it was taken and the GPS coordinate stamped on it, if it has one. No image is opened or decoded. That is why a library of fifty thousand photographs is read in seconds — nothing is looking at the pictures.

Photographs with no location — most screenshots, most saved images — are simply ignored. Hidden photographs stay hidden: the scan excludes them. Shared-album photographs are excluded too, because they belong to other people and would place you in cities you have never been.

What is then worked out, on your phone

The located photographs are grouped into stays — runs of photographs close together in space and time. A stay becomes one row: a coordinate, a date range and a count.

What is sent, and what is left behind

Before anything is uploaded, the coordinate for each stay is rounded to two decimal places, which is roughly a kilometre. What leaves your phone is: the rounded coordinate, the place name, the two-letter country code, the first and last date, and the number of photographs. What stays on your phone is: every photograph, and the internal identifiers that let the app show you your own pictures when you tap a pin. Those identifiers are never uploaded, which is why your partner sees that you have two hundred photographs of Lisbon and never sees one of them.

Your photographs are the evidence. Only the conclusion is shared.

Apple's geocoder

To turn a coordinate into "Lisbon · PT", the app asks Apple's geocoding service, which means the coordinate is sent to Apple for that lookup. This is Apple's own location service, built into iOS, and Apple's privacy policy governs it. Results are cached on your phone so each place is looked up once, ever. We mention it because "nothing leaves your phone" would otherwise be very slightly untrue, and we would rather be exact.

Saying no, and changing your mind

Declining the photo permission costs you the Map and nothing else — every game still works. You can withdraw it at any time in iOS Settings, and the app has a shortcut to that screen. Withdrawing it stops any further scanning; to remove places already uploaded, see section 10.

Scans are manual. The app does not re-read your library in the background, on a schedule, or on launch — only when you ask it to.

5. Things you switch on yourself

Everything in this section is off until you turn it on, and each can be turned back off in the app. None of it contradicts section 4 — but all of it deserves saying plainly.

How far apart you are

Turning on the distance widget asks iOS for location access. We ask for "While Using the App" — the weakest permission available — so a position is taken when you open the app and at no other time. Your phone is not reporting while it sits in your pocket.

There is then a second, separate step you can take if you want to, and it is the only thing in this app that reads your location while you are not looking at it.

Keeping it up to date on its own

Keep it up to date on its own, in Settings under Distance, asks iOS for "Always". With it on, your phone reports without you opening anything — because a number that is usually several hours old is not much use on a Lock Screen.

What that does and does not mean:

At most once an hour, and only when you have moved. Sitting still produces no readings at all. We use the system's significant-change service, which notices movement of roughly half a kilometre; we do not run continuous or precise location, and the app never follows you in real time.
Exactly the same rounding, and the same single row. Two decimal places, about a kilometre, overwritten each time. Reporting more often does not mean keeping more: there is still no trail, and still nothing that could be turned into one.
Only your partner ever reads it, exactly as before.
It is reversible from both ends. Turn the setting off in the app, or change the permission back to "While Using the App" in iOS Settings, and the background reporting stops. Turning the distance feature off altogether deletes your row.

iOS will also, on its own, remind you some days later that the app has been using your location in the background and offer to stop it. That prompt is the system's, not ours, and we would rather you saw it.

Before anything is sent, the coordinate is rounded to two decimal places, about a kilometre: the same blunting the Map uses. Enough to say "two hundred miles apart" or "same place", nowhere near enough to say which building. It is stored as one row that is overwritten each time — your current position, never a history of where you have been. Only your partner can read it.

Because of all that, the distance is not live either way. It is as fresh as the last reading each of you sent — the last time you opened the app, or up to an hour ago if you turned on the setting above — and the widget says so rather than implying otherwise. Switching the feature off deletes your row immediately, so no stale position is left sitting on anyone's screen.

A current position is a very different object from a record of where you have been. This app only ever holds the first.

A word on their screen

You can put one short sentence on your partner's widget. It replaces whatever you wrote before — this is not a chat and no thread is kept. It is stored until you replace it or take it down, and either of you can delete it. Remember where it ends up: a widget is readable by anyone who glances at their phone, so it is the wrong place for anything private.

Photographs you deliberately send

Your profile picture

If you tap your face in the app you can choose a picture for it. iOS shows you its own photo picker, which runs outside the app: we receive only the one image you tap, and the app never gains access to the rest of your library through it.

That image is cropped to a square and shrunk to 400 pixels on your phone, before anything leaves it, and the smaller version is what is uploaded. It is held in a private storage bucket keyed to your couple: a row-level policy means only the two of you can read it, and it is not reachable by a public link. It is deleted when either of you leaves the couple, and removed from both phones at the same time.

Two honest notes. A photograph of a face is personal data, and if you choose a picture of yourself you are choosing to share it with your partner — that is the whole point of the feature, but it is worth saying out loud. And it will appear on their Lock Screen widget, which is visible to anyone who glances at their phone. You can remove it at any time, and until you set one the app simply uses the first letter of your name.

Piece Together and Colour Hunt

These two games are built but are not currently on the launcher, so nothing below can happen unless they return. It is described anyway, because the code is still in the app and a policy that only covers what is switched on today is a policy you have to remember to update before you switch anything back on.

You choose one photograph from your library to turn into a jigsaw. That image is transmitted to your partner's phone, in pieces, through the same live relay that carries the rest of the game. It is relayed, not stored: it is never written to the database and no copy is kept on our side. Your partner's phone holds it for as long as you are playing. Only a picture you pick, for a game you started, goes anywhere.

Photographs you take inside the app are saved in the app's private storage on your phone. They are not uploaded. If you make a poster of a hunt and save it, it goes to your own photo library — which needs its own iOS permission, and is a copy going to you.

6. What your partner can see

A couple is two accounts joined by an invite code. Within it:

They see your places — names, dates, counts and rounded coordinates. They do not see your photographs.
They see the shared wishlist, and either of you can remove anything from it.
They see your answer to a question only once they have answered it themselves. Until then the app will not even tell them what the answer is — only that one is waiting. This is enforced in the database, not in the app, so it holds regardless of what any client asks for.
They see your answers in a round of a game only once they have answered the same round themselves — the same rule, enforced the same way. Until then the database will not return your answers at all; the only thing it will confirm is that you have finished.
They see everything you are counting down to, and either of you can add, change or remove any of it.
They see your profile picture, if you set one. Only you can set or remove it, and only they can set or remove theirs — same for your two names. Before the second person joins, whoever set the couple up fills in both.
They see the names and the anniversary, and whether the couple is subscribed. The anniversary is a fact about the pair, so either of you can change that one.

Nobody outside your couple can read any of it. Every table carries a row-level policy scoping it to your couple, so a request for somebody else's data returns nothing rather than being politely declined by the app.

One asymmetry worth knowing: neither of you can write a place for the other. "We were both here" is always the result of two independent ledgers agreeing, or of one of you tapping to confirm it.

7. Why we are allowed to hold it

Under the UK GDPR and the EU GDPR, each purpose needs a lawful basis. Ours:

To give you the app you asked for — your account, your couple, your places, your answers, your subscription status. Basis: performance of a contract (Article 6(1)(b)).
To read your photo library. Basis: your consent, given through the iOS permission prompt and withdrawable at any time in iOS Settings.
To show how far apart you are, if you switch the distance widget on. Basis: your consent, given twice over — once in the app and once in the iOS permission prompt — and withdrawable from either.
To send you a reminder, if you allow notifications. Basis: your consent, withdrawable in iOS Settings.
To keep the service up and to prevent abuse — server logs, rate limits. Basis: legitimate interests, in running a service that works and is not being attacked.

There is no profiling and no automated decision-making with legal effects. Nothing in the app scores you, ranks you or decides anything about you.

8. Where it goes, and who else touches it

Two organisations are involved, and no others.

Who	What they do	What they hold
Supabase	Hosts the database, authentication and the live game relay. They act as our processor, under their data processing terms, and do not use your data for their own purposes.	Everything in the table in section 2 marked "our database", hosted in the European Union (Ireland).
Apple	Distributes the app, handles sign-in, takes payment for subscriptions, and provides the geocoding that turns coordinates into place names.	Your Apple ID, your payment details and your subscription — none of which we ever see. We receive only whether your couple is subscribed.

We are the merchant of nothing. Card details never reach us and never could; Apple takes every payment.

International transfers. Your data is held in Ireland, inside the EEA. Transfers from the UK to the EEA are covered by the UK's adequacy regulations, so no additional safeguard is needed for them. TRANSFER MECHANISM — Supabase's own support operations may reach the data from outside the EEA; the safeguard in their data processing agreement (Standard Contractual Clauses, plus the UK Addendum) should be named here once that agreement is signed.

We do not sell your data, and we have no advertising business. We would disclose data outside these two processors only if a court or the law required it, and only to the extent required.

9. How long it is kept

Your account, couple, places, wishes and answers are kept while your account exists. They are what the app is — a map that forgets last year would not be worth having.
Presence messages are not stored at all.
Your profile picture is kept until you remove it, or until either of you leaves the couple, or you delete your account.
Things you are counting down to are kept while the couple exists — including ones that have already happened, because "we did that" is worth keeping. Either of you can remove any of them.
Your position is a single row, overwritten each time and deleted the moment you switch sharing off or delete your account.
A note on their screen is kept until you replace it or take it down.
Server logs are kept for LOG RETENTION.
Backups. Deleted data can persist in encrypted database backups for up to BACKUP WINDOW before those backups roll off. It is not restored or read in the meantime.

10. Leaving, breaking up, and deleting

This is a couples app, so this section matters more than it usually does. Here is exactly what each action does today.

Delete account

In Settings, and it really deletes. Your sign-in account is removed, your profile with it, and every place you uploaded is deleted. Your partner's places are not touched — they are your partner's, and they are what keeps their own map intact. If you were the last person in the couple, the couple and its shared wishlist go too. If your partner is still there, they inherit ownership of the subscription so that nobody is locked out of their own billing. This cannot be undone.

Leaving a couple

Leaving detaches you from the couple so you can start again, and takes your data with you: every place you uploaded, every answer you wrote and every round you played is deleted as you go. Your former partner keeps their own map and their own answers, because those are theirs. Your account survives, so you can pair with someone else and scan again — one tap, and the map rebuilds.

Both profile pictures go, not just yours. They belonged to the pair, and a photograph of somebody you are no longer with should not be left sitting on their Lock Screen. The one who stays can set a new one in two taps. Your countdowns stay with the couple: unlike a place or a round, an event is not one person's record of anything, and the one who stays should not lose their own birthday.

What leaving never undoes

Answers your partner has already unlocked and read, and anything they have seen or screenshotted, cannot be recalled. No app can do that. Share accordingly.

11. Your rights

If the UK or EU GDPR applies to you, you have the right to ask for a copy of your data, to have it corrected, to have it deleted, to restrict or object to how it is used, to receive it in a portable form, and to withdraw any consent you have given. Exercising any of them costs nothing and will not make the app worse for you.

Two of those are buttons rather than emails: deletion is in Settings, and withdrawing photo consent is in iOS Settings. For anything else, write to SUPPORT EMAIL. We will respond within one month.

If you think we have got it wrong, you can complain to the Information Commissioner's Office (ico.org.uk), or to your own country's data protection authority if you are in the EEA. We would rather you told us first, but you do not have to.

12. Age

The app is for people aged MINIMUM AGE and over, and is not directed at children. We do not knowingly collect data from anyone below that age. If you believe a child has an account, write to SUPPORT EMAIL and it will be deleted.

13. Security

Everything in transit is encrypted with TLS. Everything at rest is encrypted by the hosting provider.
Your sign-in session is held in the iOS Keychain, not in ordinary app storage.
Access control is enforced in the database by row-level security, not by the app. A modified or hostile client gets nothing it is not entitled to.
The key shipped inside the app is a publishable key and carries no privileges of its own; every privilege is decided server-side.
The live game channel is private and authorised per couple, so guessing another couple's identifier gets you nothing.
No security is perfect. If a breach affects your rights we will tell you, and the ICO, as the law requires.

14. If you are in the United States

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. There is no mechanism in the app that could — no ad network, no data broker, no advertising identifier. California residents may request access to, or deletion of, their personal information under the CCPA/CPRA; use the same contact address above, and you will not be treated differently for asking.

15. Changes, and features not yet built

If this policy changes materially we will say so in the app before the change takes effect, and update the date at the top.

An earlier version of this policy said that a distance widget and on-screen notes did not exist and were not covered by it. Both now exist, and section 5 was written at the same time as they were — not afterwards. That is the commitment worth holding us to: this document changes with the app, in the same breath, and never quietly widens to cover something you have not been shown.

Still not built, and still not covered: a shared photo board would mean photographs actually leaving your phone, which is the promise the Map rests on. If that is ever built it will be separate, opt-in, and described here first.

16. Contact and complaints

LEGAL NAME, REGISTERED ADDRESS
SUPPORT EMAIL

Also worth reading: the Terms of Service.