UsTwo privacy notice

Last updated: 19 October 2026.

UsTwo is operated by Arda Moustafa, Türkiye. For privacy requests and questions, contact ardamoustafa_@hotmail.com. This notice covers the UsTwo iPhone app and this website.

Your account and Google or Apple sign-in

We process your authentication identifier, email address, display name, language, timezone and the profile information you choose to provide to create and maintain your account. When you choose Google sign-in, Google shares your account identifier, email address and basic profile information, such as your name and profile picture. We use these details to authenticate you, associate your sign-in with your UsTwo account and display your chosen profile. We do not request access to Gmail, Drive, contacts or calendar data through Google sign-in. UsTwo does not receive your Google or Apple password. Apple may provide a private relay email address.

Supabase processes authentication and stores the app's data for us. Our production database is hosted in Ireland (EU). Google and Apple also process your sign-in under their own privacy policies.

Information you choose to share

UsTwo processes your partner connection, relationship preferences, daily answers, game choices, notes, moods, shared room, reunion plans and memories to provide the features you use. Optional media includes photographs, Polaroid drawings and voice recordings. Voice recording and camera access require your device permission. Voice messages, including alarm sounds you choose, are processed to send, play or schedule that feature. Time capsule text is withheld by the server until its unlock time.

Your linked partner can see the information you choose to share according to the feature's rules. Daily answers remain sealed until both people answer; private game choices follow the game's reveal rules. Do not include other people's confidential information or sensitive information you do not want to share. We do not sell your content or use it to train AI models.

Optional distance features use the city information you provide or authorize. UsTwo does not track continuous GPS movement. Uploaded memory photographs are resized and their original EXIF/GPS metadata is removed; text place names you add remain part of the memory. Your device permissions can be changed in iOS Settings.

Purchases, notifications and support

Apple handles in-app payments. We process product and transaction identifiers, purchase status and subscription renewal information to check Premium access; we do not receive payment-card numbers. Account deletion does not cancel an Apple subscription.

We process device notification tokens and notification preferences to deliver enabled notifications and widget updates. Apple processes notification delivery. Widget and voice caches and secure session credentials may also be stored on your device.

When you contact support, we and the email providers involved receive your sender address and the message and attachments you choose to send. The app's support composer does not automatically attach your private answers, photographs or account logs. We use support information to respond and resolve your request.

Website and analytics

Cloudflare hosts this website and processes technical request information, such as IP address, browser information and security signals, to deliver and protect it. The website does not set advertising cookies or run third-party analytics scripts. Shared invite pages can display the inviter's first name and a question; duel pages can display first names and scores. Anyone with the link may see that preview. Private answers and voice recordings are not included in these public previews.

Product analytics collection is disabled in the current production configuration. If optional analytics is enabled in a future configuration, it requires your separate in-app choice and an updated notice describing the provider and data. We do not use cross-app advertising tracking.

Purposes, legal grounds and recipients

Account access, partner sharing and requested features are processed to provide the service you request (where applicable, GDPR Article 6(1)(b) and KVKK Article 5(2)(c)). Optional permissions and processing that require consent depend on your choice; a device permission alone does not replace a legally required consent. Necessary security and abuse prevention serve our legitimate interest in keeping accounts safe, subject to your rights; legally required processing relies on the applicable legal obligation. Support is used to respond to your request and resolve service issues. We do not require sensitive personal information to create an account.

Recipients include your linked partner, Supabase for authentication/database/storage/functions, Google or Apple when you use their sign-in, Apple for payments and notifications, Cloudflare for this website, and the email providers used for support. Information may also be disclosed when required by law or necessary to protect legal rights. Their infrastructure may process information outside your country, including in the EU, United States and other locations used by these providers. International processing is subject to applicable data-transfer requirements; details about the relevant provider and available safeguards can be requested at the contact above. This notice does not constitute consent to an international transfer.

Retention, export and deletion

We keep account and shared content while needed to provide your account and the features you choose. Support correspondence is retained for the time needed to resolve the request and any associated dispute or legal obligation. Security and legal records are limited to what is necessary for their purpose; their retention depends on the incident, the provider's operational cycle and applicable duties.

You can remove supported authored content, unlink or block a partner, request an export and delete your account in Profile > Account. Exports exclude your partner's unrevealed answers and private choices. Protected export download links last up to 15 minutes and the generated archive expires after 24 hours.

Deleting an account removes its authentication/profile data and authored content covered by the deletion flow, including uploaded media. Local voice data and scheduled voice alarms are cleaned up by the app. Shared room placements and memory dates may remain as a read-only archive for your partner; your authored memory text, media and attribution are removed. Partner-authored records can still refer to you. Contact us about residual personal information. Independent copies or screenshots already saved by your partner are outside our control. Limited deletion-processing records are removed seven days after outstanding processor deletion completes. Provider backups and operational logs may expire separately and are not instantaneously erased with active records.

Your choices and rights

Where applicable, you may request access, correction, deletion, restriction, portability, object to processing or withdraw consent. KVKK Article 11 also provides rights to learn whether data is processed, obtain information about processing and recipients, request correction or lawful erasure and notification to recipients, object to adverse results produced solely by automated analysis and seek compensation for unlawful processing. Contact ardamoustafa_@hotmail.com; we verify requests proportionately and never ask for your password. We respond within applicable statutory periods. You may complain to Türkiye's Kişisel Verileri Koruma Kurumu or another competent data protection authority where applicable. Mandatory rights are not limited by this notice.

UsTwo is intended for people aged 17 or older; age is self-declared and not government identity verification. We will update this dated notice when practices change and request a new consent where required.