This policy explains what personal data Twinely collects when you use twinely.net and the Twinely app, why we collect it, how long we keep it and what rights you have. We wrote it to be read, not skimmed past. If anything is unclear, email kutay@kutayonur.dev.
The short version: we collect only what is needed to run your calendar, we do not sell or share your data for advertising, we use no analytics or tracking tools, and you can export or delete everything at any time.
1. Who is responsible for your data
The controller of your personal data under the EU General Data Protection Regulation (GDPR) is Kutay Onur, a private individual residing in Poland, who operates Twinely. Contact for all privacy matters: kutay@kutayonur.dev. Twinely has not appointed a data protection officer because the law does not require one for a service of this size.
2. What we collect and why
| Data | Why we need it | Legal basis (GDPR) |
|---|---|---|
| Name, email address, password (stored only as an Argon2id hash), time zone | To create and secure your account and show times correctly | Art. 6(1)(b): performing our contract with you |
| Calendars, events, notes, first steps, colours, repeat rules | This is the service itself: storing and showing your calendar | Art. 6(1)(b) |
| Who you share a calendar with and their role | To show shared calendars to the people you choose | Art. 6(1)(b) |
| Date and version of the Terms and Privacy Policy you accepted, and your confirmation that you are at least 16 | To prove what you agreed to and that you may use the service | Art. 6(1)(c) and (f): legal obligations and our legitimate interest in being able to demonstrate compliance |
| Session cookie (a random token) | To keep you signed in | Art. 6(1)(b); see the Cookie Policy |
| IP address, kept in memory for up to 10 minutes and never written to disk by our server | To block password-guessing and abuse (rate limiting) | Art. 6(1)(f): our legitimate interest in keeping accounts secure |
| Security logs: time of failed sign-in attempts with a shortened, non-reversible tag instead of your email | To detect and investigate attacks | Art. 6(1)(f) |
We do not collect special categories of data (such as health data) on purpose. You decide what you write in your events; please avoid putting sensitive information about other people in shared calendars without their agreement.
We do not use your data for advertising, profiling, automated decision-making with legal or similarly significant effects, or to train AI models.
3. Connecting your own AI assistant
Twinely does not run its own AI. When this feature is available, you will be able to connect an AI assistant you already use (for example Claude or ChatGPT) and choose which calendars it may read or write. Data you let the assistant access is sent to that provider at your instruction and is processed under that provider’s own terms and privacy policy, as an independent controller. You can disconnect an assistant at any time.
4. Who processes your data for us
We keep the number of providers small. Each one only gets what it needs to provide its service to us.
| Provider | What it does | Where |
|---|---|---|
| Cloudflare, Inc. | Delivers the website, protects it from attacks (DDoS), routes traffic to our server, stores encrypted backups (R2) | Global network; transfers outside the EEA are covered by the EU–US Data Privacy Framework and Standard Contractual Clauses |
| Our own server | Runs the Twinely API and stores the database | Poland |
If we add a provider (for example for sending emails or taking payments), we will update this list before using it. We never sell personal data. We disclose data to authorities only when the law requires it.
5. How long we keep your data
- Account and calendar data: as long as your account exists.
- Deleted events: kept in a 30-day trash, then permanently deleted.
- Session cookies: expire after 30 days or when you sign out.
- IP addresses for rate limiting: up to 10 minutes, in memory only.
- Encrypted backups: 30 days, so data you delete disappears from backups within 30 days.
- When you delete your account, your account and the calendars you own are deleted immediately. Events you added to someone else’s shared calendar stay in that calendar, because they are part of it.
6. Your rights
Under the GDPR you have the right to:
- access your data and get a copy of it (Art. 15);
- have incorrect data corrected (Art. 16);
- have your data deleted (Art. 17);
- restrict processing (Art. 18);
- receive your data in a portable, machine-readable format (Art. 20);
- object to processing based on our legitimate interests (Art. 21);
- withdraw any consent at any time, without affecting processing done before.
You can export all your data as JSON and delete your account yourself on the Account page of the app. For anything else, email kutay@kutayonur.dev. We answer within one month, as the GDPR requires, and may ask you to confirm the request from your account email.
You also have the right to lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl). You can also contact the authority in the EU country where you live.
7. Age
Twinely is meant for people aged 16 and over, which is the age of digital consent in Poland. We do not knowingly collect data from younger children. If you believe a child under 16 has created an account, tell us and we will delete it.
8. How we protect your data
- All connections use HTTPS (TLS). Passwords are hashed with Argon2id and a unique salt; we never see or store them in readable form.
- Session tokens are random and only their SHA-256 hash is stored, so a copy of the database cannot be used to sign in.
- Sign-in is rate-limited per address and per account; cross-site requests from other websites are refused.
- The server runs in an isolated sandbox with no access to the rest of the machine and no outgoing network access.
- Backups are encrypted with AES-256 before they leave the server.
No system is perfectly secure. If a personal data breach is likely to put your rights at risk, we will notify the supervisory authority within 72 hours and inform you without undue delay, as Articles 33 and 34 of the GDPR require.
9. Changes to this policy
If we change this policy in a way that matters, we will tell you in the app or by email before the change takes effect. The date at the top shows the current version.