Last updated 24 September 2026.
Twin is a private social app for people who already know each other. Privacy isn't a feature of Twin; it's the point of it. This page says plainly what Twin can and can't see.
Your username and phone number. Friends find you by typing your exact username — never part of one, so nobody can browse the list of people on Twin — and your phone number proves who you are when you sign up or move to a new phone. Both are encrypted when stored, with a key the server holds, so the server can read them when it needs to. Your phone number is never shown to anyone and can't be searched.
Who your friends are. The server keeps the list of friendships so that only friends can reach each other.
Keys. The public halves of your phone's encryption keys, and a signed "key card" friends use to check they're really talking to you. The private halves never leave your phone.
Mail waiting for you. Messages sit on the server, sealed, until your phone collects them, and are deleted once it has. The server can't tell who sent them.
Posts, chats, files, comments and public postcards. Stored sealed. The server knows who posted and when, and who commented, but not what anything says or shows — not even where it sits on the bulletin board, which is sealed with it. It doesn't know who liked what: a like on a post travels to the poster's phone sealed, like a message, and is counted there; a like on a comment arrives with no account attached, sealed so only the comment's author can see who sent it. The server can tell that a comment was liked, and how many times. After 24 hours a public postcard's picture or video is deleted, along with its reactions and the list of who watched it; a sealed record that it was posted, and when, stays so its place on the board can say "you had to be there". When someone watches your public postcard, the server records who watched, so it can show you, until then.
Reactions and poll votes on the board. Sealed with the thing they're on, so only people who can see it can see them — including who sent each one. The server knows who reacted or voted on what, and when, as it does for a comment, but not the emoji, sticker or choice.
Your calendar and to-dos. Kept on your phone, and backed up to the server sealed with a key only your phones hold (it travels in your iCloud Keychain), so a new phone can restore them. The server can't read them.
Event invites. An invite travels inside your conversations, like a message, or sealed on the bulletin board like a post, so the server never sees what the event is. When someone answers, their answer reaches the server with no account attached, sealed so only the host's phone can see who answered and how. The server knows that an event exists, by a random number, and how many people answered it. Answers are deleted after about a year.
Your Pong rating. Worked out on your phone after each game, and shown on your profile once you've played ten, sealed like your bio so only friends can read it.
Calls. 1:1 calls connect your phone directly to your friend's wherever possible; otherwise they pass through Twin's relay, which forwards encrypted audio and video it can't open. Group calls go through Twin's call server, which forwards encrypted media and knows who is in a call together and for how long. When someone is added to a call that's already running, it moves onto the call server too, so the server then knows who is in that call, even if it started as a 1:1. The people added learn the names of everyone in the call. When someone rings you, the server knows that a call is ringing for you and when, but not who is calling.
Movie picker. Your answers stay on your phone: the picking happens there. The list of films and prompts comes from Twin's server without your account attached, and film posters are fetched by Twin's server from Wikipedia, so Wikipedia never sees your phone. Twin's server sees which poster was asked for, but not by whom.
Invite codes, blocks and reports. Invite codes (encrypted when stored); whom you've blocked; and reports, which are sealed on your phone so that only Twin's owner can read them. A report contains what you reported, who sent it, and who reported it. The server also keeps a note of when a report was dealt with and what was done about it, in a few words — never a name.
Whether your account is suspended. If an account is suspended after a report, the server holds that it is suspended, when, and the reason, which is shown to the person it belongs to. Nothing on their phone is touched: their messages, photos and keys stay where they are, and the app comes back if the suspension is lifted. An account removed for good goes exactly as described under "Deleting your account" below.
Your phone's addresses for notifications, encrypted when stored. Notifications travel through Apple's push service and say only "New message"; your phone opens the real message itself.
Connection details. Like any service on the internet, the server sees the IP address of each connection. Twin uses it briefly to limit abuse (for example, too many sign-up attempts) and doesn't keep it.
Twin sends text messages for two things, and nothing else:
Message and data rates may apply. Reply STOP to stop receiving texts, or HELP for help.
We do not share, sell, or provide your mobile phone number or messaging consent data to third parties or affiliates for marketing or promotional purposes.
The terms for Twin's text messages are at https://twin--app.com/terms.
Twin keeps your messages, keys and the things you've shared on your phone, protected by iOS's own encryption. One key, which opens your old posts, is stored in iCloud Keychain so it survives moving to a new phone; Apple encrypts iCloud Keychain end to end.
Settings → Delete account removes your account and everything the server holds for you, straight away and for good: your username, number, keys, friendships, posts, postcards, comments, your calendar backup and waiting mail. Likes you gave are held on the phones of the people you liked, not by the server, so they stay counted there. It also erases Twin's data from your phone. Messages you've already sent stay on the phones they reached, because they belong to the people who received them. Server backups, kept to recover from failures, age out within 14 days. A copy of each is kept away from the server, with Hetzner in Finland, encrypted on the server to a key only Twin's owner holds, so neither the server nor Hetzner can read it.
Twin is for people aged 13 and over.
If this policy changes, the new version will be here with a new date, and Twin will tell you about anything significant.
Questions about privacy? Write to Twin: