Privacy Notice

1. Who we are

Twindwell is a shared-household chore and meal planning service operated by Shohanur Rahman, an individual.

• Operator location: Dhaka, Bangladesh.
• Postal address: a full postal address has not been supplied. Please use email as the reliable contact route.
• Email: twindwellteam@gmail.com
• EU representative: none appointed at this time. We are assessing whether an EU representative is required.
• Data protection contact: the email address above. We have not appointed a separate data protection officer.

In this notice, “we”, “us” and “Twindwell” mean the operator above. The operator is named as the provider and privacy contact. Controller and processor roles are still being reviewed.

2. Beta status

Twindwell is currently a free beta. Payment checkout is blocked while beta mode is enabled, and we do not collect card details in the beta. The billing code is test-only; Stripe is not an active payment processor for this beta.

3. Account, household and shared content

When you create an account or use Twindwell, we process:

• your name and email address;
• a password hash, not your plain password;
• language and reminder preferences;
• email verification, beta/trial dates, last login and status;
• session data needed to keep you signed in, including session ID, IP address, user agent and last activity;
• security tokens and verification or reset records.

When you create or join a household, we process the household name, plan type, timezone, weekly goal, rooms, member names and roles, and the content you add: chores, notes, assignments, completion history, meals, ingredients and groceries. We use this to provide the shared workspace, show who is responsible, calculate completion history and send reminders you enable.

Household members can see the household’s shared content, including member names and roles, chores, notes, completion history, meals, groceries and subscription status. Any member can export household data; the owner’s export also includes pending invitation addresses. Do not put information in shared content that you do not want the other household members to see.

4. Invitations

A household owner can invite another person by entering that person’s email address. We process the invitee’s address, a hashed invitation token, the expiry time and whether the invitation was accepted. We use the address to send the invitation, bind acceptance to the invited address and prevent token reuse. We do not add invitees to a marketing list.

The address comes from the person who sent the invitation, not from the invitee. Invitations expire after 48 hours. Pending records are removed by scheduled cleanup after expiry, subject to the production scheduler running.

5. Reminders and feedback

If you turn reminders on, we process your email address, language, reminder preference, household timezone, the number of due chores relevant to you, and a record that a reminder was sent on a local date. Reminders are service messages, not marketing. You can turn them off in your account settings.

If you send feedback, we process the message, category, optional contact permission and a short context value showing whether it came from the dashboard or account area. Staff can see your name, user ID and household association even when contact permission is off; the permission controls display of your email, not all identification. Do not include sensitive personal data, passwords or other people’s private information in feedback.

6. Support, staff access and audit records

If you contact support or a staff member takes an administrative action, we process support notes (body, user ID, author and timestamps) and audit records (actor, action, target, reason, changed fields and timestamp). We use these for support, security, accountability, abuse investigation and legal claims.

Authorised support and admin staff can access account details, email, household name, session count, support notes, subscription status, invitations and audit records. Support staff can request password resets or verification emails, revoke sessions or invitations, and add support notes. Admin and owner staff can also create or suspend users, cancel test subscriptions and manage feedback. Writes require a recent password confirmation and a reason. Staff do not currently get chore titles or completion content through the admin pages, but the server operator can access the database. The optional analytics report is aggregate-only and available only to owner and admin staff.

7. Billing data

Billing code is present but disabled during the free beta. If paid billing is activated later, we would process plan, currency, billing interval, subscription status, renewal or end dates, and provider customer or subscription identifiers. Payment card data would be handled by the payment provider, not stored in the Twindwell database. This notice would be updated before a paid launch.

8. Technical data, cookies and browser storage

We process technical data needed to deliver and secure the site: IP address, user agent, request path, timestamps, error information and security events. We use first-party cookies and browser or device storage as follows.

The session and CSRF cookies are used for sign-in and request protection. The demo and language storage is local to your browser or device. Optional analytics storage is written only after your choice. We do not use advertising cookies or third-party analytics cookies.

9. Optional analytics

Analytics is optional and off until you explicitly allow it. We do not create an analytics identifier, store an analytics identifier or send an analytics event before acceptance. On page load the site requests a small configuration file so it knows whether analytics is available. That request does not include an identifier and does not set an analytics cookie.

If you allow analytics, we process:

• an opaque consent receipt. The server stores only its SHA-256 hash, the policy and notice versions, and the grant, expiry and withdrawal times;
• a random pseudonymous session ID, stored in sessionStorage and rotated after 30 minutes of inactivity;
• allowlisted events only: logical page or screen views, chore, meal-plan and shopping-list views, signup button clicks, deliberate demo opens, and confirmed signup success;
• a broad source category, an approved campaign label from our own links, a device category (desktop, mobile, tablet or other) and the active interface language;
• UTC date and aggregate counts after processing.

We do not collect names, email addresses, account or household IDs, IP addresses, precise location or country, raw referrer URLs, arbitrary query parameters, chore or meal content, keystrokes, session recordings, heatmaps, fingerprints or advertising pixels. Analytics is not joined to your account or household, and we do not build individual timelines or profiles.

Purpose: understand which high-level product areas are useful so we can improve Twindwell, and provide owner and admin staff with an aggregate report.

Access: the report is available only to owner and admin staff. Support staff do not have access. It contains aggregate counts, not individual sessions, raw browsers or CSV exports.

Retention: raw pseudonymous sessions and events are kept for 30 days. Daily aggregates are kept for 365 days. Consent evidence is kept for 24 months; it contains only the receipt hash, versions and timestamps. Withdrawal deletes that receipt’s raw sessions and events immediately. Already-built aggregates contain no identifiers and expire on the aggregate schedule. Backups are not rewritten and may retain a row until the backup expires.

Your choice: you can accept, decline or withdraw at any time using “Privacy choices” in the site footer or account area. Declining or withdrawing does not restrict any website feature. Withdrawal stops collection and clears the analytics receipt and session from this browser, and open tabs are synchronised. You can also change your choice after the preference or consent expires. We may ask again if the notice or policy changes materially.

If your browser sends Global Privacy Control or Do Not Track, we treat that as a rejection: analytics stays off, no notice is shown, and no accept control is offered. Change that browser setting if you want to allow analytics here.

10. Fonts

DM Sans and Manrope font files are hosted on Twindwell’s own server and loaded from the same site as the page. The site does not contact Google Fonts or another font-delivery service. The files are covered by the SIL Open Font License, and the licence texts are published with the files.

11. Why we process data

• Account, household, chores, meals and invitations you accept: performance of a contract or steps at your request.
• Security, abuse prevention, technical logs and backup or recovery: our legitimate interests, subject to safeguards.
• Daily reminders: your consent, which you can withdraw.
• Feedback and optional follow-up: product improvement and support; separate permission for follow-up contact.
• Invitations sent to an address supplied by an inviter: our legitimate interests, with information to the invitee.
• Optional analytics: your consent under Article 6(1)(a) GDPR. The related browser storage and access is intended to rely on your consent under § 25 TDDDG.
• Cookies and local storage: § 25 TDDDG for terminal-equipment access, plus the GDPR basis for the resulting processing.

Where we rely on consent, you can withdraw it at any time without affecting processing already carried out. Where we rely on legitimate interests, you can object and we will assess whether our interests override yours.

12. How long we keep data

• Account: until you delete it; you must leave your household first. Staff accounts cannot be deleted through the app.
• Household: until deleted. If you leave, your membership ends and your assignments are unassigned; shared content remains for other members.
• Chores and completions: deleted chores are hidden but their rows and completion history remain until the household is deleted. There is no automatic purge of deleted chores.
• Meals and groceries: deleted when you delete them or when the household is deleted.
• Invitations: expire after 48 hours; scheduled cleanup removes rows once expiry is more than 7 days old.
• Reminder records: scheduled cleanup after 90 days.
• Sessions: 120-minute lifetime; logout invalidates them; cleanup can be delayed.
• Password reset tokens: 60-minute expiry; used tokens are deleted.
• Mobile tokens and email codes: access tokens expire after 7 days and are pruned daily; email codes are valid for 30 minutes and removed after expiry.
• Feedback: normally 12 months; staff can delete it earlier.
• Support notes and audit records: support notes are removed when the account is hard-deleted; audit records remain with the actor reference removed. No fixed retention period is currently applied.
• Queued and failed jobs: no fixed retention; payloads may contain notification data.
• Logs: Docker rotation limits size, not age; the production log destination and time-based retention are not fully verified.
• Backups: encrypted backups may retain data after deletion. The backup script has no automatic deletion or expiry.
• Optional analytics: raw 30 days, daily aggregates 365 days, consent evidence 24 months, as described in section 9.

13. Who can access data and where it goes

You can access your account and the household data available to members, and download a JSON export from the app. Other household members can see the shared content described above. Authorised staff access is described in section 6.

We use service providers for hosting, email delivery, backups and DNS/TLS. The intended hosting provider is Oracle Cloud in Frankfurt, Germany, according to the operator. Email is delivered with Resend, which may process data in the United States. Backup and DNS providers are operator-controlled services. The operator is based in Bangladesh. Where personal data is transferred outside the EEA, we need an adequacy decision or appropriate safeguards; provider contracts and transfer documentation are still being completed. Fonts are self-hosted and are not sent to a font provider.

We do not sell personal data, use it for advertising, or make automated decisions with legal or similarly significant effects. We may disclose data to professional advisers or authorities where required by law or to establish, exercise or defend legal claims.

14. Your rights

Subject to applicable law, you have the right to access your personal data, correct it, delete it, restrict processing, receive it in a portable format, object to processing based on legitimate interests, withdraw consent at any time, and lodge a complaint with a supervisory authority.

To exercise a right, email twindwellteam@gmail.com. We may need to verify your identity. We do not currently offer a self-service export or deletion for feedback, support notes, audit records, sessions, tokens or backups; those requests need manual handling. You can complain to the supervisory authority where you live, work or where the alleged infringement occurred. A list of EEA authorities is available from the European Data Protection Board at edpb.europa.eu.

15. Security

We use HTTPS, a secure HttpOnly session cookie, CSRF protection, password hashing, email verification, access controls, hashed invitation, reset and access tokens, and encrypted backups when the backup encryption key is configured. No system is completely secure. We do not have verified external uptime, backup or email-delivery monitoring, and we do not require admin MFA.

16. Children

Twindwell is intended for adults. We do not knowingly collect personal data from children. We have no age-assurance process. If you believe a child has provided data, contact us and we will investigate.

17. Changes

We may update this notice as the service, providers or legal requirements change. We will publish a new version with a date and, where appropriate, tell you in the app or by email. If a change is material, we may ask for your analytics choice again.

18. Contact

For privacy questions or requests, email twindwellteam@gmail.com. Our operator location is Dhaka, Bangladesh. A full postal address has not been supplied, so please use email. Do not send passwords, full payment-card details or sensitive personal data by email.