Privacy Policy

Twinbeam is operated by Olmapp Piotr Olma, Cyniarska 36/109, 43-300 Bielsko-Biala, Poland ("we", "us", "our"). For the purposes of the GDPR we are the data controller for the limited personal data described below.

For any privacy question or to exercise your rights, contact us at [email protected].

Twinbeam is preparing for public release on Android and desktop, with Mac and Windows clients in testing. Public downloads and paid checkout are not currently available on this website. The implemented app features include encrypted links, text and files, Android SMS, current notifications, incoming-call controls and optional clipboard sharing. The launch email list is separate from device pairing. Two design choices shape the app:

• No accounts. Pairing uses a QR code or full pairing token. We do not ask for your name, email, or phone number to pair devices.
• End-to-end encryption for content. Links, text, SMS, notifications and file content are encrypted on your device before transmission. The relay does not receive the channel key and cannot decrypt that content. Routing metadata and content-free controls are described below.

These app design choices limit what we can access about your device-to-device content. Launch email subscriptions, billing and support correspondence involve the separate personal data described below.

Encrypted message content. Message bodies travel through the relay as encrypted blobs. The relay does not have the channel key to decrypt them. It retains encrypted history for reconnect delivery, including after a message is delivered (see Retention). File content is encrypted on the sending device and uploaded to object storage; its decryption metadata is sent in an encrypted message. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

Clipboard and call information. If you enable clipboard sharing, clipboard text is end-to-end encrypted and sent to a paired device; it is ephemeral, is not kept as message history, and requires the other device to be online. If you enable incoming-call mirroring, caller details are end-to-end encrypted and sent to your paired desktop for call controls. The relay can see message kinds and routing metadata but cannot decrypt these details. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

Push-wake token. If Android push wake is enabled, we store the device's Firebase Cloud Messaging registration token with its pairing so Google can deliver a content-free wake signal. The push payload contains only a wake instruction, not message content. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

Routing and delivery metadata. The relay can see channel, device and message identifiers, message kinds, timestamps, and message or upload sizes. Delivery receipts and message-deletion ID lists are content-free controls sent without end-to-end encryption. End-to-end encryption protects content, not all service metadata. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

Connection and device data. To route messages and protect the service we process technical data such as IP address, a hashed device token (we store only a one-way hash, never the raw token), connection timestamps, and basic diagnostic logs. Legal basis: performance of the contract and our legitimate interest in operating a secure, abuse-resistant service (Art. 6(1)(b) and (f) GDPR).

Subscription and licence data. Where paid checkout is enabled, Polar is the Merchant of Record and processes checkout, billing contact details, payments and applicable taxes under its own privacy terms. Twinbeam receives subscription and licence information needed to manage access, such as subscription identifiers, status and billing periods, not your full payment-card details. We store a one-way hash of licence keys and the channels they are bound to, so the relay can enforce plan limits. Legal basis for licence enforcement is performance of our contract (Art. 6(1)(b) GDPR); tax/accounting records are processed as required by law (Art. 6(1)(c) GDPR).

Launch email list. If you choose to subscribe, your email address and opt-in choice are submitted directly to Brevo to send a confirmation email and, after you confirm, Twinbeam early-access invitations and launch announcements. Brevo also processes the technical submission and consent records used to manage the form, prevent abuse and demonstrate consent. This list is not linked to your paired channel and is not used for a general newsletter or unrelated promotions. Providing an email is voluntary and is not required to use the app. Legal basis for launch emails: your consent (Art. 6(1)(a) GDPR). You may withdraw it using the unsubscribe link in any launch email or by contacting [email protected], without affecting earlier lawful processing.

Support correspondence. If you email us, we process your address and what you send to answer your request. Please do not send pairing invites, channel keys or licence keys. Legal basis: our legitimate interest in responding to requests (Art. 6(1)(f) GDPR), performance of a contract where applicable (Art. 6(1)(b)), or compliance with legal obligations for rights requests (Art. 6(1)(c)).

Website delivery and security. The website is prepared for hosting on Cloudflare Pages. When served there, Cloudflare processes request information such as IP addresses, requested URLs, timestamps, browser/user-agent information and security events to deliver the site and protect it from abuse. This is separate from the encrypted app relay and does not give Cloudflare your channel key. Legal basis: our legitimate interest in providing a reliable, secure public website (Art. 6(1)(f) GDPR).

• We do not read the content of your messages, SMS, notifications, files, clipboard text or caller details. The relay does not receive the key needed to decrypt them.
• We do not sell your data, and we do not use it for advertising or profiling.
• We do not require, collect, or link a real-world identity to use the core service.

The public marketing website currently sets no cookies and uses no analytics, advertising pixels, or browser storage for tracking, so it does not display a cookie-consent banner. The signup form does not load Brevo scripts, styles or tracking pixels while you browse. On submission, your browser sends the form directly to Brevo without including cookies or login credentials. Confirmation links may open Brevo-hosted pages, whose own privacy information applies. Polar checkout and portal pages are also separate services. If we introduce non-essential cookies or similar technologies on our website, we will explain their purposes and obtain any required consent before they are activated. You will be able to withdraw consent as easily as you gave it.

• Encrypted messages: relay history can include delivered messages until retention or message limits remove them. Default limits are up to 7 days and 100 messages per channel on Free, and up to 90 days and 1,000 messages on Pro. Devices may keep their own local history. Service limits are configurable.
• Encrypted files: default object-storage retention is up to 24 hours on Free and 30 days on Pro, subject to storage quotas and deletion. Downloaded copies on your devices are separate from relay retention.
• Clipboard text and incoming-call details are transient and are not retained as relay message history. A desktop may display a live incoming-call card only while the call is active.
• Relay application logs: Fly.io currently documents 7 days of retention for its searchable application logs. Logs include routing identifiers, message kinds, sizes and diagnostic events, not decrypted message bodies. This provider default is not a promise about every infrastructure or security log, and separately exported logs would require their own retention settings.
• Database backups: the repository pins Litestream 0.3.13 without overriding its documented 24-hour replica-retention default or hourly retention checks. A backup can retain deleted records until the relevant snapshot and log generation is removed; live deletion is not immediate backup erasure. These are configuration defaults, not a verified audit of deployed buckets or additional copies.
• Push identifiers: Google's Firebase documentation states that Firebase installation IDs used by Cloud Messaging remain until deletion is requested through its API; removal from live and backup systems can then take up to 180 days. Removing a Twinbeam pairing is not a guarantee of immediate deletion from Google's systems.
• Subscription/licence records: kept for the life of the subscription plus the period required by applicable accounting and tax law.
• Launch email list: used only for confirmation, early-access invitations and launch announcements, until you unsubscribe or the launch campaign ends, whichever comes first. We then remove you from the active list. Limited consent or suppression records may be retained where needed to demonstrate consent, honour an opt-out or resolve a legal claim; they are not used to send further launch emails.
• Support correspondence: retained while needed to handle the request and any related complaint or legal obligation.

We rely on providers to operate the service:

• Fly.io for relay hosting and message routing.
• Cloudflare Pages is the selected provider for the public website; deployment and domain connection are being prepared. Cloudflare R2 is already used separately for app storage.
• Cloudflare R2 for encrypted file objects and off-site database backups. Message bodies remain end-to-end encrypted in database replicas; routing and service metadata are not end-to-end encrypted.
• Google Firebase Cloud Messaging, if push wake is enabled, to deliver a content-free wake signal to an Android device.
• Brevo for the launch signup form, email list, consent records, confirmation and launch emails. Your email is submitted directly to Brevo rather than the encrypted app relay. Brevo's privacy information is at https://www.brevo.com/legal/privacypolicy/.
• Zoho Mail for our business email inbox, including correspondence sent to [email protected] and [email protected]. Zoho processes sender and recipient addresses, email content, attachments and associated delivery metadata to provide email hosting.
• Polar as Merchant of Record for paid subscriptions where checkout is enabled, including hosted checkout and the customer portal. Its published Data Processing Addendum applies where it processes covered data on our behalf; its own privacy policy also covers its direct billing, legal and other independent processing. Not all of Polar's processing is performed solely on our instructions.

Providers acting as processors must process personal data under applicable data-processing terms. Public terms alone do not demonstrate completion of account-specific acceptance or signature steps. We are checking those steps before public launch; in particular, Fly.io provides a DPA requiring the customer's signature and Zoho provides an account-based DPA initiation flow. Contact [email protected] for information about the applicable arrangements. Polar's hosted checkout and customer portal are separate services; review the terms and privacy information shown there before submitting billing information.

Our relay configuration selects Fly.io's iad region in the United States. Cloudflare and Google operate international infrastructure; a European business address does not mean all data stays in the EEA. Brevo states that its hosted databases are in the EU, including France, Germany and Belgium; this is not a claim that every subprocessor or support operation is EU-only. Our Zoho account's data-centre region and account-specific provider arrangements are still being verified.

Cloudflare's published Customer DPA includes EU Standard Contractual Clauses (Modules Two and Three as applicable) for restricted transfers, with UK and Swiss provisions. Google's Firebase privacy information describes EU-US and Swiss-US Data Privacy Framework participation and the UK extension, alongside applicable contractual terms. These are published provider mechanisms, not a blanket claim that every account-specific transfer assessment or agreement has been completed. End-to-end encryption protects message and file content but not all metadata. Contact [email protected] for the safeguards applying to a particular transfer and how to obtain a copy.

Under the GDPR you have the right to:

• Access — obtain confirmation of, and a copy of, the personal data we hold about you.
• Rectification — have inaccurate data corrected.
• Erasure — have your data deleted where the law allows.
• Restriction — ask us to limit processing in certain cases.
• Portability — receive certain data in a structured, machine-readable format.
• Objection — object to processing based on our legitimate interests.
• Withdraw consent — where processing is based on consent, at any time without affecting prior processing.

To exercise any of these rights, email [email protected]. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO) in Poland, or with the supervisory authority in your EU country of residence.

For paired-device data, because there is no user account, we may be unable to identify records relating specifically to you (Art. 11 GDPR). We may ask for information that lets us locate the relevant records; do not send your channel key or pairing invite. This limitation does not apply to locating a launch subscription or support correspondence using the email address you provided.

Clients protect message content with AES-256-GCM using a random 256-bit channel key, 12-byte nonces and 128-bit authentication tags. The channel key is generated on a device and shared through the pairing QR code or full pairing token, not through the relay. File content uses chunked AES-GCM encryption with file and chunk authentication. Remote service connections use HTTPS/WSS; local development may use loopback HTTP. Device tokens and licence keys are stored by the relay as one-way hashes. Keep pairing invites and paired devices private: anyone with the channel key can decrypt channel content they obtain. A new channel uses a new key; joining an existing channel reuses its key. End-to-end encryption does not protect a compromised endpoint or hide routing metadata.

Twinbeam is not directed at children under 16, and we do not knowingly process their personal data. If you believe a child has provided us data, contact us and we will delete it.

We may update this policy as the product evolves. We will revise the date at the top and, for material changes, provide a more prominent notice. A policy update does not itself give us consent for new email purposes or other processing that requires consent; we will request it separately where required.

Questions about privacy? Email [email protected]. For anything else, [email protected].