TwoTrail

Privacy Policy

Last updated: 2 August 2026

TwoTrail is a private, two-person space — one shared trail, just yours. There is no public feed and no social graph. Your content is visible only to you and the one partner you share a trail with. This policy explains what we collect, why, and the choices you have.

Who we are — the data controller

TwoTrail (“we”, “us”) provides the TwoTrail mobile application for iOS and Android. Under the EU General Data Protection Regulation, the data controller for the personal data described in this policy — the party that decides why and how it is processed — is Oleg Klimakov, an individual based in Finland, operating TwoTrail in a personal capacity.

For privacy questions and data-subject requests, contact twotrail@klimakov.me; a postal address is available on request. We are not required to appoint a Data Protection Officer, so requests go to that address and are handled directly.

Information we collect

• Account information. Your email address and authentication details, used to create and secure your account.
• Content you create. Your daily responses, photos, and the relationship/trail data you and your partner add. This content is readable only by the two participants of a trail.
• Device & technical data. A push notification token (Apple APNs on iOS, Firebase Cloud Messaging on Android) so we can send reminders and partner notifications, plus your app version, operating system, and time zone.
• No usage analytics. The app contains no analytics SDK and no advertising or cross-app tracking. We do not collect behavioural telemetry — we do not know which screens you open or how often you use the app. What we do hold is listed above and below: your account, your trail content, a push token, and your subscription status, each because the app cannot work without it.
• Purchases. If you subscribe, your purchase and subscription status. Payments are processed by Apple or Google; we do not receive or store your card details.

How we use your information

• To provide the core experience — sharing a private trail with your partner.
• To send reminders and notifications you have enabled.
• To operate, secure, debug, and improve the app.
• To manage subscriptions and prevent fraud and abuse.

Legal bases (GDPR)

Where the EU General Data Protection Regulation applies, we rely on: performance of a contract (to provide the service you sign up for), legitimate interests (to secure and improve the app), and consent (for optional notifications). You can withdraw consent at any time in your device or app settings.

How your information is shared

We do not sell your personal data. We share data only with:

• Your trail partner — the content you choose to share within a shared trail.
• Service providers (processors) who run the app on our behalf, including:
  • Supabase — database, authentication, and storage.
  • RevenueCat — subscription management.
  • Apple (APNs) and Google (Firebase Cloud Messaging) — push notification delivery.
• Legal authorities when required by applicable law.

Data retention & deletion

We keep your data for as long as your account is active. You can request deletion of your account and associated data at any time by contacting twotrail@klimakov.me. Some records may be retained where required for legal or accounting purposes.

Your rights

Depending on your location, you may have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to withdraw consent you have given. To exercise these rights, contact us at the address above.

You also have the right to lodge a complaint with a supervisory authority. Our lead authority is the Finnish Office of the Data Protection Ombudsman (tietosuojavaltuutetun toimisto); you may also complain to the authority in the EU country where you live or work.

Security

Access to trail content is enforced at the database level so that only the two participants of a trail can read it. Data is encrypted in transit. No method of transmission or storage is completely secure, but we work to protect your information using industry-standard safeguards.

International transfers

Your data may be processed outside your country of residence by the service providers listed above. Where required, such transfers are protected by appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

Children

TwoTrail is intended for adults (18+) and is not directed to children. We do not knowingly collect personal data from children.

Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you in the app.

Contact

Questions about this policy or your data? Email twotrail@klimakov.me.