Privacy Policy
What Twotic collects, why, how long it is kept, and the rights you have over it.
Last updated Aug 10, 2026
Twotic is the controller of the personal data described here. Contact: support@twotic.dev.
What we collect
Account data. Your name, email address and profile image, received from Google when you sign in. We do not collect or store passwords — authentication is delegated entirely to Google.
API keys. A cryptographic hash of each key, its first characters for display, and its last-used time. The key itself is never stored.
Usage data. For each call: the API and endpoint, HTTP method, status code, latency, amount charged, and timestamp. Aggregated per day, with recent individual requests retained briefly for debugging.
Billing data. Credit balance and ledger entries, plus payment transaction identifiers and status. Card and bank details never reach us — Dodo Payments collects and processes those directly, and we receive only the outcome.
We do not log request or response bodies. The content you send through an API is processed to produce your response and is not retained.
Why we process it
- To provide the service and authenticate your calls — performance of a contract.
- To meter usage and take payment — performance of a contract.
- To secure the platform against abuse — legitimate interests.
- To meet accounting and tax obligations — legal obligation.
Who we share it with
- Google — authentication.
- Dodo Payments — our merchant of record and payment processor, under its own privacy policy.
- Our hosting and database providers — infrastructure.
We do not sell personal data and do not use it for advertising.
How long we keep it
- Account data: while your account exists, then 90 days.
- Request logs: 30 days.
- Daily usage aggregates and billing ledger: as long as accounting rules require.
Your rights
Depending on where you live, you may have the right to access, correct, delete, port or restrict processing of your data, and to object to it. Email support@twotic.dev and we will respond within 30 days. You may also complain to your local supervisory authority.
Cookies
We set a session cookie to keep you signed in, and nothing else. There is no advertising and no third-party analytics tracking, which is why you are not being asked to accept anything.
Changes
Material changes will be announced by email to account holders at least 14 days before taking effect.