The online Twoody account

The data controller is Osmove SASU, 146 ave Léon Blum, 92160 Antony, France (RCS Nanterre 902 644 970). Contact: support@twoody.com.

Your account: email or phone number, password (hashed), first name, language, time zone. What you do with it: conversations (messages, answers and the details of the exchanges with the models), memories, notes, tasks, reminders, attached files and the audio of your voice messages, emails received at your Twoody address. If you connect them: the data of the linked services (Google calendar, Drive and Gmail, bank, music, work tools). For the iPhone app: usage analytics (screens, actions), which you can turn off in the app, and your location if you give it permission. And the technical information of your paired devices.

We process this data to run the service you use (performance of the contract); to secure it, prevent abuse and measure how the app is used (legitimate interest); for location, on the basis of the consent you give through the device permission; and to meet our legal obligations. We do not sell your data, and we do not use it to train models.

Our servers and database are hosted by Heroku (Salesforce), in its Europe region (Ireland), behind Cloudflare. Files (recordings, attachments, images) are stored in Google Cloud Storage. Server error reports go to Sentry; they may contain technical information about the request involved (IP address, browser, parameters).

By default, your messages and your voice are processed by OpenAI, with your first name, your email and your memories placed in the model's instructions. OpenAI is also used for fallback transcription, to title your conversations from their first exchange — including when another model, or the model lent by your Mac, answered —, to index your memories and to sort the emails you receive. Anthropic, Google (Gemini), Mistral or DeepSeek (based in China) only receive your messages if you pick one of their models. Your voice messages are transcribed by Google Cloud Speech-to-Text.

Postmark sends and receives the service's emails (sign-in codes, emails from your assistant, emails received at your Twoody address); its emails usually include open tracking. Vonage sends text messages (sign-in codes by phone, texts you ask the assistant to send). Apple and Expo deliver the app's notifications, which may contain the sender and subject of an email received or the text of a reminder.

When the assistant uses them to answer you: SerpAPI (web search), OpenWeather (weather), Amadeus (flights), OpenStreetMap and Google Maps (places, directions), Google Translate, Shazam via RapidAPI (recognising a song, from your recording), Browserbase (browser agent, if you turn it on), Phonevoice (calls you ask for). And the services you connect yourself: Google, GoCardless (bank), Spotify, GitHub, Notion, Linear, Slack, Home Assistant, Lint. Stripe and RevenueCat process the payments of accounts that had a subscription.

Several of these providers are based in the United States, including OpenAI, Google, Salesforce (Heroku), Cloudflare, Postmark, Sentry and Stripe; DeepSeek is based in China. Transfers to the United States rely on the EU–US Data Privacy Framework when the provider takes part in it, and otherwise on the European Commission's standard contractual clauses.

Your account data is kept for as long as the account exists. In the iPhone app, locations are erased after 180 days and usage analytics after 400 days.

The steps are on the Delete your account page.

Emails sent to our addresses (support@twoody.com, hello@twoody.com…) arrive in our mailbox, hosted by Google (Google Workspace), where we keep them to follow up on your request.

The measures in place are described on our security page.

Under the GDPR, you can access your data, rectify it, erase it, restrict its processing, object to it and ask for its portability. Write to us to exercise these rights: support@twoody.com. You can also lodge a complaint with the CNIL (cnil.fr) or with the data protection authority of your country.

The online account is not intended for children under 13.

We may change this policy. The version in force is the one published on this page, with its date; a significant change will also be announced on this website.