Twoody
01 Data controller
The data controller is Osmove SASU, 146 ave Léon Blum, 92160 Antony, France (RCS Nanterre 902 644 970). Contact: support@twoody.com.
Privacy
Privacy policy
This policy covers the Twoody app on your computer and this website. In short: the app keeps your data on your computer. During the beta it shares, by default, technical measurements without content, which you can turn off; never your conversations or documents, unless you tick the sharing of the whole answers. What leaves it is listed below, item by item. The online Twoody account, which is optional, has its own policy.
Last updated: 4 October 2026
The Twoody app on your computer
The app works without an account, on the Mac, and in private beta on Windows and Linux. Without an account — and, with one, for your private conversations — we receive neither your conversations, nor your documents, nor your memories, unless you tick "Also share the whole of each answer": here is what it keeps, and everything it sends over the internet.
02 Your data stays on your computer
Your conversations, your memories, the index of your documents and the models you installed are stored in the app's data folder — ~/Library/Application Support/twoody-desktop on the Mac, %APPDATA%\twoody-desktop on Windows, ~/.config/twoody-desktop on Linux —, in a local database readable only by your user account. Twoody does not encrypt that database itself: disk encryption (FileVault, BitLocker…) does, if it is turned on. Scanned PDFs are read (character recognition) on your Mac, by macOS, and dictation is transcribed on your computer. Your account's tokens and a Brave Search API key, if you enter one, are kept in the system's keychain; on Linux, when no keychain is available, they are kept in plain text in the app's folder. To erase everything: uninstall the app, then delete that folder.
03 Diagnostics and crash reports without content, during the beta
During the beta, "Share technical diagnostics" is ticked by default in the app's settings (Privacy); in stable versions it is not. If you say at first launch that you use Twoody for your work, it starts unticked; and nothing is sent before the first-launch questions are done. Ticked, the app sends every 15 minutes measurements of its answers: the model used (a model of Twoody's catalogue by its name, any other as "custom"), durations, token counts, the share served from the cache, whether your documents were read, the names of the tools used, sizes, errors. Each sending carries the app's version, the system and its version (for example macOS 15.4 or Windows 11) and the architecture (Apple Silicon, or Intel or AMD 64-bit). Once a day, even without use, the app also sends a summary of the installation: interface language, beta or stable version, date of the first launch, account linked or not, number of paired phones (0, 1, 2 or more), first-launch answers (personal or work, alone or as a team), capabilities turned on, the model engine (Metal, Vulkan or processor) and the families of engines configured, the default model (same rule as above), the number of installed models, and the computer's memory range, chip family and graphics card maker: broad categories, never a serial number or the computer's name. At the end of the first launch, if the box is ticked then, it sends your answers to those questions once, including the profession chosen from the list offered, and the capabilities turned on. It never sends a question, an answer, a memory, a document, a file name or a search. If the app crashes, the same box also sends a crash report: the type of error, its message and the lines of Twoody's code where it happened — file paths, web and e-mail addresses and quoted text taken out —, the process concerned (window, built-in server, model engine), the engine's last technical lines if it stopped, the app's version and the system. A crash of the app itself leaves a technical file (minidump) on the computer that is never sent: only the fact that it exists is. With the box unticked, these reports stay on the computer. If your computer is linked to a Twoody account, these measurements go to that account; otherwise they go to twoody.com under a number drawn at random by your installation, with no name or email (our server also sees the IP address they come from). If you later link this computer to an account, the measurements already sent are attached to it. A second box, "Also share the whole of each answer", is unticked by default: ticked, the app sends each answer whole, so that we can audit and improve Twoody — your question, the instructions given to the model with the memories and contacts they carried, the tools' arguments and results, and the answer —, only for answers given after you ticked it. Unticking a box stops the sending. Alongside these measurements, our server keeps a summary per installation: first and last time seen, first and last version, days of use, numbers of answers, failures and crashes, linked account. If your account's usage statistics are turned off, these measurements and reports are refused and nothing of them is kept. This data is kept as long as the account exists; without an account, it is erased on request to support@twoody.com with the installation's number, shown in the settings. On the computer, the app keeps the detail of each answer (⋮ under an answer, or Usage → Diagnostic screen).
04 The update check
With the beta's diagnostics and what you link yourself (e-mails, home, connectors), it is the app's only automatic exchange without an account. At most once a day, it asks downloads.twoody.com (served by Cloudflare) for a small file to know whether a new version exists. That server sees the request and the IP address it comes from, nothing that tells your computer from another; we keep only totals per day, system and country, without the IP address. Nothing is downloaded without your click, and the check can be turned off in Settings.
05 The models you install
When you install a model from Twoody, or the dictation model the first time you use it, its files are downloaded from Hugging Face (huggingface.co), which sees that download like any visitor's: IP address and requested file. If you use a model from LM Studio, Ollama or mlx-lm, what those applications contact depends on their own settings.
06 Web search, if you turn it on
It is off by default. When you turn it on, your search is sent to the engine you chose — DuckDuckGo by default, Brave Search with your API key, or your SearXNG server — then the app fetches the first pages found. That engine and those sites see your computer's requests, as with a search in a browser; your documents are not sent to them.
07 Code and the Agent (beta)
Code and the Agent read the files of the folder you open with a model running on your computer. They do not send them over the internet; only web search, if you turn it on, sends your searches out.
08 Connectors (beta)
Off by default. When you add a connector (an MCP server), the app starts it on your computer or connects to the address you give, and only to it. Before each call of one of its tools, the app asks for your consent, except for the tools you chose to "Always allow"; what the tool receives (the arguments shown) then goes to that service, which handles it under its own terms, and its answer is read by your computer's model. If the service asks you to sign in, you do so in your browser, on its own page. The tokens obtained, and those you type in, stay on your computer in a file only your user account can read: Twoody receives none of them. Google Analytics and Search Console are linked instead with "Sign in with Google" in Connectors: the app opens Google's sign-in page (accounts.google.com) in your browser, where you allow Twoody to view, read only, your Google Analytics data (analytics.readonly) and the Search Console data of your verified sites (webmasters.readonly). The authorization and the account's e-mail address stay on the computer, in the app's folder (a file only your user account can read), and are never shown again. When a message is about your site's statistics, or the model needs them to answer, your computer asks Google directly for the list of your properties and sites, the figures asked for (visitors, pages, sources, search queries, clicks, impressions, position) or a page's indexing status, at oauth2.googleapis.com, analyticsadmin.googleapis.com, analyticsdata.googleapis.com, www.googleapis.com and searchconsole.googleapis.com; Google sees these requests and the IP address they come from. The answers go only to the model you use (on this computer or another of your computers) and never pass through Twoody's servers; diagnostics, if you share them, contain only the names of the tools called. Nothing is ever changed at Google. Turning this connector off stops these requests; removing it forgets the authorization, which you can also withdraw at any time in your Google account.
09 Your home (Home Assistant), if you turn it on
Off by default. If you give the address of your Home Assistant and a token you created, the app sends it, from your computer, the commands you ask for and reads the state of your devices. The address and the token are kept in the app's database, on your computer.
10 Your e-mails, if you link them
Off by default. In Capabilities › E-mails, you can link a mailbox (Gmail, iCloud, Orange, Free, OVH, Yahoo, Proton Mail through Bridge…) with an app password created at your provider. The app then connects, from your computer and encrypted (TLS), to the one mail server you entered, every 10 minutes while the capability is on: it reads your Inbox and Sent folders over the period you chose (90 days at first) and keeps a copy on the computer, which the installed model searches when you ask it. It marks nothing as read, deletes or moves nothing and sends no e-mail; it only writes a draft in your Drafts folder, after you allow it. The password is kept on the computer, in the app's folder, and never shown again. Neither it nor your e-mails reach us. Removing the mailbox forgets the password; you then choose to keep or erase the local copy. An Outlook.com or Microsoft 365 mailbox is linked with Microsoft's sign-in instead, without IMAP: the app opens Microsoft's sign-in page (login.microsoftonline.com) in your browser, where you sign in and grant Twoody read and write access to your mailbox (Mail.ReadWrite), which Twoody uses to read your messages and, once you allow it, to save a draft there, never to send, move or delete anything. Your Microsoft password never goes through Twoody: Microsoft gives the app, on your computer, that permission and the account's e-mail address, the only part of your profile the app keeps. The app then reads your mailbox at Microsoft Graph (graph.microsoft.com): your Inbox and Sent folders over the period you chose, then their changes every 10 minutes while the capability is on (the text of the messages, senders and recipients, dates, read or flagged state, and the name, type and size of attachments, never their content), and keeps a copy on the computer as above; a message deleted or moved at Microsoft is hidden there, not erased. It renews the permission with Microsoft about once an hour; Microsoft sees these requests and the IP address they come from. A mailbox linked with Twoody 0.13.76 is still read over IMAP at Microsoft (outlook.office365.com) until you sign in again. The permission is kept in the app's folder (a file only your user account can read), the same one as for the Outlook calendar and contacts if they are linked to the same account, and is never shown again; removing the mailbox stops reading it. You can also withdraw the permission at any time in your Microsoft account. A Gmail mailbox can also be linked with “Sign in with Google”, without an app password or IMAP: the app opens Google's sign-in page (accounts.google.com) in your browser, where you sign in and allow Twoody to read your mailbox (gmail.readonly) and to create drafts in it (gmail.compose), which Twoody does not use to send, delete, move or change a message. Your computer then talks directly to Google: accounts.google.com to sign in, oauth2.googleapis.com to get and then renew the permission (about once an hour while the capability is on) and gmail.googleapis.com to read your Inbox and Sent folders as above (then their changes every 10 minutes) and to create the drafts you allow; nothing goes through Twoody's servers. Your Google password never goes through Twoody: the permission and the account's e-mail address stay on the computer, in the app's folder (a file only your user account can read), and are never shown again; Google sees these requests and the IP address they come from. Removing the mailbox forgets the permission; you can also withdraw it at any time in your Google account.
11 Your Outlook calendar and contacts, if you link them
Off by default. In Capabilities › Agenda or Contacts, you can link an Outlook.com or Microsoft 365 account with Microsoft's sign-in: the app opens Microsoft's sign-in page (login.microsoftonline.com) in your browser, where you sign in and allow Twoody to read your calendar (Calendars.Read) or your contacts (Contacts.Read). Your Microsoft password never goes through Twoody: Microsoft gives the app, on your computer, that permission and the account's e-mail address, the only part of your profile the app keeps. While the capability is on, the app then reads, from your computer, your calendars (Agenda) or your contacts (Contacts) at Microsoft Graph (graph.microsoft.com), read only, every 15 minutes and when you ask, and renews the permission with Microsoft about once an hour; Microsoft sees these requests and the IP address they come from. It keeps on the computer a copy of the events of the last 30 days and the year ahead (title, times, place, calendar name, the start of the description) and of the contacts (names, company, e-mails, phone numbers, birthday, postal addresses), which the installed model searches when you ask it; it reads neither attendees, nor attachments, nor photos. The permission is kept in the app's folder (a file only your user account can read) and is never shown again. Neither it nor this data reaches us. Turning the capability off removes its copy; removing the Microsoft account forgets the permission and removes both copies. You can also withdraw the permission at any time in your Microsoft account.
12 Your bank statements, if you import them
Off by default. In Capabilities › Bank, you can import statements exported from your bank (CSV, OFX, QIF). They are read and kept on the computer, and the installed model searches them when you ask it: balances, transactions, spending by category. The app connects to no bank and nothing of these statements reaches us. In a conversation kept on your account, the model's answer, which may quote amounts, is kept there encrypted end to end, like the other messages.
13 Send feedback
This button opens your email app with a message addressed to support@twoody.com, which includes the app's version and your system's. The app sends nothing itself: the message only leaves if you send it.
14 The Twoody account, only if you sign in
From the app's welcome or its Settings, you can sign in to an online Twoody account, or create one when sign-ups are open. Only in that case does the app talk to that account (part B). Since version 0.13.20, your synced conversations are kept there end-to-end encrypted (beta): your devices share a key our servers never have. Private conversations, marked with a hat and glasses, stay on your computer and do not go through our servers. The iPhone app, in private beta, reaches your computer away from home through an end-to-end encrypted relay, which sees account tokens, IP addresses, message sizes and timing, not their content, and keeps the encrypted messages only for as long as it takes to pass them on (two minutes at most). A few cases still go through our servers in clear: they are listed in part B.
15 Several trusted computers
With an account, you can trust several of your computers ("Faire confiance à cet ordinateur" — trust this computer — in Devices). They then share your history and your memories, end-to-end encrypted, and a question can search the documents of all your trusted computers. Your documents stay on the computer that holds them: only excerpts, with the name of their document, and the files you open from an answer travel from one computer to another, only between your own devices and end-to-end encrypted, sometimes through Twoody's relay, which cannot read them. To link a computer to your account, you enter the code it shows and a one-time secret, which is never sent to our servers; each computer also has a "code de sécurité" (security code), to compare with the one it shows itself before trusting it. A computer of your household or a shared one, like a computer you do not trust, only receives the conversation sent to it: never keys, memories or documents.
16 A computer without a screen
A computer without a screen that you trust (a Raspberry Pi, for instance) keeps the keys of your encrypted history on its disk: if someone took that disk or its memory card, they could read your history and your memories. We advise you to encrypt its whole disk. Removing your trust changes the keys: it will not be able to read what is written afterwards, but what it has already received cannot be taken back.
This website
twoody.com and its pages.
17 Cookies
The pages of this site set no cookie. Only the online account uses cookies, when you sign in to it: _twoody_session (sign-in and form security, deleted when the browser closes), and remember_user_token if you tick "Remember me". No audience-measurement or advertising cookie.
18 Audience measurement
No measurement cookie, no advertising tracking. We measure the site's traffic in three ways, on the basis of our legitimate interest in knowing how it is found and used. On the presentation pages, Cloudflare Web Analytics counts page views, referring sites, countries, device types and page speed, with a Cloudflare script, without a cookie or an identifier. When a visit comes from a campaign (utm_… parameters, an ad click identifier) or from another site, our servers record it: source, campaign, landing page, referring site, browser, country and truncated IP address (the last number of an IPv4 address replaced by zero, an IPv6 address cut to its /48 prefix); we keep these records 13 months, then they are deleted. Last, a click on a download button is counted, with the page, the campaign and the referring site of the visit, the country, the device type and what the browser says of the navigation (a person's click, or a link followed without one, as a link scanner does), without an IP address; we keep these clicks. We also count the files downloads.twoody.com serves (installers, the app's updates and its update checks), from the statistics Cloudflare keeps for us: per day, file, country, system and kind of software (browser, Homebrew, Twoody…), without an IP address or an identifier; we keep these totals. None of this is linked to an account. You can ask for these records to be deleted, or object to them.
19 Hosting
The site is served by Heroku, behind Cloudflare, which see your IP address as any host does. It loads no font or script from another service, apart from Cloudflare's measurement script.
20 The waitlist
If you join the waitlist — to be let into Twoody's private beta, or told when Twoody comes to your platform —, the form asks for your email address only. With it we keep what your browser and our CDN (Cloudflare) tell us on their own when you sign up: your IP address; your country, and the continent, region, city and postcode Cloudflare derives from that address when it gives them; your type of device, its system and browser and their versions; the languages your browser accepts; your time zone, screen size and display density, the window's size and whether the screen is a touch screen; the page you signed up on, the page that sent you to this site, and the campaign you came from (utm_… parameters, an ad click identifier) if there was one; the language of the page; and the IP address and browser of your confirmation. The platform we will tell you about is the one your device runs on. We use all this to prove your consent, to write to you when Twoody opens to you or comes to your platform, and to know where sign-ups come from. We send one email to confirm your address (the link is valid for three days), an email when Twoody is ready for you, and, from time to time, Twoody's news. The basis is your consent, and, for its proof and for knowing where sign-ups come from, our legitimate interest; you can withdraw your consent at any time: every email has a link that deletes your address for good, and all of this with it, at once. We keep all of this until you unsubscribe; an address never confirmed is kept too, but receives no other email. The emails are sent by Postmark, in the United States, without open or click tracking; the transfer relies on the EU–US Data Privacy Framework when the provider takes part in it, and otherwise on the European Commission's standard contractual clauses.
21 If you left your email
If you left your address on this site to be told about the launch, before the waitlist, we have kept it, with its date, the language, the country, the IP address, the browser and the campaign you arrived from, to write to you about it. Write to us to have it deleted.
For everyone
22 If you write to us
Emails sent to our addresses (support@twoody.com, hello@twoody.com…) arrive in our mailbox, hosted by Google (Google Workspace), where we keep them to follow up on your request.
23 Security
All exchanges with our servers are encrypted in transit (HTTPS); the synced history, your synced memories, the exchanges between your trusted computers, the relay and shared computers are end-to-end encrypted, as described above. The details of the measures in place are on our security page. If a data breach puts you at risk, we notify the CNIL and, if the risk is high, we tell you.
24 Your rights
Under the GDPR, you can access your data, rectify it, erase it, restrict its processing, object to processing based on our legitimate interest, withdraw your consent at any time and ask for the portability of the data you gave us. Write to us to exercise these rights: support@twoody.com; we answer within one month at most, and may ask you to confirm that the request comes from you. You can also lodge a complaint with the CNIL (cnil.fr) or with the data protection authority of your country.
25 Children
The online account is reserved for people aged 15 or over.
26 Changes
We may change this policy. The version in force is the one published on this page, with its date; a significant change will also be announced on this website.