Twoody
01 Data controller
The data controller is Osmove SASU, 146 ave Léon Blum, 92160 Antony, France (RCS Nanterre 902 644 970). Contact: support@twoody.com.
Privacy
The online Twoody account
This page describes what the online Twoody account does with your data: optional; free, it uses the models of your own computers only. What is end-to-end encrypted there, and what is not, is set out below. The Twoody app does not need it: without an account, none of what follows concerns you, and the app's policy is the one that applies.
Last updated: 28 October 2026
The online account is optional: the Twoody app does not need one. It links your devices and keeps your synced conversations. A free account uses the models of your own computers only, never a cloud model. Osmove may, however, turn cloud models on for some people (see “AI models”). This part also covers the iPhone app, in private beta, which works with Twoody on your computer.
02 Data we process
Your account: email address (or phone number, for accounts once created that way), password in hashed form, first name, language, time zone. Your devices: their name, model, system and its version, app version, public encryption keys and session tokens. Your connections: with your account, the IP address of your sign-up and the last two IP addresses it was used from (site or apps), kept truncated (the last number of an IPv4 address replaced by zero, an IPv6 address cut to its /48 prefix), with the time of those two connections and their count; separately, the full IP addresses of the account's creation and of each of your connections (each new session opened by an app, a device or the site: the one our server sees and the one Cloudflare reports to us), with their date and time, kept for one year to answer requests from the authorities (see “Retention”). What you keep there: your synced conversations (end-to-end encrypted since version 0.13.20) and your memories synced between your trusted devices (end-to-end encrypted), and what the account keeps in clear, detailed below — older conversations, memories learned by the account, notes, tasks, reminders, attached files, emails received at your Twoody address. If you connect them: the data of the linked services (for instance Google's calendar, Drive and Gmail). The household or organisation you belong to, and the computers whose models you share or use. For the iPhone and Android apps: their installation identifier, usage analytics and error reports, which can be turned off; and the locations the iPhone app may have sent before 27 September 2026 (see “The iPhone and Android apps”). The messages you write to us from the app (“Write to us”): the message, the address to answer you at if you leave one, the language and the app, and the technical details if you include them. The answers you report (“Report this answer”): the category, your comment, the model's name and the app, and the answer's text if you include it. Your opinions on answers (👍 / 👎): the opinion, the reason and comment of a 👎, the model's name, the app and its version, the answer's identifier, and its technical details if the desktop app shares diagnostics.
03 What is end-to-end encrypted
Encrypted on your devices with keys our servers never have: the history of your synced conversations since version 0.13.20 of the computer app (and the matching version of the iPhone app), with what you attach to them; your memories, synced between your trusted devices; the excerpts and files of your documents that travel from one of your computers to another; the exchanges between the iPhone and your computer through the relay; the questions and answers sent to a computer shared by your household or organisation; and the questions and answers about a folder someone shares with you. Our servers see that your devices exchange, when, how much and between which devices — never the content. For your history and your memories, the account keeps only encrypted events and their metadata: their number, size, time and type (conversation or memory). So that the answer comes sooner, the app lets the shared computer know as soon as you open a conversation with it or start typing: it sends it the start of the conversation, sealed like a question, which the computer reads ahead without answering. The Twoody account cannot read it; it only sees that a request went through.
04 What is not
Our servers read, and keep in clear: the conversations kept on the account before that encrypted history, including when you resume one from the computer app; the questions asked to the account without going through the encrypted history — by the iPhone app when it is not paired with a computer, by older versions of the apps or by the original voice assistant —, with their answers and the details of their steps; the memories learned by the account itself, before your encrypted memories, and your notes, tasks and reminders; attached files and recordings; the emails received at your Twoody address; the desktop app's diagnostics and crash reports and, if you ticked their sharing, its whole answers. Since 11 October 2026 the account takes no question in clear, except those that the people Osmove turns cloud models on for ask those models (see “AI models”): a question that is not end-to-end encrypted (from an older version of an app, or from the command line pointed at the account) is refused and nothing of it is kept; a conversation kept in clear can still be read in the computer app, but is no longer continued through the account; and the account no longer hands anything in clear to your computers, which also refuse it themselves in the versions released after that date. Your apps copy these older conversations into your encrypted history on their own as soon as one of your devices is part of it; their copy in clear stays on the account until you erase it. The working copies of the questions your computer used to receive that way, in clear, are erased from our servers after 24 hours (7 days after an error). All these exchanges are protected in transit by HTTPS. You can erase these clear-text conversations yourself — conversations, questions, answers and their steps, recordings and attached files — with the "Erase my older conversations from the account" button of your profile on twoody.com; your encrypted history, your memories and your notes are not touched. In the Twoody app on your computer, "Bring back the memories of your account" copies the memories learned by the account to your computer, letting you choose which to keep, then lets you erase them from the account. As long as the account keeps data in clear, do not put health data in it, yours or other people's (patients, clients…): it is not hosted by a host certified for health data (HDS). The app on your computer, which keeps everything with you, is not concerned.
05 Sharing a folder of your Documents
With an account, you can share a folder of your Documents with someone of your household or organisation, or with your whole organisation, so that they can ask questions about its files ("Ask questions") or read them ("Read the files"), until a date or with no end. The share is decided and checked by your computer, the only one that reads the folder: it answers only the devices you have allowed, and you can remove a share at any time. The person's questions and your computer's answers (excerpts, names and paths of files in the folder, texts) go through the account end-to-end encrypted. For each share, the account keeps: the display name you choose (the folder's by default), the computer, the person or organisation, the right, the end date, when it was created, changed and removed and who removed it; and for each request: when, from which person, the fingerprint of their device's key, the computer, the size of the encrypted blocks and the outcome (relayed, computer offline, refused). The owners and admins of an organisation see the shares made within it (display name, from whom, with whom, right, end date) and can remove them or set rules; they never see the contents or the questions. Your computer itself keeps the list of its shares, the allowed devices and a log of the consultations (who, when, which operation, without the question or the file). What a person has already received stays in their conversations.
06 Purposes and legal bases
We process this data to run the service you use and answer the messages you write to us and examine the answers you report (performance of the contract); to secure it, prevent abuse, fix errors, measure how the iPhone and Android apps are used and the quality of the desktop app's answers and its crashes (legitimate interest, which you can object to in the app); to audit whole answers, on the basis of your consent (the "Also share the whole of each answer" box, unticked by default); for the locations the iPhone app may have sent before 27 September 2026, on the basis of the consent given then through the device permission; and to meet our legal obligations: accounting ones, and keeping for one year the data that identifies who created content (the IP addresses of the account's creation and of the connections), which the French law on confidence in the digital economy (LCEN) and decree no. 2021-1362 of 20 October 2021 require of hosting providers. We do not sell your data, and we do not use it to train models.
07 Where your data goes
Our servers and database are hosted by Heroku (Salesforce), in its Europe region (Ireland), behind Cloudflare, through which all traffic passes. Attached files and recordings are stored in Google Cloud Storage. The tokens of the Google services you connect are kept encrypted. Error reports from the server and the iPhone app go to Sentry: they contain technical information about the error (device, version, request involved), not the content of your conversations.
08 AI models
With a free account, your messages are processed only by your own computer's model, and by no cloud model: neither OpenAI nor another; conversation titles and voice transcription are done without them, and a question none of your computers can handle is sent to no AI service. No account has a paid plan today: Twoody therefore gives your messages, voice or memories to no online AI service. Should a paid option using such a service open one day, this policy will be updated first, and the option will remain your choice. Exception, since 11 October 2026: Osmove may turn the cloud models ChatGPT (OpenAI) and Claude (Anthropic) on, in the iPhone app and the computer app, for people it chooses (today, Osmove's team, and the demo account Osmove gives Apple and Google to review its apps before they are published). They appear only for them, under “In the cloud”, with the words “Your questions to these models go through the Twoody account, without end-to-end encryption.”, and are never chosen for them. When one of them chooses one, only the conversation goes: their question — with the text of a document they attach to the message themselves — and the earlier exchanges of that conversation go in clear through our servers, which send them to OpenAI or to Anthropic, in the United States, with a neutral instruction that gives only the date and the language of the answer. Nothing else goes: not the memories, profile or style instructions the account keeps about them, not their other conversations, not the results of a web search; their computers' documents are never attached on their own; the model has no tool there (web search, smart home, e-mail, calendar…); and no photo, no file and no voice recording goes (a message dictated on the iPhone is transcribed there, and only its words go). The conversation and its answers are kept on the account as described in “What is not”. These conversations are marked “Cloud” in the apps and are never put into your encrypted history.
09 Emails and notifications
Postmark sends and receives the service's emails (sign-in codes, emails received at your Twoody address); the account's emails include open tracking. We send no text messages. The current iPhone and Android apps do not sign up for notifications. An iPhone signed up with a version of the app older than 27 September 2026 may still receive them: Apple and Expo deliver them, and they may contain the sender and the beginning (120 characters) of an email received, or the text of a reminder.
10 Depending on what you use
When the account's assistant uses them to answer you: OpenStreetMap (Nominatim), to locate a place, which then receives your exact coordinates; and, depending on your plan, SerpAPI (web search), OpenWeather (weather), Amadeus (flights) or Phonevoice (calls you ask for). And the services you connect yourself: Google (calendar, Drive, Gmail), GoCardless (bank), Spotify, or the tools you give access to (GitHub, Notion, Linear, Slack, Home Assistant, Lint). There are no payments at this time: if a paid offer opens, this policy will name the provider that processes payments.
11 The iPhone and Android apps (private beta)
Each sends our servers usage analytics (screens, actions, and the campaign the install came from: the campaign parameters of the link that opened the app and, on Android, those Google Play passes to it at install, read once) and sends Sentry error reports, without the content of your conversations; both can be turned off in its settings ("Send error reports" for the latter). When first opened, the app draws a random installation identifier, which is neither Apple's nor Google's advertising identifier; it attaches it to its usage analytics. It gives the account the phone's name (often your first name, for instance “Marie's iPhone”), which names it among your devices; when you sign in with a code received by email, it adds the installation identifier, the phone's type (phone or tablet), brand, model, system and its version, and the country and time zone of its settings. With each question to a cloud model (see “AI models”), it also sends the account this information about the phone and the installation identifier; it goes neither to OpenAI nor to Anthropic. At each launch, it asks Expo (United States) whether an update exists, which passes on the IP address, the app's version and the type of device. Dictation is transcribed on the phone. The apps do not ask for your location; until 27 September 2026, the iPhone app could send it to the account if you had given it permission, and the locations received then are kept with the account (see “Retention”).
12 Transfers outside the European Union
Several of our providers are based in the United States: Salesforce (Heroku, which hosts our data in Europe), Cloudflare, Google, Postmark, Sentry, Expo and Apple. For the people who use cloud models, OpenAI and Anthropic, based in the United States, are among them too. Transfers to the United States rely on the EU–US Data Privacy Framework when the provider takes part in it, and otherwise on the European Commission's standard contractual clauses.
13 Retention
We do not delete an account's data automatically: conversations, questions and answers, memories, the iPhone and Android apps' usage analytics, the locations received from the iPhone app before 27 September 2026, diagnostics, crash reports, messages written from the app (“Write to us”), answer reports (“Report this answer”), opinions on answers (👍 / 👎) and, if you chose it, whole answers shared from the desktop app are kept for as long as the account exists, until it is deleted or you ask for erasure; you can also erase your old clear-text conversations yourself (see "What is not"). The only exceptions: sign-in codes and computer sign-in codes are erased after one day, the working copies of questions handled by your computer after 24 hours (7 days after an error), the relay's encrypted messages after two minutes at most, and the full IP addresses of the account's creation and of the connections, kept separately for our legal obligations, one year after each (or with the account if it is deleted sooner); the account keeps only their truncated form. These full addresses are encrypted in our database, appear on no administration screen and are read only to answer a request from a judicial or administrative authority; every lookup is logged.
14 Deleting your account
From the app or by email: the steps are on the Delete your account page. Deletion erases your account and what it keeps: conversations, encrypted or not, questions and answers, memories, notes, files, emails, devices and sessions, the IP addresses of your connections, sign-in codes, your waitlist sign-up, and your place in a household, an organisation or a computer sharing. All that remains is a trace with no personal data: the account's number, the dates it was created and deleted, and a random replacement address that says nothing about you. It is there so that this number is never given to another account, to prevent abuse (an old sign-in token or link opens nothing) and to tie the payments kept for accounting to it: those of a former plan are kept for ten years, without what identifies you, for our accounting obligations. What is on your computer is not touched.
For everyone
15 If you write to us
Emails sent to our addresses (support@twoody.com, hello@twoody.com…) arrive in our mailbox, hosted by Google (Google Workspace), where we keep them to follow up on your request.
16 Security
All exchanges with our servers are encrypted in transit (HTTPS); the synced history, your synced memories, the exchanges between your trusted computers, the relay and shared computers are end-to-end encrypted, as described above. The details of the measures in place are on our security page. If a data breach puts you at risk, we notify the CNIL and, if the risk is high, we tell you.
17 Your rights
Under the GDPR, you can access your data, rectify it, erase it, restrict its processing, object to processing based on our legitimate interest, withdraw your consent at any time and ask for the portability of the data you gave us. Write to us to exercise these rights: support@twoody.com; we answer within one month at most, and may ask you to confirm that the request comes from you. You can also lodge a complaint with the CNIL (cnil.fr) or with the data protection authority of your country.
18 Children
The online account is reserved for people aged 16 or over.
19 Changes
We may change this policy. The version in force is the one published on this page, with its date; a significant change will also be announced on this website.