Privacy policy
Twocy stores what you ask it to store: text, links, screenshots, files, audio and emails. This policy explains, in plain language, what data we process, why, where it lives and what you can do about it. It covers the Windows app, the web app (twocy.app/app) and this website. It follows Brazil's data protection law (LGPD, Law 13,709/2018) and, for people in the EU and UK, the GDPR.
1. Who is responsible
The data controller is SPEAR DIGITAL HOLDING, Brazilian company registration (CNPJ) 49.000.665/0001-94, RJFG 105, Centro, Jaguaruna, Santa Catarina, Brazil ("Twocy", "we").
Data protection officer (DPO): Leonardo Garcia Coelho Pereira, at privacidade@twocy.app.
2. What we process
- Account: name, email and password. The password is stored only as a hash by our authentication provider; we never see it. A profile photo, if you choose to add one.
- Sign in with Google: if you choose to sign in with your Google account, Google confirms your name, email and profile photo to us. We do not receive your Google password or access to its emails, files or contacts. A Twocy account with the same email becomes a single account.
- Your captures: the content you save (text, links, images, audio, files and emails), with space, folder, tags, reminders, comments and dates.
- Email to Twocy (Pro): if you use your personal capture address, we receive the emails sent to it (sender, subject, body and attachments) to save them as captures. We also keep a short delivery log and the list of senders you allowed or blocked.
- Shared spaces: who you invite (email), each person's role (can edit or view only) and what each person added.
- Support: the messages you exchange with our team in the help chat.
- Payment (Pro): card details stay with the payment processor (Stripe). We receive the subscription status, plan, amounts paid, currency, payment method (card, Pix, etc.) and dates.
- Usage and presence: when you open the web app or the desktop app, we record the time of your last visit, app version, language, time zone and country, state/region and city of access (estimated by our hosting provider from your IP address; we do not store the IP with it). We also count captures, voice minutes and AI requests per account to apply plan limits.
- Website visits: when you open our public pages (home, pricing and download), we record the page, time, country, state/region, city estimated from the IP, referring site, device and browser type, and IP address, to measure Twocy's reach and block bots. We use no cookies for this. IP addresses are deleted after 90 days; only daily totals per country remain, which identify no one.
- Error reports: when something fails, we send the error message, app version and technical details, linked to your account. The content of your captures is not included.
- Security: IP addresses and access logs kept by our hosting providers to prevent abuse, and logs of blocked attempts (for example, too many requests).
Newsletter: when you subscribe, we store your email, language, source page, campaign when supplied, consent version and request, confirmation and cancellation dates. Creating an app account does not subscribe you. Your subscription becomes active only after email confirmation. The confirmation link expires in 24 hours; you can unsubscribe through any newsletter email without changing your app account. To limit abuse, we temporarily use a daily IP hash without storing the raw IP in that record.
3. What stays on your computer
- Copy history (Ctrl+Space): kept only in your PC's memory and gone when the app closes. It never reaches our cloud unless you choose to save an item.
- Passwords: anything copied from a password manager is ignored: it is not added to the history and cannot be saved.
- Offline queue: captures made offline wait on your PC and upload when you are back online.
The app only watches the shortcut keys (Ctrl+C+C, Ctrl+G+G, Ctrl+Space, Ctrl+Shift+A and the snip key) to know when to open. It does not record what you type.
4. Why we use it (and the legal basis)
- Storing, syncing and showing your captures across your devices, including those that arrive by email: performance of a contract.
- Sharing with the people you invited to a space: performance of a contract.
- Transcribing audio and answering AI requests, only when you trigger them: performance of a contract.
- Answering support requests: performance of a contract.
- Billing and tax obligations: performance of a contract and legal obligation.
- Keeping the service secure, preventing abuse, applying limits and fixing bugs; understanding, in aggregate, how many people use Twocy and where from: legitimate interests, always with the minimum data.
- Showing service notices inside the web app and sending account emails (confirmation, password reset, support replies, important notices). Newsletters and marketing emails only with your consent, and you can opt out at any time.
We do not sell your data, we do not show third-party ads and we do not use the content of your captures to train AI models.
5. Artificial intelligence
- Transcription (dictation and voice notes): the audio goes to OpenAI, which returns the text. Groq may be used as a backup under the same terms.
- Ctrl+Shift+A (translate, explain, summarize): only when you press the shortcut, the selected text goes to OpenAI and the answer comes back. We do not keep that text unless you click "Save to Twocy".
- TwocyAI (Pro): when you make a request, we send OpenAI your question and the captures needed to answer (as text). The AI never acts on its own: any suggested change needs your confirmation.
- Email sorting (Pro, optional): if you turn on automatic sorting, the subject, sender and an excerpt of the email go to OpenAI to choose the folder.
Under OpenAI's and Groq's API policies, what we send is not used to train their models. All of these features have per-account usage limits and run only when you trigger them.
6. Who we share with
Only with the providers that make the service work (processors), under contract and only for that purpose:
- Supabase: database, sign-in and files (servers in São Paulo, Brazil).
- Vercel: hosting for the website and web app (global network).
- Cloudflare: DNS and receiving emails sent to @twocy.app addresses.
- OpenAI and, as a backup, Groq: AI features and transcription (USA).
- Stripe: Pro plan payments.
- Resend: account, support and consented newsletter emails.
- GitHub: stores the weekly database backups, encrypted, for up to 90 days (USA).
- Telegram: our team receives internal alerts (for example, "new support message" or "new payment") with the minimum needed to act.
- Google: this website's fonts load from Google Fonts, which receives your IP address when you open the page. On the dashboard sign-in screen, the "Continue with Google" button and the quick sign-in prompt (One Tap) come from Google, which learns that you opened that screen; if you use the button, Google signs you in and sends us your name, email and photo (USA).
Some of these providers are outside Brazil. International transfers follow the LGPD (art. 33) and, where applicable, the GDPR, using standard contractual clauses and equivalent safeguards. We may also share data when required by law or court order.
In shared spaces, the people you invited see what is in the space, your name and your photo or avatar.
7. How long we keep it
- Your captures: for as long as you keep your account.
- Trash: items in the trash are permanently deleted after 7 days (Free) or 30 days (Pro), or sooner if you empty it.
- Account deletion: we immediately delete your data, spaces and files and cancel your subscription. Database backups are overwritten within 30 days.
- Billing: payment records are kept for the period required by tax law (usually 5 years), even after account deletion, linked only to your email.
- Error reports: deleted within 90 days.
- Support: conversations are kept while the account exists.
Newsletter: never-confirmed requests are removed after 30 days. Temporary sending-limit records are removed after 2 days. We retain the email, consent and state of confirmed or canceled subscriptions until a deletion request, including to respect unsubscribes. You can request deletion through our privacy contact.
8. Your rights
At any time and free of charge you can: confirm whether we process your data; access and correct it; ask for anonymization, restriction or deletion of unnecessary data; request portability; request deletion; know who we share it with; withdraw consent; and object to processing based on legitimate interests.
You can do most of this yourself in Settings:
- Correct: Settings → Account (name and photo).
- Export everything: Settings → Data → Export .zip (captures, files and a JSON index).
- Delete your account: Settings → Data → Delete my account.
For anything else, email privacidade@twocy.app from your account address. We reply within 15 days. You can also complain to Brazil's data protection authority (ANPD) or to the authority in your country.
9. Security
We use encrypted connections (HTTPS), private files with temporary links, row-level access control in the database (each person can only read what is theirs or in spaces they were invited to), usage limits against abuse, and service keys that never leave our servers. No system is 100% secure. If an incident creates a relevant risk to you, we will notify you and the authorities as the law requires.
10. Cookies and browser storage
We do not use advertising cookies or third-party tracking tools. We only store in your browser what the website and web app need to work (sign-in, theme, language). Details are in the Cookie policy.
11. Children
Twocy is for people aged 18 or over, or 13 or over with permission and supervision from a parent or guardian (or the minimum age required in your country, if higher). If we learn that an account does not meet this, we may close it.
12. Changes
If this policy changes in an important way, we will let you know by email or inside the app before the change takes effect. The last update date is shown at the top.
This English version is provided for convenience. If there is any conflict, the Portuguese version prevails.