Draft This text is a draft. It has not been reviewed by a lawyer yet and may change before Twenty opens.
Privacy policy
Last updated:
Twenty is built to know as little about you as possible. This policy says what we collect, why, how long we keep it, and how you can see, download or delete it.
Who is responsible. [Publisher name, legal form and address: to be completed before launch.] Contact for privacy questions: privacy@playtwenty.app.
What we collect
| Data | Why | Kept |
|---|---|---|
| Phone number, stored encrypted, and a keyed fingerprint of it | Sign-in by SMS code, finding friends who have your number, keeping banned accounts out | While the account exists; after a ban, only the fingerprint, while the ban lasts |
| Year of birth (the full date is only checked, never stored) | Twenty is for people aged 16 or more | While the account exists |
| Username, display name, profile photo, optional country shown to others | Your profile as your friends see it | While the account exists |
| Email address, only if you add one, stored encrypted | Account recovery and your data export | While the account exists |
| Device identifier, platform, app version, notification token | Sessions, notifications, security | While the account exists |
| Friends, friend requests, blocks, your invite code | The social features you use | While the account exists |
| Duels, votes, points, streaks, leagues, badges | The game | While the account exists |
| Reports, decisions, warnings, sanctions, appeals | Safety and your right to appeal | See below |
| Recordings of duels with people you do not know | Safety, only checked after a report | 72 hours, longer only as evidence of a report |
| Takes (recorded duels between friends) | Deferred duels | Up to 72 hours |
| Twenty+: store, product, end of the paid period, renewal, the frame you chose | Your subscription and its benefits; the store keeps the payment, we never see it | While the account exists; RevenueCat forgets you when the account is deleted |
| Product analytics, under a random identifier with no phone, email or username | Improving the app | 13 months |
| Technical logs with your IP address | Security and abuse prevention | Full IP 7 days, then shortened |
What we never collect: your location (the app never asks for it and does not read it from your IP address), the content of your contacts (numbers are compared as fingerprints and never stored), private messages (Twenty has none), advertising identifiers.
Recordings
- Live duels between friends are never recorded.
- Live duels with friends of friends or with the World are recorded for safety, with a visible “Recorded for safety” sign during the whole duel. A recording is deleted after 72 hours, unless the duel was reported.
- World duels are also checked by an automatic filter while they run: still images are taken every 5 seconds, checked on our own servers and deleted at once.
- A recording is looked at only after a report: first by an automatic review, then by a person when needed.
- When a duel is reported, its recordings are kept as evidence for 180 days, and longer when the law requires it (for example a suspected minor).
Who processes your data for us
Our servers, database, storage and video service run in the European Union. Our providers are:
- Hosting of our servers and of the live video service: OVH (France).
- Database: Supabase, in the European Union (Frankfurt).
- Storage of videos, photos and exports: Cloudflare R2, in its European Union jurisdiction.
- SMS codes and emails: Brevo (France).
- Notifications: Expo, Apple and Google (Firebase Cloud Messaging) deliver them.
- Device checks: Apple App Attest and Google Play Integrity tell us whether the app runs on a genuine device; we keep only the result.
- Product analytics and error reports: none at launch. If we turn them on, they run in the European Union, without cookies, and error reports carry no name, number, message or video; this policy will name the provider first.
- In-app purchases: RevenueCat, with the App Store and Google Play.
- Automatic review of a reported video: not used at launch, reports are reviewed by people. If we turn it on, it runs in the European Union, this policy will name the provider first, and a report about a minor is never sent to it.
Your rights
- See and download your data: Account, Export my data.
- Correct it: change your profile in the app.
- Delete your account: Account, Delete my account, or from the account deletion page without the app. Your account disappears at once; the rest is erased within 30 days, except evidence kept for a report or by law. A banned or suspended account keeps a fingerprint of its number while the sanction lasts.
- Object or complain: write to [privacy contact address]. You can also complain to your data protection authority (in France, the CNIL).
Age
Twenty is for people aged 16 or more. A person who says they are younger cannot sign up. World duels, between strangers, are for people aged 18 or more.