Twin Geek Privacy Policy

Last updated: September 26, 2026 (beta)

Twin Geek is in beta. This policy may be updated as the Service grows and as our business registration is completed. We'll tell you about important changes before they take effect.

This Privacy Policy explains what personal information Twin Geek collects, how we use it, who we share it with, and the choices you have. It applies to twingeek.app and any related apps (the "Service").

1. Who we are

The Service is operated by Twin Geek, based in Halifax, Nova Scotia, Canada, which is responsible (the "controller") for your personal information. Our Privacy Officer is responsible for protecting your personal information and can be reached at privacy@twingeek.app.

2. Information you give us

Account: email address, password (stored only in securely hashed form by our authentication provider), username, display name and date of birth (used to check the minimum age and apply teen protections).
Profile: bio, profile picture and banner, favourite games, platforms, region, languages, availability status, and gaming handles you choose to add (such as Discord, PlayStation Network, Xbox, Steam or Nintendo).
Activity and content: lobbies and sessions you host or join, join requests, squads, friends, messages, teammate ratings, and anything you upload. \[ONCE GEEK POINTS LAUNCH:\] point purchases, gifts sent and received, items you own, and refunds. Card and payment details are handled by our payment provider, and we don't store them.
Support and safety: support tickets, feedback and reports you submit, and our replies.
Preferences: language, theme, and notification and email settings.
Security: 2-step verification setup details and recovery codes (stored only as one-way hashes).

3. Information collected automatically

Activity data: sign-in times, games played and participation in lobbies and sessions. We use this to show Recently Played, and to award activity badges such as Daily Player and Always On.
Device and log data: browser and device type, IP address, approximate location derived from your IP address, and technical logs.
Email delivery data: whether emails we send were delivered, bounced or marked as spam.
Usage analytics: how features are used, so we can improve the Service. We use only Twin Geek's own built-in analytics; there are no third-party analytics or advertising trackers.
Browser storage: we store small items in your browser to keep you signed in and remember your language, theme and which updates you've seen. These are needed for the Service to work. We don't use advertising or cross-site tracking cookies.

4. How we use your information

To provide the Service: creating your account, showing your profile, matching you with players, running lobbies, sessions, squads and messages.
To communicate with you: in-app notifications, security emails (such as 2-step changes and password changes), optional emails based on your preferences, and occasional official messages or gifts from the Twin Geek account.
To keep the community safe: automated detection of potentially harmful messages, review of flagged content and reports by authorized staff, and enforcing our Terms.
To keep accounts secure: 2-step verification, checking new passwords against known data breaches, rate-limiting, and preventing fraud and abuse.
To improve the Service: understanding how features are used, mostly in aggregated form.
To meet legal obligations and respond to lawful requests.

5. Legal bases (EEA and UK users)

We rely on: contract, to provide the Service you signed up for; legitimate interests, for safety, moderation, security, preventing abuse and improving the Service; consent, for marketing emails (off by default) and anything else we ask your permission for, which you can withdraw at any time; and legal obligation, where the law requires it.

6. Automated message screening

We use automated tools to scan messages for potentially harmful content, such as harassment, hate speech, threats, and self-harm wishes. When a message is flagged or reported, authorized moderators see that message and a few messages before and after it for context, and nothing else from the conversation. Twin Geek's founders can access conversations when needed for safety, support, investigating reports or legal compliance, and every access is logged. Automated screening alone never leads to an account being banned.

7. Who can see or receive your information

Other users: your public profile (username, display name, pictures, bio, games, platforms, region, languages, availability, badges and reputation), your participation in lobbies, sessions and squads, and your messages to the people you send them to. If you send a gift, the recipient sees your username and any note you add. Your gaming handles are visible only to you and to authorized Twin Geek staff, except a contact handle you choose to add to a lobby you host, which is shown to players who can see that lobby.
Twin Geek staff: authorized admins and moderators, only as needed for support, safety and running the Service.
Service providers who process data on our behalf: our app platform provider (app hosting, database, sign-in and email delivery) and its infrastructure providers; Google Workspace (our support email inbox); \[ONCE GEEK POINTS LAUNCH: our payment provider, which processes purchases and refunds;\] and Have I Been Pwned (to check whether a new password has appeared in a data breach — only a partial, anonymised fragment of a password hash is sent, never your password).
Legal and safety: where required by law, or to protect the safety, rights or property of users, the public or Twin Geek.
Business transfers: if Twin Geek is involved in a merger, acquisition or sale of assets, subject to this policy.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

8. International transfers

Your information may be stored and processed in the United States (our backend is hosted in the US West region) and other countries where our providers operate. Where information is transferred out of the EEA or UK, we rely on appropriate safeguards such as Standard Contractual Clauses.

9. How long we keep information

Account and profile data: while your account is active. When you delete your account, it's hidden immediately and can be restored by signing in within 30 days; after that, your login and personal data are deleted. We keep a one-way scrambled fingerprint of your email address (not the address itself) for 90 days after deletion, or up to 2 years if the account was banned or connected to a safety concern, so we can recognise it if it's used to sign up again. A new account with the same email starts fresh and isn't linked to your old data, but our staff may be told the email was used before.
Safety records: if a deleted account is connected to a safety concern (for example a report about it, a suspension or ban, or a child-safety report), we keep its information for up to 90 days after deletion so it can be investigated, and longer where the law requires it or it's needed for a legal or police investigation. Reports, enforcement and ban records are kept for up to 2 years to prevent repeat abuse.
Security and email logs: including sign-in IP addresses, devices and times, kept for up to 12 months.

10. Your rights

Depending on where you live, you can ask to access, correct, delete or receive a copy of your personal information, and to object to or restrict certain uses. You can withdraw consent at any time. California residents have the right to know, delete and correct their information, and not to be discriminated against for using these rights; we do not sell or share personal information as defined by California law.

To use your rights, email our Privacy Officer at privacy@twingeek.app. We may need to verify your identity first. You can also complain to your local data protection authority.

11. Children

Twin Geek is not intended for children under 13, or the older minimum age that applies in their country. We ask for date of birth at sign-up and do not let anyone under the minimum age create an account. Players aged 13 to 17 have teen accounts: we use their date of birth to apply extra protections (limits on contact from adults, reduced profile visibility, stricter message filtering) and we do not send them marketing emails. If we learn that we have collected personal information from a child under the minimum age, we will delete it. Parents or guardians who believe this has happened can contact privacy@twingeek.app.

12. Security

We protect your information with measures including encryption in transit, database access rules that limit who can see each record, 2-step verification for staff accounts, hashed passwords and recovery codes, and checks against breached passwords. No system is completely secure, so please use a strong, unique password and turn on 2-step verification.

13. Emails and notifications

You can manage notification and email preferences in Settings, and every non-essential email includes an unsubscribe link. Account and security emails can't be turned off while you have an account.

14. Changes to this policy

We may update this policy. If a change is material, we'll let you know in the app or by email before it takes effect.

15. Contact

Twin Geek, Halifax, Nova Scotia, Canada. Privacy Officer: privacy@twingeek.app. General questions: hello@twingeek.app