Privacy Policy

Last updated: 1 January 2025

TwoTicks ("we", "us", "our") is committed to protecting your privacy. This policy explains how we collect, use, and protect your personal data in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Data Controller

We are the data controller responsible for your personal data. If you have questions about this policy or your data, please contact us at the details below.

2. Data We Collect

Account Data

• Email address - Required for authentication and communication
• Account creation date - For account management

Task Data

• Tasks and lists - The content you create in the app
• Preferences - Your chosen theme, sound settings

Technical Data

• Device information - Device name, platform (for multi-device sync)
• Login timestamps - For security and account management

Payment Data

Payment processing is handled by Stripe. We do not store your payment card details. Stripe's privacy policy applies to payment processing.

3. How We Use Your Data

We use your data to:

• Provide and maintain the TwoTicks service
• Authenticate your identity (magic link login)
• Sync your data across devices (Pro subscribers)
• Process subscription payments
• Send essential service emails (login links, subscription confirmations)
• Improve our service

4. Legal Basis for Processing

We process your data based on:

• Contract - To provide the service you've signed up for
• Legitimate interests - To improve our service and prevent fraud
• Consent - For optional marketing communications (if you opt in)

5. Data Retention

• Active accounts - We retain your data while your account is active
• Deleted accounts - We delete all data immediately upon account deletion
• Backups (Pro) - Retained for 30 days, then automatically deleted
• Logs - Retained for 30 days for security purposes

6. Your Rights (UK GDPR)

You have the right to:

• Access - Request a copy of your data (via Account > Download My Data)
• Rectification - Correct inaccurate data
• Erasure - Delete your account and all data (via Account > Delete Account)
• Portability - Export your data in a machine-readable format
• Object - Object to processing based on legitimate interests
• Withdraw consent - For any consent-based processing

7. Data Security

We protect your data through:

• HTTPS encryption for all connections
• Secure token-based authentication
• Password-less login (magic links)
• Data stored on secure servers

8. Data Sharing

We do not sell your data. We share data only with:

• Stripe - Payment processing (for subscribers)
• Postmark - Transactional email delivery

These processors are bound by data processing agreements.

9. International Transfers

Some of our service providers are based outside the UK. We ensure appropriate safeguards are in place, including Standard Contractual Clauses where applicable.

10. Cookies

We use only essential cookies for authentication. See our Cookie Policy for details.

11. Children

TwoTicks is not directed at children under 16. We do not knowingly collect data from children.

12. Changes to This Policy

We may update this policy. We'll notify you of significant changes via email or in-app notice.