TwoKey Privacy Policy

TwoKey has no accounts, no servers that can read your messages, and no analytics of any kind. We do not know who you are, who you talk to, or when. This is a property of how the app is built, not a promise about how we behave.

1. Information we collect

None.

We have no account system. There is nothing to sign up for, no username, no email address and no phone number. We do not know that you use TwoKey.

We do not collect: name, email, phone number, address book, location, device identifiers for advertising, usage analytics, or any behavioural data. The app contains no third-party analytics, advertising, attribution or crash-reporting software in any build.

If you have chosen in iOS Settings to share diagnostics with app developers, Apple may pass us a crash log when the app crashes. We do not ask for these, they contain no message content, and Apple's own privacy policy governs what Apple keeps.

2. Information stored on your device

Held on your phone, never transmitted to us:

• Your identity keys, generated on the device on first launch and stored in the iOS Keychain, marked so they never sync to iCloud Keychain and are never included in a device backup.
• Your pairings — the shared secret for each contact and their public identity key — stored in a file encrypted with a key that never leaves the phone. The file is excluded from iCloud and device backups.
• The names you give contacts. Chosen by you and stored only on your device. The other person never learns what you called them.
• Your app-lock settings and the passcode you set, if any. Face ID and Touch ID are handled entirely by iOS; the app is told only whether unlocking succeeded and never sees biometric data.
• A list of security events the app noticed, such as a contact's identity key changing. It is shown to you in Settings and can be cleared there.

Messages are held in memory only and are never written to your phone's storage. Depending on the lifetime you and your contact agree, a message is kept while the conversation is open, deleted a minute after you reply, or deleted as soon as you reply. Quitting the app, or iOS ending it in the background, discards whatever is in memory.

Backups. You can make an encrypted backup of your pairings and contact names from Settings, protected by a passphrase you choose. It is created on your phone and handed to the iOS share sheet; where you keep it is up to you, and we never receive it. A backup contains no messages and no identity key, so it can restore your contacts to a new phone but cannot let anyone impersonate you. If you lose the backup or its passphrase, we cannot help: there is no recovery route through us, because any such route would also be a way in for someone else.

"Erase everything" in Settings destroys all of the above permanently and immediately.

3. Our relay servers

When two phones cannot reach each other directly, messages pass through a relay we operate. It exists only to hold an encrypted message for a phone that is offline until that phone comes back; once delivered, a message exists only on the two phones. The relay:

• Holds messages in memory only. There is no database and no disk storage. If the relay restarts, undelivered messages are gone.
• Forgets each message as soon as your phone confirms it has received it. Until then it is held for delivery, and anything not collected within 24 hours is discarded.
• Sees only an opaque mailbox address and encrypted bytes. It is never told who sent a message, who it is for, or which mailboxes belong to the same conversation; the two directions of one conversation use unrelated addresses.
• Keeps no access logs and does not record IP addresses. Rate limiting is keyed on the mailbox address, not on where the request came from.

Message content is encrypted on your phone before it reaches the relay and decrypted only on the other person's phone. We cannot decrypt it. This is not a policy commitment — we do not hold the keys. The little the relay does hold (a mailbox address and the encrypted bytes waiting for delivery) is the minimum required to deliver a message, and it is kept no longer than that.

The relay runs on a server rented from a hosting provider. Like any hosting provider, it can observe that traffic reaches the machine, and what it retains about that is governed by its own policies, not ours. It cannot see inside the encrypted connection.

4. Notifications

To deliver a message while the app is closed, we send a notification through Apple's Push Notification service. That notification is empty — it contains no message content, no sender, and nothing identifying the conversation. Your phone wakes, collects whatever is waiting in all of its mailboxes, and decides locally what to show you.

To do this we hold your device's notification token, which Apple issues and which identifies your phone to Apple only. It is the minimum required to wake your phone and nothing more. It is kept in memory, never on disk, under a random handle chosen by your phone, and expires seven days after your phone last renewed it. Two separate servers are involved, on purpose: the relay, which holds mailbox addresses and refers to your device only by that handle, and the notifier, which holds the token and knows nothing about mailboxes. They run at different hosting companies in different countries. Neither machine, on its own, contains the link between your phone and a conversation, so a compromise of either, or a demand served on either provider, does not yield it. We operate both, and we say that plainly rather than claim more.

What we cannot prevent: Apple learns that your device received a notification, and when. This is unavoidable for any iOS app that uses push notifications, whatever the notification contains. Apple's handling of that information is governed by Apple's privacy policy, not ours.

5. Pairing, your local network, and permissions

Pairing happens in person: one phone shows a code, the other scans it with the camera. The code is never sent to us or to anyone.

• Camera. Used only while you are scanning a pairing code. Nothing is recorded or uploaded.
• Local network. After a scan, the two phones look for each other on the local Wi-Fi network to finish pairing directly, and will exchange messages directly whenever they can reach each other. iOS asks your permission for this. Other devices on the same network can see that *a* TwoKey device is pairing, under a random name that says nothing about whose; only a device holding the shared secret can complete a connection.
• Face ID / Touch ID. Optional, for the app lock; see §2.
• Notifications. Optional; see §4. Without them, messages arrive when you open the app.

6. What we share

We do not sell, rent or monetize your personal data or content, in any way. There are no third-party services in the app other than Apple's push notification service, described in §4, and Apple's own policies govern what Apple does with what it sees.

We may share information only in these circumstances:

• to comply with applicable law, regulation, legal process or an enforceable governmental request;
• to enforce these terms and investigate a possible violation of them;
• to detect, prevent or address fraud, security or technical issues; or
• to protect the rights, property or safety of I Totally Need That LLC, our users or the public, as required or permitted by law.

In every one of those cases we can share only what we hold, and what we hold is described in §3 and §4: encrypted bytes waiting for delivery, for at most 24 hours, and a notification token, for at most seven days. We hold no accounts, no message content, no contact lists and no logs, so a lawful demand for any of those can only be answered by saying so.

Nothing we hold is linked to a name, a phone number or a device we could identify, so a demand naming a person cannot be matched to anything on our servers, and what we could produce would be unreadable to us and to anyone else.

7. Children

TwoKey is not intended for anyone under 18. We do not knowingly collect personal information from children under 13, or from anyone else; we have no mechanism that could. Apple's age rating and Screen Time controls are the only age gate; the app has no way to ask.

8. Your rights

Privacy laws such as the GDPR and CCPA give you rights to access, correct, export and delete personal data a company holds about you.

We hold no personal data about you, so there is nothing to access, correct, export or delete on our side. The only things we hold at all are described in §3 and §4, with how long each lasts: a relayed message for at most 24 hours, a notification token for at most seven days. Everything else is on your device, where "Erase everything" in Settings destroys it permanently and immediately.

If you believe we hold information about you, write to support@itotallyneedthat.com and we will investigate and respond within 30 days.

9. Payment

Subscriptions are sold through Apple's in-app purchase system. We never see your payment details, card number or billing address; Apple provides us with aggregate sales information only. The free trial is kept by the app on your phone as a single date, the day your first pairing completed; it is included in your encrypted backup and is never sent to us.

10. What this policy does not protect you from

Stated plainly, because a privacy policy that only lists guarantees is misleading:

• The person you are messaging. They can screenshot, photograph the screen, or repeat what you said. Encryption decides who can read a message, not what they do next.
• A compromised or unlocked phone. Software with access to your screen can read messages before they are encrypted and after they are decrypted, and anyone holding your unlocked phone can read what is on it. The app lock helps; it is not a substitute for locking the phone.
• Traffic analysis. Someone watching your network can see that you connected to a relay and when, though not to whom you were talking or what was said.

11. Changes

We will update this policy as needed so that it stays current, accurate and as clear as we can make it. Any change updates the date above, and for anything material we will say so in the release notes of the app update that carries it and on this page. We will not retroactively reduce protections for data we already hold, which is straightforward, since we hold none.

12. Contact

support@itotallyneedthat.com — put "Privacy" in the subject line.

I Totally Need That LLC — TwoKey
1909 E Ray Rd
Ste 9 - 1033
Chandler, AZ 85225
United States