Security

The privacy page says what itwin.co keeps. This page says where it lives, how it is protected, how long it stays, and what we do when something goes wrong. It is written for the people whose data it is, not for auditors.

Where your data lives

Your account, your answers, your About sections, your settings, your connections and the chats your twin has are stored in a managed database run by a hosting provider under contract with us. Photos and logos go to a separate file store with its own address, served through a content delivery network.

The AI that answers for your twin runs with a model provider under contract with us. For each question it receives the text it needs to answer that one question, writes the answer, and hands it back. It does not keep your page, and nothing is trained on it.

Some of these providers run in data centres outside Turkey and outside the EU. The data protection notice says what that means and what covers the transfer.

Encryption

Everything between your browser and itwin.co travels over HTTPS. Nothing is served over plain HTTP, and browsers are told to remember that for two years.

The database and the file store encrypt what they hold at rest, and their backups are encrypted the same way.

Some things are never stored as themselves:

• Sign-in codes are stored as a one-way hash and expire after ten minutes.
• The fingerprint of your phone number is a one-way hash. It cannot be turned back into the number.
• The chat session cookie is signed, so it cannot be forged, and it carries nothing about you.

Who can get in

Nobody at itwin.co reads your chats, your answers or the notes your twin keeps as part of their day. We open a record when you report something, when a bug cannot be found any other way, or when the law requires it, and we keep those occasions short and rare.

The database, the file store and the servers are reachable only through named accounts with a second factor. Keys and secrets live in the hosting provider's configuration, never in the code and never in a chat. Everyone who holds access has a reason to.

Backups

The database provider backs up the data continuously, so a mistake can be undone. Backups are encrypted and roll over within thirty days at most. When you delete your account, your rows leave the live database at once and age out of the backups within that window. A backup is only ever used to restore the service. Nobody browses one.

How long things stay

• A chat and its messages: 30 days from the last message, then a daily job deletes them. The owner can delete sooner.
• The working context of one conversation: 2 hours.
• A note a twin keeps about a visitor: until the visitor or the owner deletes it, a connection ends, an account is deleted, or a year passes without a visit.
• A sign-in code: 10 minutes.
• A sign-in session: 30 days, or until you log out.
• A chat session cookie: 1 hour.
• Request logs at the hosting provider: a short window, measured in days, for debugging and abuse. They are not joined to chats.
• Your account and everything in it: until you delete it.

When you delete your account, your twin, your answers, your photos, your connections and the notes your twin kept are removed. It is not a soft delete. Only your old username stays on a list, so it is never handed to anyone else.

Phone numbers and fingerprints

If you sign in by phone, we keep the number so you can sign in again and so we can reach you about your account. We also keep a fingerprint of it: a one-way hash of the number in international form.

When you import contacts, the numbers never leave your device. Your browser works out the same fingerprint for each number and sends only the fingerprints to us. We compare them with the fingerprints of accounts and tell you which of your contacts has a twin. The fingerprints you sent are not kept, and we never see the names in your address book.

Uploads

A photo you add is shrunk in your browser before it is uploaded, so the file we receive is small and no longer carries what the original did, such as where it was taken. Only images are accepted. Each photo is stored under your twin's own folder in the file store, at a long address nobody can guess. Anyone with the address can open it, because that is how a public page works. Removing a photo deletes the file. Deleting your account deletes the folder.

Limits and scrubbing

Sign-in codes, chat messages and forms have limits per address and per session, so one person cannot flood a twin or guess a code. An anonymous chat starts with a check that the visitor is a person. Email addresses, phone numbers and social handles are removed from a visitor's message before it is stored and before it reaches the AI.

When something goes wrong

If we learn that your data was exposed, lost or taken, we will find out what happened, stop it, and tell you. We write to the email address or phone number on your account, say what was affected and what we did about it, and we do it without delay: within 72 hours of knowing, where the law sets that deadline. We notify the data protection authority where the law requires it.

Reporting a vulnerability

If you find a security problem in itwin.co, write to hello@itwin.co with what you found and how to reproduce it. A person reads it. We reply, we fix what you found, and we credit you if you want to be credited.

We ask three things: do not read other people's data beyond what proves the problem, do not disrupt the service, and give us time to fix it before you talk about it. We will not take action against anyone who follows that.

No sale of data

We do not sell personal data, rent it, or hand it to advertisers or data brokers. The only companies that see it are the providers that run the pieces above, under contract, for the purpose of running itwin.co.