Privacy Policy

Last updated: 19 October 2026

This policy explains what Twotell collects, why, who can see it and how you can control it. We keep it short on purpose and we collect as little as we can.

Twotell is run by Ramesh Maddula, an individual based in India. “We” and “us” mean the person who runs Twotell. For anything about your data, email [email protected].

The short version

Only adults (18 and older) can play.
We collect your first name, your answers and guesses, and your email only if you choose to give it.
Games and their answers are deleted automatically 30 days after they are created.
We don't sell your data.
You can ask us to delete your data at any time.

Who can use Twotell

Twotell is for people who are 18 or older, and we ask you to confirm this before you play. We do not knowingly collect information from anyone under 18. If you think someone under 18 is using Twotell, report it in the app or email [email protected]. A report like that ends the game and deletes its data.

What we collect

We collect only what the game needs.

Your first name: the name you type. The other player sees it, and it can appear in link previews. It can be up to 20 characters. Please use a first name only.
Your answers and guesses: the option you pick for each question and the option you guess for the other player. We store option letters (like “b”), not the answer text.
Scores: the Sync score and Mind-Read score we work out from those answers.
Petty Court text: if you use Petty Court, the case title and the text you write about the dispute (up to 600 characters).
Crush answer: your private yes or no. We delete it as soon as both people have answered. After that we keep only whether the interest was mutual.
Your email: only if you choose to sign in, to save your games and to hold Pro. We email you a 6-digit code and a link, so there are no passwords. We use your email only for sign-in and for notices you ask for.
Sign-in data: when you sign in we keep a scrambled (hashed) copy of your session and of each sign-in code, and the games you played in this browser are linked to your account.
Invite data: if you arrive through someone's invite link we remember the invite code in a cookie. If you then start your own game, we record that for the person who invited you, together with a scrambled identifier of your device, so we can tell real invites from fake ones.
Technical data: your IP address, browser and device type, and language. We also keep a one-way scrambled (hashed) identifier of your device. We use it for rate limits, blocks, referral checks and stopping abuse.
Purchase data: if you buy Pro, our payment provider handles your payment details and we receive confirmation that you paid. We never see your card number.

We do not collect phone numbers, your contacts, your precise location or your photos.

Cookies and browser storage

A secret game token in a cookie. It lets you reopen your own game and results. Our server stores only a scrambled (hashed) copy.
Your 18+ confirmation and first name are kept in your browser's session storage for your current visit. They are cleared when you close the tab.
A list of your recent games may be kept in your browser so you can find them again.
If you turn on notifications for a game, your browser gives us a push address and two keys for that game. We keep them only until the game is deleted, you turn notifications off, or the browser's push service says the address is no longer valid.
If you sign in, a session cookie keeps you signed in on this device for up to 90 days. It is deleted when you sign out.
A random device cookie, kept for a year. We store only a scrambled copy of it for 12 months, to tell whether an invited person is on a new device.
If you open an invite link, an invite cookie remembers the code for 30 days.

Our analytics are cookieless. Cloudflare, which protects the site, may set security cookies of its own.

How we use your information

To run the game: store your answers, work out scores and show the reveal to both players.
To show your first name to the other player and in link previews.
To write short AI readings and Petty Court verdicts (see the AI section).
To keep Twotell safe: rate limits, bot checks, reports, blocks and stopping abuse.
To send emails you ask for, such as your sign-in link.
To give you Pro, and to process payments and invites.
To improve the questions, using anonymous counts such as how often a question is shown or matched. These counts contain no names and no answers.
To fix errors and keep the service running.

If you are in the EU or UK, our legal bases are: providing the game you asked for (contract), keeping the service safe and improving it (legitimate interests), and your choice for optional things like email notices (consent). You can withdraw consent at any time.

What the other player sees

They see your first name.
Neither of you sees the other's answers until you have both finished. Then both sets of answers, guesses and scores are shown to both of you.
Crush: the person who receives the link always sees who sent it. Your yes or no is shown only if you both said yes. Otherwise nobody learns the other's answer.
Petty Court: you don't see the other person's side while you write yours.

Anyone with a game link can open it, but only the two players can see the results. If you share a screenshot or a receipt image, anyone you share it with can see what is on it.

AI features

Some features use AI providers: the short reading after a Truth Lock reveal, Petty Court verdicts, and the safety check that runs before every Petty Court verdict. When you use one of these, we send the first names and the answers or text that feature needs. We never send your email, IDs or device data. Crush does not use AI.

We use OpenAI as our main AI provider. Petty Court text (the case title and both sides) is sent to OpenAI only, for the safety check and the verdict, and never to DeepSeek; if OpenAI is unavailable, you see a pre-written screen instead of a verdict. For the short reading after a Truth Lock reveal, if OpenAI is unavailable, DeepSeek takes over as a backup and can receive the same content (first names, scores and the answers you picked). OpenAI: we use paid API access, and OpenAI says it does not use API content to train its models by default. DeepSeek: it runs servers in China, and its own privacy policy says that content sent to it may be used to train and improve its models. We have not agreed a separate no-training term with DeepSeek. Both providers may keep inputs for a limited time, for example to detect abuse. If you don't want your Petty Court text to be sent to OpenAI, don't use Petty Court. AI output is for fun, can be wrong, and is not advice.

How long we keep it

Games: deleted automatically 30 days after the game is created, together with its answers, scores and Petty Court text.
Deleting sooner: either player can delete a game with the “Delete this game now” button.
Notification addresses: deleted with their game, when you turn notifications off, or when the browser's push service reports them as no longer valid.
Crush answers: deleted as soon as both people have answered.
Petty Court text on cases our safety check flags: deleted 24 hours after the game is created.
Accounts: your email and Pro status are kept until you delete your account on the account page (or email us). Sign-in codes are deleted after a day.
Invite records and device identifiers: kept for up to 12 months, then deleted. If you delete your account, the invite records you earned are deleted with it.
Payment records: kept by our payment provider and by us for as long as tax and accounting rules require.
Safety records such as reports and blocks: kept only as long as needed to protect people from abuse.
Backups: deleted data can remain in backups for up to 14 days before it is gone.

Your rights

Depending on where you live, you can ask us to tell you what we hold about you, correct it, delete it, give you a copy, limit how we use it, or stop using it because you withdrew your consent. To do any of these, email [email protected]. Most players are guests, so we may ask for the game link or the email address you used so we can find your data. We aim to reply within 30 days.

If you are in the EU or UK, you can complain to your local data protection authority. If you are in India, you can also complain to the Data Protection Board of India and nominate someone to exercise your rights for you. Our grievance contact is [email protected].

Where your data goes

We run Twotell from India. Our providers may process data in other countries, including the United States and, if our backup AI provider DeepSeek is used, China. By using Twotell you understand that your information may be processed outside the country where you live.

Keeping it safe

Game links use long random IDs that can't be guessed. Player tokens are stored only as hashes. Traffic is encrypted with HTTPS. No online service can promise perfect security. If a breach affects you, we will tell you and the authorities as the law requires.

Changes to this policy

If we change this policy, we will update the date at the top. If a change is important, we will also tell you in the app or by email where we can.

Contact us

Questions, requests or complaints about your privacy: email [email protected]. Twotell is run by Ramesh Maddula, India.

Back to home