# Privacy — TwiceMet

*Plain words first, legal words second. Last updated 2026-10-16.*

## What we collect, right now, today

| What | Where | Why | Deletion |
|---|---|---|---|
| Your email + consent flag + timestamp | waitlist database | to tell you when we launch in your area | ask, and it's gone the same day |
| A visitor's-log note (if you leave one) | visitor database | it's a guestbook; that's the whole point | ask (even anonymously via the note's ID) |
| Your IP address, briefly | server logs, 14 days | to stop signup spam and machine-speed scraping | it ages out on its own; see **What we log** below |
| Your push endpoint, if you switch on phone notifications | account database | to tell your device "something happened" while the app is closed | switch it off, or ask, and it's gone — same-day |
| The line you write about yourself ("in your own words"), if you write one | account database | it's shown on your card, under the AI's introduction, in your words | edit it away in the app, or ask for same-day removal |
| A short note you attach when you match someone, if you write one | account database | it's shown only to the person you matched, at the top of your card and in their notifications, and it opens the conversation between you | press again without it, take the match back, or ask for same-day removal |
| Which societies you are in, and whether you founded one or run it as an admin | account database | a society is a room with a door, and the door has to know who holds a key | leave the society and the line goes with it, or ask for same-day removal |
| The day an organiser removed you from a society, and which organiser did it | account database | so a removal can be checked, appealed and reversed instead of remembered only by whoever made it | an organiser can lift it; erasure takes it with everything else |

No trackers, no analytics pixels, no third-party scripts on this site.
The map library is served by us rather than a CDN, so nothing on this page runs
someone else's JavaScript. One request does go to a third party: the map's tiles,
fonts and sprites come from `tiles.openfreemap.org`, and that request carries your
IP address to them. It happens on the map view, and it is the only place where a
visitor's address leaves this machine on its own.

**The cookies, and the ones you can refuse.** Everything here is first-party,
set by `twicemet.com` alone, and there are exactly three. `tm_consent` is the
one essential cookie: it remembers only your answer to one question and is set
the moment you answer the banner. `tm_vid` is
the optional one: if you press Accept, it gives your browser a random anonymous
number so we can count *visitors* rather than page loads. It identifies a
browser, never a person, is stored on our side only as a one-way hash, is never
connected to any account, and is never shared with anyone. Decline (or change
your mind from the footer, any time) and it is deleted and never written again.
In France, the UK and the Netherlands the law waves anonymous audience-counting
through without a banner (each with conditions this build meets, and an
off-switch is one of them), so there the visitor cookie is set quietly and the
footer's change link is your veto; in Germany and Ireland, where the law
insists on being asked first, nothing optional is set until you click Accept;
everywhere else we follow the same quiet rule, and a browser that sends Global
Privacy Control is always taken as an answer of no.
`tm_visits` is the optional fun one, and the friendliest cookie there is: it
sits in your browser, counts how many times *you* have visited, and shows you
"visit no. 7" in the footer. The server never reads it, writes it or stores
anything like it — it is a number about you that only you can see. Decline
clears it too. No cookie exists before you answer; nothing about you is
counted differently either way except the visitor tally.

If you switch on phone notifications, your browser starts carrying messages
for us: they travel to your device through the platform's push service
(Google's for Chrome, Mozilla's for Firefox, Apple's for Safari). The message
is encrypted so that only your browser can open it, and it carries the type of
event and nothing else. No name, no text, no identifier. The notification says
*something happened*; the app says what, from us, after you tap. The push
service sees that your device receives messages for twicemet.com and nothing
about what they were.

## In a society

A society is a group somebody starts, and the founder can hand the running of it to a few
others as admins. Both of them can see the member list, open a member's profile, and throw
somebody out. That is real power over other people's accounts, so it gets its own section
rather than one more row in the table above.

What an organiser can read is your profile at the tier a stranger on the map already sees:
the fields you set public, your photos, and whether you are verified. Nothing marked for
matches only is visible to an organiser, because running a club is not a match. Your email
address and your account id are on no profile at any tier, and there is no way to look
somebody up by hand: a profile comes back from a member list the organiser already holds,
and a person outside the society gets nothing back at all. An answer reading "no such
person" would itself confirm that an id exists, so the reply is the same empty one either
way.

What an organiser can do is remove you. A kick ends the membership and lets you ask to join
again, and that ask reaches the founder like any other. A ban ends it and refuses the next
ask out loud, until an organiser lifts it. Both are written down with the name of the
organiser who did it and the day it happened, in the society's own record, and both are
listed for the organisers afterwards, so that a decision can be reversed as easily as it was
made. Erasing your account erases the record with everything else.

What nobody can do is bigger than that. An organiser cannot appoint or dismiss an admin,
close the society, or remove another admin; those stay with the founder, so an admin cannot
take a society over or clear it of anybody who disagrees with them. Not even the founder can
remove themselves by accident or read a field you kept for matches.

The roster has shown members each other's first names since societies existed. What changed
on 2026-10-11 is that the people who run a society can go one step further and open the
profile behind a name, and the app says so where you would meet it: on the roster, in the
note an applicant reads before asking to join, and in this page.

## What we log

Running a service means keeping some logs. Here is exactly what exists, and for
how long. This is the part most privacy pages hide, so it gets its own heading.

- **Page views** are counted without an identity: UTC day, which page, whether the
tab died, and the country Cloudflare saw. No IP, no device fingerprint, no
session cookie. That file is what the "how is the room doing" numbers come from.
- **The raw IP address goes to a separate log**, one line per pageview, and is kept
for **14 days**. Same for agents knocking on the door: their IP, a timestamp, the
country, and a client name. The trim is enforced by the code that writes the line,
not by a scheduled job, so nothing older than 14 days exists even if every cron on
the machine died.
- **A salted hash of the IP** (first 12 characters of SHA-256) lets us notice that
the *same agent* came back yesterday without keeping the address itself. Rotate the
salt and every past hash becomes meaningless; that is the erase path for it.
- **Rate limits** count requests per IP in memory only. A restart clears them; no
IP is stored for this purpose.
- **Backups** are encrypted at rest on the same machine in Cambridge, UK, rotated
on a 14-day window, and are included in erasure: erasing you erases you from the
backups as they roll off.

Those IP logs are reachable by the operator's own admin view and by nothing else:
no public endpoint returns them, and they are not joined to profiles for matching.
If you want your lines dropped before the 14 days are up, ask and it is a same-day
edit.

## What we will never collect

Birthdays (only age bands), addresses (only districts), health data, precise
location, phone numbers, contact lists, or anything your AI wasn't explicitly
allowed to submit. Profiles are built field-by-field under your consent, and
the interview is designed so your AI **cannot** guess on your behalf. Unsure
answers are marked unknown and stay unknown.

## Your rights (the real ones)

- **Erase:** use the waitlist delete path, or `delete_profile` through your AI.
  Full removal of your profile, your photos and your account, same day. The in-app path
  asks why you are leaving before it deletes: one tap answers it, and Back closes the
  question and leaves your account alone. Three things are kept, and you should know all
  three before you press it.

  The exit reason survives, if you give one: the reason you chose and anything you typed
  with it, with no name and no account id attached. It is the only thing this product
  learns about why people leave, which is why the app asks rather than deletes silently.

  The conversations survive. The messages you sent stay in the other person's
  transcript, because a conversation is their record as much as yours and deleting your
  account should not quietly rewrite what someone else experienced.

  One audit line survives too: your email address, the name you signed up with, the date
  you joined and the date you erased, in a single internal record reachable only by the
  operator's admin credential. It exists because a transcript of messages with no way to
  say who wrote them is not evidence, and if someone uses this product to threaten another
  person, erasing their account must not be what ends the enquiry. It stores nothing about
  your matches, your board or your scores.

  Everything else about you is gone.
- **Export:** ask, get a machine-readable copy.
- **Object/rectify:** ask, we comply or explain honestly.
- **No automated decisions about you that matter:** our matching is deterministic on fields *you* consented to; no secret scoring, no shadow profiles.

## Controller & jurisdiction

**TwiceMet** is a trading name of **<[Your Name], [your sole-trader status or
Ltd number, if any]>**, with postal contact at **<[PO Box / virtual office
address, incl. postcode]>**. Data requests, erasure requests and complaints: the
in-app paths below, or by post to that address. We answer within one month, the
GDPR deadline.

Data residency: our own machine in **Cambridge, United Kingdom**. Backups are
encrypted at rest on the same machine, rotated 14 days, included in erasure.

No automated decision-making is used about you: matching is a deterministic
comparison of the fields you approved for matching, and a human's own word about
their own profile always overrides an AI's impression.

If you are in the UK, you can complain to the Information Commissioner's Office
(ico.org.uk, +44 303 123 1113). Elsewhere in the EEA, complain to your local data
protection authority.

## For AI agents acting for humans

You may submit only what your human authorized, field by field. You must not
submit contact details or addresses (our gate rejects them). You may erase a
profile with `delete_profile` at any time. We publish our full agent-facing
instructions at [/for-agents.md](/for-agents.md), and we never prompt-inject.

## The honest fine print

This site is run by a small team on a good-faith interpretation of GDPR. When
we're serious enough to need a lawyer, we'll get one. Until then the table
above is the truth, and the truth is the policy.