Privacy policy
Last updated:
Twenty is built to know as little about you as possible. This policy says what we collect, why, how long we keep it, and how you can see, download or delete it.
Who is responsible. Nathan Bardi, sole proprietor (entrepreneur individuel, EI) trading as Nabflux Labs, 30127 Bellegarde, France, publishes Twenty and is responsible for your data. Contact for privacy questions: privacy@playtwenty.app.
What we collect
| Data | Why | Kept |
|---|---|---|
| A keyed fingerprint of the identifier Apple gives Twenty for your Apple account, and a token from Apple, stored encrypted | Sign in with Apple, keeping banned accounts out, and ending Twenty’s access at Apple when you delete your account | While the account exists; the token until it is revoked after a deletion; after a ban, only the fingerprint, while the ban lasts |
| Country you choose when you sign up | The time of your daily Drop and the players you meet in World | While the account exists |
| Phone number, only for accounts created with one before Sign in with Apple, stored encrypted, and a keyed fingerprint of it | Finding friends who have your number, keeping banned accounts out (sign-in by SMS code has ended) | While the account exists; after a ban, only the fingerprint, while the ban lasts |
| Year of birth (the full date is only checked, never stored) | Twenty is for people aged 16 or more | While the account exists |
| Username, display name, profile photo, optional country shown to others | Your profile. Your name and photo are shown to the people who can see your duels or comments; your username only to your friends | While the account exists |
| Email address, only if you add one, stored encrypted | Account recovery and your data export | While the account exists |
| Device identifier, platform, app version, notification token | Sessions, notifications, security | While the account exists |
| Friends, friend requests, blocks, your invite code | The social features you use | While the account exists |
| Duels, votes, points, streaks, leagues, badges | The game | While the account exists |
| Reports of duels, comments and players, decisions, warnings, sanctions, appeals | Safety and your right to appeal | See below; your reports of comments are deleted with your account |
| Recordings of duels with people you do not know | Safety, checked only after a report or a stop by the filter | 72 hours, longer as evidence of a report; a World duel both players published is kept until one of them deletes it |
| Memories: videos of duels between friends (live recordings and Takes) | Memories for both players, deferred duels, the feed when both players share | Until one of the two deletes it; Takes that are not a memory, 72 hours |
| Your choices: keep memories, share your duels with friends, publish your World duels | Deciding what is kept and who sees it | While the account exists |
| Likes you give | The like count of a duel | Until you take the like back or your account is deleted |
| Comments you write, with your name and photo | Talking about a duel in the feed | Until you, a player of the duel or a moderator deletes it, or your account is deleted |
| Twenty+: store, product, end of the paid period, renewal, the frame you chose | Your subscription and its benefits; the store keeps the payment, we never see it | While the account exists; RevenueCat forgets you when the account is deleted |
| Product analytics, under a random identifier with no phone, email or username (off at launch) | Improving the app | 13 months, once turned on |
| Technical logs with your IP address | Security and abuse prevention | Full IP 7 days, then shortened |
Sign in with Apple: Twenty never asks Apple for your email address. When you create your account, it asks for your name, which you can leave out or edit in Apple’s sheet: it only fills in the name field of your profile, on your phone, and becomes your display name if you keep it.
What we never collect: your location (the app never asks for it and does not read it from your IP address), the content of your contacts (numbers are compared as fingerprints and never stored), private messages (Twenty has none), advertising identifiers.
Recordings and memories
- Duels between friends, live or Takes, are kept as memories for both players, unless one of them turned memories off (Profile, then Account). Either player can delete a memory, for both; removing or blocking the friend, or deleting the account, deletes the shared memories too. A reported duel is never kept as a memory: its videos follow the evidence rules below.
- Live duels with friends of friends or with the World are recorded for safety, with a visible “Recorded for safety” sign during the whole duel. A recording is deleted after 72 hours, unless the duel was reported, or it is a World duel both players published (see the feed below).
- World duels are also checked by an automatic filter while they run: still images are taken every 5 seconds, checked on our own servers and deleted at once.
- Our team looks at a recording only after a report, or when the filter stops a World duel. Reports are reviewed by people.
- When a duel is reported, its recordings are kept as evidence for 180 days, and longer when the law requires it (for example a suspected minor).
The feed
- Who sees a duel. A duel between friends is shown to the friends of either player only when both players share their duels. A World duel is shown to World players only when both players publish their World duels, and it is then kept until one of them deletes it. Both choices are off until you turn them on, in Profile, then Account. Turning one off hides your past duels at once. A block, in either direction, hides the duel.
- Blurred until you play. The duels of the feed stay blurred, by our servers, until you played a duel that day.
- Likes. A duel shows how many people liked it. Nobody, not even its players, sees who liked it.
- Comments. A comment shows your name and photo to everyone who can see the duel. It has at most 200 characters and no web address. You can delete your comments; either player can delete any comment on their duel.
- Profiles. Tapping a player opens their profile: photo, name, the username only for their friends, and only the duels you may already see in the feed. No stats, no list of friends.
- Reports. Anyone who sees a duel or a comment can report it. A reported duel leaves every feed at once; a reported comment is hidden from everyone at once. A person reviews it within 24 hours, within 2 hours when a minor may be involved.
- Under 18. Players under 18 cannot share their duels, publish them or comment.
Who processes your data for us
Our servers, database, storage and video service run in the European Union. Our providers are:
- Hosting of our servers and of the live video service: OVH (France).
- Database: Supabase, in the European Union (Frankfurt).
- Storage of videos, photos and exports: Cloudflare R2, in its European Union jurisdiction.
- Sign-in: Apple (Sign in with Apple).
- Emails: Brevo (France).
- Notifications: Expo, Apple and Google (Firebase Cloud Messaging) deliver them.
- Device checks: Apple App Attest and Google Play Integrity tell us whether the app runs on a genuine device; we keep only the result.
- Product analytics and error reports: none at launch. If we turn them on, they run in the European Union, without cookies, and error reports carry no name, number, message or video; this policy will name the provider first.
- In-app purchases: RevenueCat, with the App Store and Google Play.
- Automatic review of a reported video: not used at launch, reports are reviewed by people. If we turn it on, it runs in the European Union, this policy will name the provider first, and a report about a minor is never sent to it.
Your rights
- See and download your data: Account, Export my data. The export lists your memories (without the videos), likes and comments.
- Correct it: change your profile in the app.
- Delete your account: Account, Delete my account, or from the account deletion page without the app. Your account disappears at once, with your memories, likes, comments and reports of comments; the rest is erased within 30 days, except evidence kept for a report or by law. A banned or suspended account keeps a fingerprint of its Apple account or number while the sanction lasts. Twenty’s access to your Apple account is revoked at Apple.
- Object or complain: write to privacy@playtwenty.app. You can also complain to your data protection authority (in France, the CNIL).
Age
Twenty is for people aged 16 or more. A person who says they are younger cannot sign up. World duels, between strangers, are for people aged 18 or more by the date of birth given at sign-up: only the year of birth is kept to know it. Sharing duels, publishing them and commenting are for people aged 18 or more too. Ages are never shown to other players.