Privacy policy

Kam Jia Kai Brian Isaac makes and runs TwoPax, and is the person responsible for your data under the PDPA. Write to hello@twopax.app about anything here.

• Your sign-in: your email, or your Apple or Google identity. It lets you sign in, and nothing else.
• Your first name, so someone planning with you knows who you are.
• That you confirmed you are 18 or over.
• What you like, your areas and what you will not do, so a plan starts nearer what suits you.
• Your list, your favourites, your sets, and the places you passed.
• Your plans: who you planned with, the places, your rankings, the notes and the day.
• What you add to the shared place list, and what you change or report on it.
• Your notices, and your phone's notification token if you allow notifications.
• The people you have blocked.
• A list you import: the note you paste or the spreadsheet you choose is kept only until it has been read, and the places found in it for 30 days, so you can go through them. Only a note, or a spreadsheet you ask to have read by AI, goes to Anthropic, and only once you have said yes.

We hold no phone number, no photo, no precise location history and no payment card. The app does not track where you are or read your contacts. It has no advertising and no tracking, and sells nothing about you to anyone.

• Your profile is yours. The ranking reads it for a plan you said yes to, once, and the person planning sees the plan it made, never your profile.
• Your list, favourites and sets start on Only you. You can open each to people you plan with.
• The places you passed are never shown to anyone.
• A plan is seen by the two of you, and by whoever holds its link while the link is live. The link can be taken back and it runs out.
• Who plans with whom is for the two of you alone. There is no directory and no one is suggested to you.
• Who added or changed a place is seen by the stewards who look after the list, and by no one else. The list itself carries no names.
• How many people kept a place is shown only from 5 up, since a smaller number can point at a person.

If you plan with someone who has no account, what you tell us about them is a guess about a person who has not agreed to anything. It is kept on that one plan, used for that one plan, and deleted with it. We keep no name or contact for them beyond the name you give the plan.

The page a link opens needs no account. It keeps a random secret in a cookie on that browser for up to 120 days, so the same person keeps their seat on the plan, and we store only a scrambled form of it.

• The app's data is stored by Convex in Sydney, Australia, which is outside Singapore.
• Your sign-in is kept by Clerk, in the United States.
• Notices reach your phone through Expo's push service, in the United States, which passes them to Apple or Google to deliver. It receives your phone's notification token and the words of each notice.
• When you open a map, your phone fetches its tiles from OneMap, run by the Singapore Land Authority. On Android, Google's Maps SDK draws the map.
• When you import a spreadsheet, we read it ourselves, and it goes to no one else.
• A note you paste, or a spreadsheet you ask to have read by AI, is sent to Anthropic, a company in the United States, whose AI model reads it to pick out the place names, and only once you have said yes. Nothing else about you goes with it.

Each keeps your data under its own security and privacy terms. Your data leaves Singapore only to these services, for these reasons, and we choose them to protect it to a standard comparable to the PDPA's.

• What you add stays until you delete it, or until you delete your account.
• A place you added that was confirmed stays on the shared list, since the list is everyone's. Its history stays with a marker that names no one once your account is gone.
• A record of how each plan ended (the places offered and the one chosen) is kept to make the ranking better. It names no person.
• A copy of the shared list and its history is made each week as a backup.

• See what you have added, in the app.
• Correct your name, what you like, your areas and your limits, in Edit your profile.
• Delete any of it in the app, or your whole account under Me.
• Withdraw your consent by deleting your account. You can turn notifications off in the app or in your phone's settings at any time.
• Take back your yes to sending imported lists to Anthropic, in Me. Nothing more is sent after that, and a spreadsheet can still be imported, read by us.

Write to hello@twopax.app for a copy of what we hold about you, to correct it, or with any question about your data.

TwoPax is for people 18 and over. Someone who thinks a person under 18 has an account can write to hello@twopax.app, and the account will be deleted.

If data is lost or seen by someone who should not see it, the owner assesses within 30 days whether it must be notified, and if it must, tells the Personal Data Protection Commission and the people affected, as the PDPA requires.

The date above says when this policy last changed.