Privacy Policy

Twelo is a personal hobby project operated by Rick Wels, based in Breda, the Netherlands. You can reach us at the contact details at the bottom of this page.

Because Twelo processes biometric data of users in the European Union, the General Data Protection Regulation (GDPR) applies.

• Account data: email address, password (encrypted), name, date of birth, country
• Profile photo: the selfie you upload to your profile
• Biometric data: a facial feature vector (mathematical representation of your face) generated by AWS Rekognition. This is special category data under GDPR Article 9.
• Match data: similarity scores between your face and other users' faces
• Messages: in-app messages between matched users

• Account data: necessary to provide the service (GDPR Art. 6(1)(b))
• Biometric data and facial matching: based on your explicit consent (GDPR Art. 9(2)(a)). You can withdraw this consent at any time by deleting your account.
• Messages: necessary to provide the messaging feature you opted into

• Profile data and messages: stored in Supabase (PostgreSQL database), hosted in the EU
• Profile photos: stored in Supabase Storage, hosted in the EU
• Facial feature vectors: stored in AWS Rekognition, in the EU (Ireland, eu-west-1 region)

We do not transfer your data outside the European Economic Area.

We keep your data for as long as your account is active. When you delete your account, we will delete all your personal data within 30 days, including your profile photo and facial feature vectors from AWS Rekognition.

• Twelo (Rick Wels): as the operator, for technical maintenance only
• Supabase: database and storage provider (processor)
• AWS: facial recognition service provider (processor)
• Other users: only your name, country, profile photo and similarity score are visible to your match — never your email, date of birth, or biometric data

We do not sell your data. We do not use your data for advertising.

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate data via your profile page
• Delete all your data by deleting your account
• Withdraw consent for biometric processing at any time
• Object to processing or request restriction
• Lodge a complaint with the Dutch data protection authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl

Your facial feature vector is biometric data under GDPR Article 9. We process this data solely to match you with visually similar users. We do not use it for identification, tracking, or any other purpose. You can withdraw your consent at any time by deleting your account, after which your biometric data will be permanently deleted.

We use industry-standard security measures including encrypted connections (HTTPS), encrypted passwords, and access controls. AWS credentials are stored as environment variables and never exposed in code.

Twelo is not intended for anyone under the age of 18. We do not knowingly collect data from minors. If you believe a minor has created an account, please contact us so we can delete it.

If we make significant changes to this privacy policy, we will notify you via email or an in-app notification before the changes take effect.