Privacy Policy

About This Notice

This notice explains what personal data Twine collects, why, who receives it, how long we keep it, and the rights you have. It covers twine.id, the Twine apps and APIs (including api.twine.id and auth.twine.id), and the websites, email, and booking pages Twine runs for domains connected to your account. It is written to meet Articles 13 and 14 of the EU General Data Protection Regulation (GDPR).

Who Is Responsible

The controller responsible for your personal data is:

• Service: twine.id (Build Stuff Fast LLC, a Wyoming limited liability company)
• Address: Registered Agents Inc, 30 N Gould St Ste R, Sheridan, WY 82801, USA
• Privacy contact: privacy@twine.id
• Data Protection Officer: Not currently appointed. The contact above handles privacy requests.

Twine also processes personal data about people who email you, book time with you, or contact you through a site Twine hosts. See People Who Contact You Through Twine.

EU and UK Representative

We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact in the European Union (EU) and the United Kingdom (UK), as GDPR Article 27 and UK GDPR Article 27 require.

Prighter gives you an easy way to exercise your privacy rights, for example to request access to or erasure of your personal data. To contact us through Prighter or to use your rights, visit app.prighter.com/portal/build-stuff-fast. You can also contact us directly at privacy@twine.id.

What Personal Data We Process

Depending on how you use Twine, we process:

• Account data: your email address, name, and profile picture from the sign-in provider you use, plus your Twine settings and preferences.
• Connected accounts: the accounts you link to Twine, including the provider, your user ID and the handle or email on that account, and when you connected it. This includes an Instagram account you verify by message, as described in Verifying Your Instagram Account.
• ID verification: if you choose to verify your ID, Stripe processes your document and selfie. We never receive the documents or anything on them. We store whether it passed and when, and a record of each step (when you started, when it was sent, Stripe's result, and Stripe's short reason code when it didn't pass, for example that the document had expired), and we ask Stripe to delete its copy as soon as it has a result. The result only affects your Twine Score; we never share it with apps you sign in to.
• Domain data: domains you register or connect, their DNS settings, and the registrant contact details (name, address, phone) that domain registration requires.
• Email data: messages sent and received at your Twine addresses, including headers, content, attachments, and delivery events.
• Calendar and booking data: events you create and booking requests people send you.
• Connected apps and API keys: the apps you authorize, the API keys you create, and a log of requests made with them. We store only a one-way hash of each key, never the key itself.
• Payment data: purchase records, Stripe payment references, and the fraud-risk rating Stripe assigns to a purchase. We never see or store full card numbers. For cryptocurrency payments, the transaction ID, sending wallet address, amount, and network.
• Security records: sign-ins and sensitive account actions, with the IP address and browser used.
• Diagnostics: error details when something fails, such as the feature involved and the error message.
• Product analytics: the steps you complete in sign-up and setup flows, recorded against an anonymous identifier.
• Website traffic: a daily count of page views on websites Twine hosts for your domain. We don't record who visited.

Purposes and Legal Bases

Each use of personal data has a legal basis under GDPR Article 6:

• Performance of a contract (Art. 6(1)(b)): running your account and Twine Score, registering and operating your domains, delivering and storing your email, running your calendar and booking pages, processing purchases, and serving the API keys and apps you set up.
• Legitimate interests (Art. 6(1)(f)): security; preventing fraud, spam, and abuse, including sending limits and suppression lists; checking incoming mail for sender authentication and spam; diagnostics; and product analytics. We weigh these against your rights, and you can object at any time.
• Consent (Art. 6(1)(a)): ID verification, linking additional accounts, sharing data with apps and assistants you authorize, and showing information on your public profile. You can withdraw consent at any time. Withdrawal doesn't affect processing that already happened.
• Legal obligation (Art. 6(1)(c)): keeping invoices and payment records, and meeting domain registry and ICANN requirements.

How Your Twine Score Works

Your Twine Score is an automated assessment of how much evidence shows that a real, accountable person is behind your account. It is not a credit score, and Twine doesn't use it to make decisions that have legal effects on you.

• What it uses: the accounts you connect, whether their email addresses match, and whether a connected account reports that it's verified; domains connected to your account and how they're set up; whether you've verified your ID; Stripe's fraud check on your purchases; how long you've had your account; and whether you've been active recently.
• What it doesn't use: the content of your email, your browsing, or your product analytics.
• Where it appears: on your dashboard, on your public profile if you choose to show it, and to apps you approve to see it.

We publish the signals the score uses but not their exact weights, which keeps it hard to game. Other Twine users can require a minimum tier, for example to book time with them, and they see your tier on requests you send them. If you think your score is wrong, contact privacy@twine.id and a person will review it.

Sign In With Twine and Connected Apps

When you use Sign in with Twine on another app or website, a consent screen lists what the app is asking for, such as your email, name, Twine Score, connected accounts, or domain. The app receives only what you approve, and from then on its own privacy policy applies to that data. You can see and revoke every app you've approved at twine.id/apps.

AI Assistants and Agents You Connect

You can connect Twine to an AI assistant or automated tool, for example Meta's Muse, so it can send and read email at your domain for you.

• You set the scope. You create an API key for one domain and choose whether it can send, read, or both. You can also limit it to a single address.
• What we receive: the requests the assistant makes and the content of any email it asks us to send.
• What we return: only what the key allows, such as messages to the address it's limited to. We hide one-time codes and sign-in links in those messages automatically. We return the contents of attachments only when the assistant asks for them.
• Their policy applies: the assistant's provider receives that data under its own privacy policy. For Muse, that provider is Meta. We don't control how the provider uses it.
• What we log: each request's key, action, time, and IP address. When the assistant reads a message, we log which message it was, not its contents.
• Revoking: you can revoke a key at any time in your domain settings, and it stops working immediately.

Paying With Cryptocurrency

Purchases made through our API, for example by an AI agent, can be paid in USDC, a dollar-backed digital currency, on the Base, Polygon, or Arbitrum blockchains.

• Blockchain payments are public and permanent. The sending wallet address, the receiving address, the amount, and the time are recorded on the blockchain, where anyone can see them. Neither we nor anyone else can change or delete them, so erasing your Twine account can't remove them.
• What we keep: the transaction ID, the sending wallet address, the amount, and the network, stored with the purchase record.
• How we check a payment: we look up the transaction through a blockchain node provider. The provider receives the transaction ID, which is already public, and nothing else about you.
• Coinbase: Base is a blockchain operated by Coinbase, so a payment on Base is processed by Coinbase's network. If we use Coinbase's payment service (the Coinbase Developer Platform) to submit a payment for you, Coinbase receives the signed payment, including the sending wallet address, and handles it under its own privacy policy.
• Final: a blockchain payment can't be reversed or charged back.

No Third-Party AI on Your Data

We don't send your data to third-party AI models, and we don't use your email, files, or account data to train AI. Where Twine uses machine-learning models, such as for search, they run on infrastructure we operate.

Your Email

We process your email to deliver it, store it, secure it, and organize it the way you set up. That includes automatic checks on incoming mail: whether the sender is authenticated using SPF, DKIM, and DMARC, and whether a message contains a one-time code or sign-in link, so we can hide it from anyone you share access with. We read calendar invitations attached to messages so booking works. We apply the labels and rules you create, and if you turn on forwarding we send copies to the address you verify. We don't read your email for advertising, and we don't sell it.

Your Public Profile

Twine can host a website on your domain that serves as your public profile. It can show your Twine Score, connected accounts, links, and agents, along with a machine-readable copy of the same details. You control what appears in your privacy settings at twine.id/privacy.

People Who Contact You Through Twine

When someone emails a Twine address, books time on a Twine booking page, uses a contact form on a site Twine hosts, or opens a share link, we process their details for the account owner and to keep the service secure.

• Email senders: their address, name, message, and attachments, kept in the recipient's mailbox until the recipient deletes them.
• Booking requests: name, email, requested time, and message. If the visitor never confirms their email, we delete the request about a week later. We delete declined and expired requests after 90 days. Confirmed bookings stay in the owner's calendar until the owner deletes them.
• Contact forms: the name, email, and message submitted, stored for the site owner.
• Share links: the email address the link was sent to, and a record of each time it was used.

If you contacted a Twine user and want your data removed, ask them or contact privacy@twine.id.

Sign-In With Third-Party Providers

You sign in to Twine with a third-party provider. Google Sign-In is available today, and we may add other providers over time. When you sign in with Google we receive your Google account email address, name, and profile picture. We use this information only to create and manage your Twine account. We do not access your Google contacts, Gmail, or any other Google services data. Google's use of your information is governed by the Google Privacy Policy.

If you sign in with Facebook or connect a Facebook account, we receive your name, email address, profile picture, and the user ID Facebook assigns to Twine. We use them only to create and manage your Twine account and to calculate your Twine Score. We don't post to Facebook, and we don't receive your friends, posts, messages, or any other Facebook data. Facebook's use of your information is governed by the Meta Privacy Policy. You can remove Twine from your Facebook settings under Apps and Websites. To have what we received deleted, see Delete Your Data.

When you connect another account to Twine, we receive the basic profile that provider shares, such as your user ID and the handle or email on that account. We never receive your passwords, because providers handle sign-in through OAuth. You can disconnect linked accounts at any time in your account settings.

If you connect an X account, we ask X whether that account has passed X's ID verification. We ask when you connect it and again about once a week while it stays connected. We send X only that account's user ID, never your name, email, or anything else about you, and we don't use your X login to do it. We store X's answer, the kind of verification X reports, whether X labels the account a parody, and when the account was created. We use this to calculate your Twine Score and, if you claim a Twine ID name, to weigh that claim. Disconnecting the X account or closing your Twine account stops the checks.

Verifying Your Instagram Account

Instagram doesn't offer a sign-in that proves who owns a personal account, so Twine verifies an Instagram account by direct message instead.

• How it works: we email you a code. You send it in a direct message from your Instagram account to ours, @twinedotid. We reply with a second code, and you enter it on Twine. That shows you can both send and read messages on that account.
• What Meta sends us: the messages people send to @twinedotid, the sender's Instagram username and name, and an ID Instagram assigns the sender for our account. We read these messages only to look for verification codes.
• What we keep: for an account you verify, its username, that ID, and when you verified it. For each attempt, a one-way hash of each code and when it was used or expired. We don't keep the text of any message, and a message that isn't a verification code leaves no record in Twine.
• What we never get: your Instagram password or login, or any access to your account. You don't sign in to Instagram through Twine, and we can't see your posts, followers, or other conversations.
• How it's used: a verified Instagram account counts toward your Twine Score and is treated like your other connected accounts, as described in Sign In With Twine and Connected Apps.
• How long: a verified account's details stay until you ask us to delete them or your Twine account is erased. Unfinished attempts are deleted 23 hours after they start. If an account reaches the daily limit of 3 tries, or someone reports a verification they didn't start, a record of those attempts (the Twine account, the Instagram username, and when and why each try ended) is kept for review for 12 months.
• The messages themselves stay in Instagram, where the Instagram Privacy Policy applies, and you can delete them there. Our team may read and answer other messages to @twinedotid in Instagram, like any business account.

Product Analytics

We use first-party analytics to see which steps in sign-up and setup work and which don't. We don't use Google Analytics, advertising pixels, or other third-party trackers.

• We record the steps you complete against an anonymous identifier stored in your browser. When you create an account, we link that identifier to it so we can see which steps lead to sign-up.
• Events never contain content you write.
• We don't sell or share analytics, and we don't use them to build advertising profiles.
• On websites Twine hosts for your domain, we count page views per day. We don't record who visited.

Security and Diagnostic Records

We keep a record of sign-ins and sensitive actions on your account, with the IP address and browser used, to protect your account and investigate misuse. After 12 months we remove the IP address, browser, and other details, and keep only the type of action and its date. When something fails, we record error details so we can fix it. We also use IP addresses briefly to limit how many requests any one source can make.

Recipients and Processors

We send personal data to these companies, and only for the purpose listed next to each. Our hosting, payment, domain, DNS, and email providers process it on our instructions. The others receive only the specific item described:

• Supabase: authentication, database, storage, and server functions.
• Netlify: hosting for twine.id and for websites on your domains.
• Railway: hosting for parts of our API.
• Stripe: payments, including stablecoin payments to our API, fraud checks (Radar), and optional ID verification (Stripe Identity).
• Namecheap: domain registration. Registrant details go to the registrar and the domain registry through a Microsoft Azure relay we operate. For domains you buy through Twine, we turn on WHOIS privacy so those details aren't published.
• Instant Domain Search: checking whether a domain name is available. We send only the names you search for.
• Cloudflare: DNS for the domains we manage.
• Resend: sending and receiving email for your domains.
• Google: sign-in, and registering domains we manage with Google Postmaster Tools so we can monitor delivery to Gmail. For that we send Google only the domain name.
• X: checking whether a connected X account is ID verified, as described in Sign-In With Third-Party Providers.
• Meta: Facebook sign-in, and the Instagram messages used to verify an Instagram account, as described in Verifying Your Instagram Account. Our replies to those messages contain only a code.
• Blockchain node providers: confirming a cryptocurrency payment. They receive only the public transaction ID.
• Coinbase: operates the Base blockchain, and may submit cryptocurrency payments for us, as described in Paying With Cryptocurrency.

Apps and AI assistants you connect are not our service providers. They receive data because you directed it, and their own privacy policies apply. We don't sell, rent, or trade your personal data.

International Data Transfers

Twine is operated from the United States, and we and our providers process personal data in the United States and other countries. When we transfer personal data out of the European Economic Area (EEA) or the UK, we rely on an adequacy decision or, where none applies, on Standard Contractual Clauses (SCCs) with appropriate supplementary measures. You can request a copy of the relevant mechanism at privacy@twine.id.

How Long We Keep Your Data

• Account data: while your account is open. If you close your account, we keep it for 12 months so you can come back, then erase it.
• Erasure: when you ask us to erase your account, we do it without undue delay. If you still hold domains through Twine, we first help you transfer or release them, because a domain registration has to stay with a registrant. After erasure we keep a one-way hash of your email address, the dates, and the reason as a record that the erasure happened, plus the records listed below that we're required to keep.
• Email: until you delete it or your account is erased.
• Booking requests: as described in People Who Contact You Through Twine.
• Security records: IP address, browser, and details are removed after 12 months.
• ID verification: the result stays until your account is erased. The step-by-step record of each try is deleted after 12 months.
• Diagnostics and product analytics: deleted after 12 months. That leaves us a full year of records to answer questions from the platforms and payment providers we work with about an incident, a dispute, or a review.
• Suppression records (addresses that bounced, complained, or unsubscribed): kept after account erasure, because honoring them is a legal and deliverability obligation.
• Invoices, payment records (including cryptocurrency transaction records), and domain registration records: as long as tax, accounting, and registry rules require. Records on a public blockchain are permanent and outside anyone's control.

Your Rights

Under GDPR Articles 15 to 22 you have the right to:

• Access (Art. 15): confirm whether we process your data and get a copy.
• Rectification (Art. 16): correct inaccurate or incomplete data.
• Erasure (Art. 17): have your account and personal data erased.
• Portability (Art. 20): receive your data in a structured, machine-readable format.
• Restriction (Art. 18): ask us to limit processing in specific cases.
• Objection (Art. 21): object to processing based on legitimate interests.
• Human review: ask a person to review your Twine Score.
• Withdraw consent (Art. 7): withdraw consent for any processing that relies on it, without affecting processing that already happened.
• Complaint: complain to a supervisory authority (see below).

Email privacy@twine.id to use any of these rights. Some controls are already in your account: visibility settings at twine.id/privacy, connected apps at twine.id/apps, and API keys in your domain settings. We respond within one month. For complex or numerous requests we may extend that by up to two more months, and we'll tell you if we do.

Delete Your Data

You can ask us to delete your personal data at any time:

• Your whole account: email privacy@twine.id from the address on your account and ask us to erase it. If you still hold domains through Twine, we first help you transfer or release them, as described in How Long We Keep Your Data.
• One connected or verified account, such as Facebook or Instagram: disconnect it at twine.id/providers so it stops counting toward your Twine Score and stops being shared with apps, then email privacy@twine.id and tell us which account to delete.
• Facebook: removing Twine in your Facebook settings under Apps and Websites stops Facebook from sending us anything new. To delete what we already received, email us as above.
• Instagram, without a Twine account: if you messaged @twinedotid, email privacy@twine.id with your Instagram username and we'll delete anything we hold about it. See Verifying Your Instagram Account for what that can be.

We complete deletion requests within one month and confirm by email. We keep only the records we're required to keep, as listed in How Long We Keep Your Data.

If You're in the United States

We don't sell your personal information or share it for cross-context behavioral advertising. We use your ID verification result only to verify you and to calculate your Twine Score.

Cookies and Local Storage

We use browser storage, never advertising cookies, for:

• Essential: your sign-in session and the state of a sign-in in progress.
• Preferences: theme, currency, and mail layout.
• Drafts: sign-up answers before you create an account, domain setup progress, and unsent email.
• Analytics: the anonymous identifier described above.
• Codes: invite or discount codes from a link you followed, kept until used.
• Returning browser: a marker that this browser has signed in before, so we show Sign In instead of Get Started.

When you sign out, we clear all of this except the returning-browser marker.

We serve everything on twine.id from our own servers, including fonts, so visiting twine.id doesn't send your IP address to anyone else. The exceptions are paying and verifying your ID: at those two steps only, Stripe's form loads from Stripe and sets its own cookies to prevent fraud. We don't use advertising or cross-site tracking cookies.

Children

Twine is not for children. You must be at least 13, or 16 where local law requires it, to use Twine, and at least 18 to buy a domain or any paid service. If you believe a child has given us personal data, contact privacy@twine.id and we will delete it without undue delay.

Security

We encrypt data in transit (TLS) and at rest, enforce row-level security in our database, store API keys only as one-way hashes, and restrict internal access. No system is perfectly secure. If we become aware of a personal data breach that affects you, we will notify you and the supervisory authority as GDPR Articles 33 and 34 require. Security researchers can find our disclosure policy at twine.id/security.

Supervisory Authority

If you're in the EU, the EEA, or the UK, you can complain to the data protection authority where you live or work, or where you believe an infringement happened.

Changes to This Notice

We may update this notice. We'll mark material changes by updating the "Last updated" date and, where appropriate, with a notice in the product. The current version is always at this URL.

Contact Us

For privacy questions or to use your rights, contact privacy@twine.id, or write to Build Stuff Fast LLC, Registered Agents Inc, 30 N Gould St Ste R, Sheridan, WY 82801, USA.