Privacy is the product, not the tax.

Local-first architecture

The core of each product runs on your device. For TwinMail that means message bodies, subjects, addresses, thread structure, and search indexes stay local. For TwinContacts, the import → dedupe → digest loop runs on-device. For TwinVault, your credentials never leave your device in readable form. Cloud features are the exception, not the default — and every one is disclosed.

Explicit consent, recorded as events

Every notification channel and every off-device action is opt-in. Consent decisions are written to an immutable, timestamped log with the source of the decision and request context, retained for compliance. You can review and revoke at any time. The same model powers our SMS program — see Messaging & SMS.

Encryption & key handling

Local data boundaries (“vaults”) are encrypted with modern authenticated encryption — XChaCha20-Poly1305 for content, Argon2id-derived keys, Ed25519 signatures for audit events, and X25519 key envelopes, with epoch-based rotation. Lost keys cannot be recovered by Twindevs, by design.

AI & third-party data-flow

Intelligence features run locally by default. When an action requires an off-device provider (for example, summarizing a long thread), a consent sheet shows the exact content to be sent before anything leaves your device, and the request and response are written to the audit log. Drafts are pre-fill only — nothing is ever auto-sent.

Sub-processors

No data brokering

We do not sell, rent, or share your contacts, phone number, or messaging consent with third parties or affiliates for marketing. You can export your data at any time, in open formats, with no lock-in.

Responsible disclosure

Found a security issue? Email dylan@twindevs.ai. See also our Privacy Policy and Terms of Service.