Privacy & Security
What we hold, and what we deliberately don't.
Twik sits between you and everything you write. That only works if the boundaries are clear.
What we don't collect
- Passwords - authentication is handled by Firebase, Google and Apple
- Card details - payments are processed by Google Play, Apple or Razorpay
- Text you type that you did not submit for AI processing
- Browsing history or location data
- Contacts, photos or other device data
What we do process
We process the text you explicitly submit for AI assistance - on Android by tapping the correction button, on iOS through the keyboard extension. We do not collect the rest of what you type.
Alongside that: your email and name from Google or Apple Sign-In, subscription status, request counts used to enforce plan limits, and standard device and crash information.
The complete list is in the Privacy Policy.
Security
How it is protected.
Encrypted in transit
All data between the app and our servers uses HTTPS/TLS.
No plaintext storage
Sensitive data is never stored in plaintext.
Tokens stay on device
Authentication tokens are held in the Android Keystore and iOS Keychain.
Row-level access control
Database access is restricted with row-level security policies.
OAuth 2.0 sign-in
Firebase Authentication with Google and Apple Sign-In. We never see a password.
No advertising trade
We do not sell personal information or share it with advertisers.
Retention
How long we keep it.
- Account data
- Kept while your account is active; deleted within 30 days of account deletion.
- Text submissions
- Processed in real time, cached up to 24 hours for performance, not permanently stored.
- Usage data
- Kept up to 1 year for analytics and optimisation.
- Subscription records
- Kept as long as tax and accounting rules require - typically up to 7 years.
Sub-processors
Who else touches the data.
- Firebase (Google LLC)
- Authentication and secure token management
- Supabase
- Backend processing and storage of submitted text
- RevenueCat
- Subscription management and verification
- Google Play / Apple
- In-app purchase processing
- Razorpay
- Desktop plan payment processing
Your rights
Deleting your account removes your data.
Deleting your account removes your profile and usage statistics, your Firebase authentication account, your RevenueCat customer record and any cached AI processing data. To request deletion or ask what we hold on you, write to contact.twikapp@gmail.com.