Privacy policy
What Twinpad stores, for how long, and what it never sees. No accounts, no tracking cookies, no ads.
Twinpad is built so that there is as little to protect as possible: no accounts, no profiles, no tracking, and content that the server can't read and doesn't keep. This page lists everything that is stored, why, and for how long.
Who runs Twinpad
Twinpad is operated by Energit DOO, which is responsible for the processing described on this page. For any question about privacy or your data, write to office@energit.me.
Content you add to a session
Text, secrets, files, file names and device names are encrypted in your browser before they are sent (how the encryption works). The server stores this encrypted data in memory, and file chunks in a temporary folder, only while the session exists. When the session expires or someone clicks Destroy session, all of it is deleted. Restarting the server also deletes everything. We cannot read, recover or hand over this content, because we never have the key.
Technical data needed to run the service
- IP addresses are held in memory for rate limiting and blocking password guessing: failed join attempts for 15 minutes, request counters for up to one hour. They are not written to disk and not linked to any session content.
- Session metadata such as when a room was created, its expiry time, how many devices joined, and the size of encrypted files is kept in memory while the session exists, because the service needs it to work.
- Server logs record errors and events like "room destroyed" with no IP addresses, room codes or content. We don't keep HTTP access logs.
Usage statistics
We count aggregate totals per day: how many sessions were created, how many devices joined, how many files and secrets were sent, homepage views, and security events like failed password attempts. These are plain counters. They contain no IP addresses, room codes, device names, cookies or identifiers, and can't be linked to a person or a session.
Cookies and local storage
Twinpad sets no cookies and uses no analytics, advertising or third-party scripts. Your browser keeps a few things locally, on your device only:
- Session storage (cleared when you close the tab): the ticket that keeps you connected to a session.
- Local storage: your theme (dark/light), editor preferences, and the device name you chose. It is sent to the server only in encrypted form when you join a session.
Hosting
Twinpad runs on a server in Frankfurt, Germany (Amazon Web Services, eu-central-1). Traffic is encrypted with HTTPS using certificates from Let's Encrypt.
Your rights
Because we don't have accounts and don't store personal data beyond the short-lived technical data above, there is usually nothing to access, correct or delete. Destroying a session removes its content immediately, and everything else expires on its own within an hour.
Changes
If this policy changes, we'll update this page and the date below. Questions: office@energit.me.
Last updated