Privacy Policy

Twinbat is owned and operated by Nofeez Proptech Private Limited (“we”), which publishes the Twinbat mobile application and this website. For the purposes of the EU and UK GDPR we are the data controller for the personal data described here. Under India’s Digital Personal Data Protection Act 2023 we act as a Data Fiduciary, and under the UAE Personal Data Protection Law as a Controller.

Contact us at privacy@twinbat.com for anything in this policy, including to exercise the rights in section 9.

This policy applies to twinbat.com, the Twinbat mobile apps, support, moderation, marketing and related services.

It does not govern another member’s independent conduct, or external services that have their own policies. What somebody does with what you tell them is not something a privacy policy can control.

Two categories get stricter handling because they are special category data under GDPR Article 9 and equivalent provisions elsewhere.

If an entry suggests you may be at risk, the app shows crisis support resources. That is a display decision made on your device from the model’s output — we do not report it to anyone, and it does not restrict your account.

We do not carry out automated decision-making that produces legal or similarly significant effects on you. Match scores and AI readings are suggestions; they do not restrict your access to anything.

Readings, comparisons and suggestions are generated by large language models hosted on Microsoft Azure within our own tenancy. Two things follow from how that is built:

The model never calculates your chart. Positions are computed by an ephemeris on our servers and passed to the model as data, so the astrology does not depend on the model being right about astronomy.

Your prompts and the resulting outputs are not used to train the underlying models. We send the minimum needed: a compact chart summary and the specific question or entry. We log the output, the model used and the token cost so we can audit quality and spend.

AI content is for self-reflection and entertainment. It is not medical, legal, financial or emergency advice, and you should not rely on it as such.

Twinbat uses automated systems to rank eligible profiles and produce compatibility indicators. Eligibility rules run first and remove blocked, ineligible or excluded profiles. Ranking then considers your selected connection intent, your preferences, profile alignment, permitted behavioural signals, distance settings and — where you have enabled them — birth-based factors.

Paid features can change which filters you can use, how much depth an insight has, or how many times you can do something. They never bypass a safety rule or a consent setting.

These outputs exist to help you discover and reflect. They do not make legal or similarly significant decisions about employment, credit, housing, insurance, education or access to essential services, and they are not used for any such purpose.

You can inspect the main factors behind a score, correct the inputs, turn optional behavioural learning off, clear AI memory and reset your recommendations. To challenge or ask about automated processing, write to privacy@twinbat.com.

Visible to eligible members according to your settings: your display profile, the interests you select, your chosen intent, your posts, your Circle activity and high-level compatibility indicators.

Not public by default: exact birth time, exact birth place, private answers, raw behavioural signals, your blocked list, precise live location, identity documents and payment information.

Messages and restricted Circle content go to the people they are addressed to — and those people can copy or repeat what they receive. Blocking stops future access through the blocked account. It cannot erase copies already made outside Twinbat, and no setting can.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We share only with processors acting on our instructions:

Other users see only what your privacy settings allow. Match reasons are deliberately worded to avoid disclosing values — another user is told you were “born within the hour”, never your actual birth time.

If we are ever involved in a merger or acquisition, we will give notice before your data becomes subject to a different privacy policy.

We operate globally, so your data may be processed outside your country. Where we transfer personal data out of the EEA, the UK or Switzerland we rely on the European Commission’s Standard Contractual Clauses together with the UK Addendum, and we assess the destination country’s laws before transferring. For transfers from India and the UAE we rely on the mechanisms permitted under the DPDP Act and the PDPL respectively. You can request a copy of the safeguards we use.

Wherever you live, you can ask us to do the following, and we will respond within 30 days:

We will not discriminate against you for exercising any of these rights.

Delete your account from Settings › Account › Delete Account, or from the deletion page on the web if you cannot get into the app.

Your profile leaves discovery immediately. You can cancel the request by signing in within 7 days. After that, deletion from active systems completes within 30 days and from routine backups within 90 days — apart from records we must keep for payment, tax, fraud prevention, security, legal claims or safety.

Deleting your account does not cancel a subscription billed by Apple or Google. Cancel through that store to stop future charges. See the Refund and Cancellation Policy.

We use necessary technologies for sign-in, security, preferences and checkout. With your consent where it is required, we may use analytics technologies. The detail, and the controls, are in the Cookie Policy.

Mobile identifiers and the SDKs we use are described in the in-app consent screens and in our store disclosures.

Data is encrypted in transit and at rest. Access is limited to staff who need it and is logged. Sign-in uses one-time codes rather than stored passwords, and session tokens are stored only as hashes so a database leak cannot be replayed as a login.

No system is perfectly secure. If a breach affects your rights we will notify you and the relevant authority within the timeframes the law requires — 72 hours under GDPR.

Twinbat is for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has an account, contact us and we will remove it.

If we make a material change we will tell you in the app or by email before it takes effect, and where the change requires consent we will ask again rather than assume your previous choice still covers it.