Privacy Policy
Effective 1 June 2025 · Last updated 9 October 2026
1. Who We Are
Twopeas AI, Inc. (“TwoPeas”, “we”, “our”, “us”) operates a real-time AI voice companion available at twopeas.ai (the “Service”). We are incorporated in Delaware, USA, with our principal place of business at 131 Continental Dr, Suite 305, Newark, DE 19713, USA.
2. Scope
This Privacy Policy explains how we collect, use, disclose, transfer, store, and secure your information when you access or use the Service, register an account, or otherwise interact with us. If you do not agree with any part of this Policy, please do not use the Service.
3. Information We Collect
| Category | Typical Items | Source | Purpose |
|---|---|---|---|
| Account Data | email, display name, hashed credentials, subscription tier, preferred voice | you | create & authenticate your account |
| Conversation Content | text transcripts you save as memories; real-time audio streams | you | deliver requested conversational features |
| Usage Data | timestamps, feature clicks, coarse geo, device data, error logs | automatic | analytics, performance, fraud prevention |
| Payment Data | Stripe customer ID, subscription status, last 4 of card, billing ZIP | Stripe | billing, refunds, tax |
| Advertising measurement | the ad-click ID (gclid, gbraid or wbraid) and campaign tags in the address you arrive with; Google advertising cookies (such as _gcl_au and _gcl_aw, up to 90 days) and Google’s own cookies on its domains; when you last arrived from one of our ads, kept in your browser and used for 90 days; the page of our site you are on and the page or site you came from; your IP address, browser and device details; that an account was created, by email or with Google; for a subscription, the plan’s list price (0 if it starts with a free trial) and an order reference | automatic (the Google tag) | measure which of our ads lead to sign-ups and subscriptions |
| Cookies & Local Storage | session & CSRF tokens, UI prefs; Google advertising cookies for visitors who came from our ads (see Advertising measurement) | automatic | keep you logged in, UX, ad measurement |
Advertising measurement runs only for visitors who arrive from one of our Google ads, or did in the last 90 days, and only on our public pages, sign-up and sign-in, and the page you return to after checkout. It never runs in the app where you talk with your companion, on our anxiety, emotional support or loneliness pages, or in the EEA, the UK or Switzerland.
We do not collect biometric voiceprints, precise GPS location, or store raw audio recordings.
4. How & Why We Use Your Information
We process personal data only when we have a valid legal basis:
| Purpose | Legal Basis |
|---|---|
| Provide, maintain & personalise the Service | Contractual necessity |
| Process payments & detect fraud | Contractual necessity & legitimate interests |
| Improve performance via aggregate analytics | Legitimate interests |
| Measure our advertising (Google Ads conversion measurement) | Legitimate interests (not used in the EEA, the UK or Switzerland) |
| Send transactional communications | Contractual necessity |
| Send product tips, updates & occasional offers by email (in the EEA, the UK and Switzerland, only if you opt in), each with a way to unsubscribe | Consent in the EEA, the UK and Switzerland; legitimate interests elsewhere; you can opt out at any time |
| Comply with legal obligations | Legal obligation |
5. Sharing & Disclosure
We never sell or rent your data. We disclose only when necessary:
- Cloud & infrastructure providers (Vercel, AWS, Google Cloud – Firebase)
- LLM & speech APIs (OpenAI, xAI, Google Cloud)
- Memory storage (Supermemory) – stores the notes your companion remembers and your conversation transcripts, from which it builds summaries
- Product analytics (PostHog) – usage events, error reports and session replays
- Advertising measurement (Google Ads, Google LLC) – learns that a visit came from one of our ads and whether it led to a sign-up or a subscription. Ad personalization is off; it is not used for remarketing or to build advertising profiles. We never send Google your email, name, conversations or memories.
- Avatar expression API (TypeSafe AI, accessed through Vercel AI Gateway) – chooses your companion’s facial expression from the first few words (at most 12) of each part of the companion’s replies and the last few words (at most 30) of what you said just before it, together with the list of expressions your companion’s avatar can show. The words are sent as text after we remove the names, email addresses, links, handles, phone numbers and other numbers of three or more digits we can detect. Your voice is never sent to TypeSafe. We only send these words to TypeSafe on terms under which they are not used to train AI models; they may be retained under TypeSafe’s terms.
- Payment processor (Stripe)
- Professional advisors under NDA
- Law enforcement when legally required
We do not sell personal information or share it for cross-context behavioral advertising, as those terms are defined in California and other US state privacy laws.
6. International Transfers
We are US-based but serve users worldwide. For EEA/UK transfers we rely on Standard Contractual Clauses, the UK Addendum, or adequacy decisions. Google Ads measurement data is processed by Google LLC in the United States.
7. Data Retention
- Account Data: until deletion or 24 months after subscription lapse
- Conversation Memories: until you delete them or 24 months after account closure
- Analytics: 12 months
- Advertising cookies on our site (such as _gcl_au and _gcl_aw): up to 90 days; Google’s own cookies on its domains, as long as Google’s cookie policy says
- Payment records: 7 years
8. Your Rights
Email mario@twopeas.ai to access, correct, delete, port or restrict processing of your data. We reply within 30 days.
You can unsubscribe from any of our emails by replying “stop”, with its unsubscribe link where it has one, or by emailing us. You can also block or delete advertising cookies in your browser, and manage Google’s ad settings at myadcenter.google.com.
9. Security
We employ TLS 1.3 in transit, AES-256 at rest, MFA-protected admin access, RBAC, vulnerability scanning, and regular penetration testing.
10. Children
The Service is not directed to children under 13 (16 in EEA/UK). If you believe we hold data about a minor, contact us for deletion.
11. Changes to This Policy
We may revise this Policy from time to time. Material changes will be announced by email or in-app banner at least 14 days in advance.
12. Contact
Email: mario@twopeas.ai
Postal: Twopeas AI, Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, USA