Privacy policy

Information we collect

• Your account. You sign in with Apple, Google, Microsoft, a passkey or a code we email you. Apple, Google and Microsoft share your email address and name with TwoKey (Google also shares your profile photo), and TwoKey never sees those passwords. If you choose Apple's Hide My Email, we only get Apple's forwarding address. A passkey stays on your device or in your password manager; TwoKey keeps only its public half, which can't be used to sign in. If you add an authenticator app as a second step, its secret key is kept by our sign-in provider, Supabase, and isn't shown again.
• The waitlist. If you leave your email on the front page while TwoKey is invite only, we keep that email, when you added it and when you confirmed it, nothing else. We email you one link to confirm the address is yours; if nobody taps it, the email is deleted after 7 days. To keep bots out, our server briefly counts tries from each IP address (kept for up to 2 days, never with your email), and sometimes your browser does a quick check that runs on your device and sends nothing about you. Only TwoKey's admins can see the list. We use your email to send your invite, and then take it off the list. It also comes off the list if you join a home some other way, like your partner's invite. To be taken off sooner, email us.
• Your household. Who belongs to it, each person's role (owner, partner or family member) and what each person is allowed to see and change.
• Links to one task or project. When you send a vendor or cleaner a link, we keep the name you gave them, when they opened it, and what they did there: the steps they ticked, their note, the photos they added, when they marked it done, and a quote (price, what it covers, when they could start). They don't sign in, and see only that one task or project, never money or anything else in your home. A project link ends after 14 days; you can turn any link off.
• What you add. Projects, tasks, notes, photos, contacts, quotes, budgets, paint colors, appliances, plants, job listings, places you're considering, how each of you rated a home you toured (your partner sees yours only once you've both finished), a lease on a place you rent (rent, dates, deposit, your landlord's name and email or phone), a shopping list, a list of what you own for insurance (what each thing cost, when you bought it and its serial number), receipts you photograph, loans you add for a debt plan (what's owed, the rate and the monthly payment, plus the rate on a card), and anything else you type, upload or import (for example a CSV from another money app). A note to your landlord is sent from your own email or messages app, never by TwoKey. A receipt is read by you, not by a computer: you type its total and TwoKey looks for the matching charge in your own accounts.
• Your resume or LinkedIn export, if you bring one in. TwoKey reads the file in your browser and never uploads it. It saves only what you keep after checking: skills, past job titles, companies and dates, schools, and your LinkedIn headline. From LinkedIn's export it also saves your contacts' names, companies, job titles, profile links and when you connected, so a job can say who you know there. It never keeps your contacts' email addresses, your messages, your address or your birth date, even though LinkedIn's export includes them. Remove it any time in Jobs, Search and filters, About you.
• Job emails, if you forward them. The sender, subject and date of each job email you forward to your private TwoKey address, and which job it moved. Never the rest of the email.
• Listing alerts, if you forward them. From a Zillow, Redfin or other listing alert you forward to the same address: its sender, subject and date, plus each home's link and the price, size and address the alert lists. TwoKey may open each home's page once to fill in what the alert left out, like a link you paste. Never the rest of the email.
• House emails, if you forward them. The sender, subject and date of each email you forward to your private House address, what TwoKey read from it (the kind of email, an amount, a booked day, an invoice's due date) and what it changed on which project or task, so you can undo it. Everyone who can see House sees these. An invoice's PDF or photo, or the email's words when the invoice came as words, goes on the project like an invoice you add yourself. Never the rest of the email.
• Bank data, if you connect a bank through Plaid. Account names, types, balances and transactions, and for credit cards, statement and due-date details. Your bank username and password go to Plaid and never reach TwoKey.
• Where a charge happened, as your bank reports it. The town, state, ZIP and country, a map spot when the bank sends one, and whether it was paid at a store or online. TwoKey uses it only to spot trips (charges away from home on days close together) and asks you who pays. It is never your phone's location, and a charge on a private card stays private. A trip that work or one of you pays for shows only to that person.
• Bank data, if you connect a bank through SimpleFIN. The same account names, balances and transactions, for banks Plaid can't reach. See the SimpleFIN section below.
• Bank data, if you connect a bank through Teller. The same account names, balances and transactions, for banks Plaid can't reach. Your bank username and password go to Teller and the bank, never TwoKey. See the Teller section below.
• Pinterest data, if you connect Pinterest. See the Pinterest section below.
• Home energy and water use, if you add it. Daily and hourly totals from a usage file you upload, or from the meters in your Home Assistant Energy dashboard if you connect Home Assistant. TwoKey stores the Home Assistant address and an encrypted access token, only reads, and never controls your devices.
• Thermostat and device readings, if you connect Nest or SmartThings. See the Devices section below.
• Your ZIP code, if you turn on garden weather. TwoKey saves the ZIP code, the town it belongs to and that town's rough location (to about a kilometer), and uses it only to get the forecast. If you tap “Use my location” while setting up, your phone or computer's location is rounded to about 100 meters and sent once to Photon, an OpenStreetMap search run by Komoot, to find your ZIP code. Only the ZIP code comes back; the location itself isn't saved.
• Your houses, if you have more than one. Each house's name, icon, how you use it (you live there, rent it out, weekends or family's place) and its time zone, and which house each of you is looking at in House. Everyone in your household sees the names; the rest follows House access. Each house's address is handled like the one below.
• Your home's street address, and what it tells TwoKey, if you add it. Get started and House → Info can save the address; only people in your home can see it, and it appears on a house guide you share only when you make one. While you type, our server sends what you've typed so far to Google Places to suggest matching addresses, never with your name or email, along with a rough area (to about 10 km) so nearby streets come first: your house's spot if TwoKey already has it, else the area your internet connection is in (from our host Vercel), which is never saved. When Google isn't available, your browser asks Photon, an OpenStreetMap search run by Komoot, instead, with the same rough area. When you pick an address, our server sends just that address to the US Census Bureau's free geocoder to check it and write it the way the post office does, and if the suggestions can't find your home once you've added a city or ZIP code, it sends what you typed there too, to suggest the match. Once it's saved, our server looks the address up, never with your name or email: Photon for its spot on the map, FEMA for its flood zone, phzmapi.org (built from the USDA's map) for your ZIP code's growing zone, and RentCast for the home's public record (beds, baths, size, year built, past sales, tax assessments and taxes) and estimates of its value and rent, checked about once a month. TwoKey keeps those answers for your home, along with anything you add yourself, like what's still owed on the mortgage, the mortgage's terms (what you borrowed, the rate, the years and the first payment month, to work out what's owed each month) or when property tax is due. If you link your mortgage company like a bank, its balance updates what's owed, and when that bank login already sends card statements, the mortgage's rate, start and end dates, original amount and whether it has PMI or a prepayment penalty come along too, for the Mortgage plan. What you pick on the Mortgage plan (extra payments, a refinance you tried, how long you'll stay, and for PMI the kind of loan, what PMI costs and what the home cost) is kept for your home so both of you see it, and so is whether you filed your state's homestead exemption and whether the home is where you live. The homestead estimate is worked out inside TwoKey from your state's rules and the county's record; nothing about it is sent anywhere. Where TwoKey doesn't have your state's own page, "Find your county's form" opens a Google search for your county and state's homestead form, only when you tap it. About once a year it also sends only the home's spot on the map (or its ZIP code) to free public sources about the area around it: FEMA for nearby flood zones, flood claims in the ZIP code and weather risk, the USGS for ground height, the USDA for the soil, the National Park Service for historic listings, OpenStreetMap (through Overpass) and the Department of Education for schools, the US Forest Service for tree cover, NREL for a solar estimate and the electric company, and Mapillary for a street-level photo of the home that TwoKey keeps a copy of. TwoKey keeps the answers for your home, plus a radon result or what your water line is made of if you add them, and a photo of the home if you add one, stored privately like your other photos. When you open Walk Score at home, the address and its spot go to Walk Score; the scores aren't saved. Weather still uses only your ZIP code's rough location. Change the address and the old home's facts are cleared.
• Your setup progress. Which areas you said you want TwoKey for, which Get started steps you skipped or answered, and whether you closed the setup card. It fills in from your Google name and photo, which TwoKey already has from your sign-in; it asks Google for nothing more.
• Notes, budgets and planning you add. Notes you leave on a charge, task, project or job, with who wrote them and when; a note shows only to people who can see what it's on, and “Let them know” sends the note to their reminders (just the name while their App lock is on, and never for a charge on a personal card). Monthly budgets by category; a budget for your own spending shows only to you. Each morning's account balances and investment total, for Net worth. An interview kit on your own jobs (when, who, your questions and notes), shown only to you. Links you make between a charge, task, project or job, shown only to people who can see both ends. Plans that point at a savings fund, House projects and a job search. Which weeks you finished your money date, and who marked it. Free trials you add (the name, the day it bills and the price after), so TwoKey can remind you before it bills; a trial you mark as just yours shows only to you. Subscriptions are worked out from your charges each time and not saved separately. Each person's fun money a month; your partner sees only how much of yours is left, worked out on our server from your own charges, never the charges. A charge you make a gift, the day it opens and who made it a gift; until then the other person sees it only as “A gift” with no amount on the list, in TwoKey, its phone app, assistants and the calendar feed. Whether a big buy on shared money was talked about or saved for your money date, and who answered.
• Recall checks for things in your house. About once a week, for each device with a brand, our server asks the U.S. Consumer Product Safety Commission's public recall list (saferproducts.gov) about that brand, sending only the brand name and a date. TwoKey keeps the recalls that match your devices.
• Papers and "If something happens", if you add them. Papers that renew (their name, the day, what they cost and where they're kept), and what you put in the folder (where papers are, who to call, notes). TwoKey never keeps passwords and turns away any line that looks like one. A paper that's just yours is only shown to you. If you add a trusted person, TwoKey keeps their name and a scrambled copy of their link, never the link itself. When they ask, both of you get a reminder, and seven days later the folder opens to them for 30 days unless one of you says no. They see the folder, where your shared papers are, and your accounts by bank and name only: no balances, numbers or passwords, and nothing someone keeps hidden.
• Investments and retirement numbers, if you add them. Each account's name, kind, what's in it, what you add each month, its fee and what it holds, as you type them. An account that's just yours is only shown to you unless you let your partner see it. The year you were born, the age you'd stop working and the growth to assume are only ever shown to you.
• New home alerts, if you set one. The city, the most you'd pay, the beds, and the spots your commute areas go around. Finding new homes uses a paid listings service (RentCast), and it's off until we say otherwise here. When it's on, our server sends RentCast only a spot on the map, a distance and a price, never your names or anything else about you.
• What was in your Amazon orders, if you bring in the file. Amazon's order history is read once to match orders to charges. TwoKey keeps only the matched items (name, how many, what each cost, the order day) and drops the rest of the file. Each item shows to whoever can see its charge, so an order on a private card stays private.
• Task displays, if you set one up. Its name, whether it shows the shopping list, and when it was last on. TwoKey keeps a scrambled copy of its link, never the link itself. The display shows house tasks, who did them and the shopping list, never money, and anyone at it can tick things off. Turning it off stops the link at once.
• Rental data, if you use host tools. See the Rentals section below.
• Reminders, if you turn them on. For each phone or computer you turn them on for: the address its push service gave it, the keys that encrypt messages to it, a label like “iPhone”, and when it last got one. Also what you want to be reminded about, at what time, your time zone, and which reminders were already sent so none repeats. Turning reminders off on a device deletes its entry.
• Apple Wallet passes and iPhone widgets. A guest's Wallet pass is made when a host asks for one, from the same switches as the guest guide PDF, and handed straight back to the host to send; TwoKey keeps no copy. Widgets show text the TwoKey app saves on your iPhone, for you only, as you'd see it in the app. While App lock is on they say “Locked” instead of amounts, and the Lock Screen shows counts, not amounts, unless you turn amounts on. Signing out clears them.
• Places. Addresses and areas you add, such as your home, job locations and neighborhoods you're looking at. TwoKey doesn't track your device's location; it only reads it once, when you tap “Use my location”. Job searches send only the job titles and a town (from Photon, for “Search this area”) to the job listing services JSearch and Adzuna, never your name or email. Find a place sends what you type and the city's center to Photon, and a place you add has its rent, transit and what's nearby looked up from its spot on the map, never with your name or email. A city you search has its outline looked up once by its name on OpenStreetMap's Nominatim, never with your name or email, and kept and shared, since a city's outline says nothing about you. Tapping what's within a walk of a place sends that place's spot (to about 10 meters) to Photon for the names of what's there; answers are kept for a day and shared, since they say nothing about you. Opening a job sends only the company's name to Wikipedia and Wikidata (what it does and a few facts), GDELT and Google News (recent headlines) and, for companies that trade publicly, the SEC (when it went public). What comes back is public, kept for a day and shared, since it says nothing about you. How much each part of a job, home or place score matters to you is saved with your job settings.
• Payment details, if you buy a paid plan (not offered yet). Payments will be handled by Stripe. TwoKey will see your plan, billing email and the last four digits of your card, never the full card number.
• Technical data. Cookies that keep you signed in and remember settings like the theme, font, accessibility choices and app lock (with day and night themes on, also your house's time zone and its spot rounded to about a kilometer, so the theme can switch at its sunset), and standard server logs (time, page, IP address, browser) kept by our hosting provider for security. TwoKey uses no advertising or analytics trackers. Your recent searches stay in your own browser on that device, kept apart for each person, and are never sent to TwoKey; Clear in any search deletes them.

Bank connections (Plaid)

TwoKey uses Plaid to connect to banks. When you connect a bank, you sign in on Plaid's screen and agree to Plaid sharing your account data with TwoKey. Plaid's handling of your data is covered by the Plaid End User Privacy Policy.

• TwoKey only reads account data. It can't move money, pay bills or open accounts.
• The person who connects a bank decides how much of each account the rest of the household sees: everything, the balance only, or nothing.
• Bank data is never sold, never used for advertising and never used to market other financial products to you.

Bank connections (SimpleFIN)

Connecting a bank through SimpleFIN Bridge is optional, for banks Plaid can't reach. You sign up with SimpleFIN, pay SimpleFIN directly and sign in to your bank on SimpleFIN's site, then paste a one-time Setup Token into TwoKey. SimpleFIN's handling of your data is covered by its own privacy policy at simplefin.org.

• TwoKey stores the access address SimpleFIN gives back, encrypted the same way as Plaid's, and uses it only to read accounts and transactions.
• It's read only: TwoKey can't move money through it. The same privacy choices apply as for a Plaid bank.
• Disconnecting it in Settings deletes the access address and the bank's data from TwoKey. You can also remove TwoKey in your SimpleFIN account at any time.

Bank connections (Teller)

For some banks Plaid can't reach yet, TwoKey offers Teller, which signs in to your bank on its own screen. Teller's handling of your data is covered by its own privacy policy at teller.io.

• TwoKey stores the access token Teller gives back, encrypted the same way as Plaid's, and uses it only to read accounts, balances and transactions.
• It's read only: TwoKey can't move money through it. The same privacy choices apply as for a Plaid bank.
• Disconnecting it in Settings ends TwoKey's access at Teller and deletes the token and the bank's data from TwoKey.

Pinterest

Connecting Pinterest is optional. If you connect it in Settings › Pinterest:

• You approve access on Pinterest's own page. TwoKey asks only for read access: your username, your boards and their sections (including secret boards), and your pins. TwoKey never creates, edits or deletes anything in your Pinterest account.
• TwoKey shows you a list of your boards. Only the boards or sections you choose to link to a home project are saved, with each pin's title, description, picture link and the web page it was saved from.
• Those pins show on that project to you and the other people in your household who can see House. If someone in your household connects an app like Muse (see Sharing), it can read them. Pins are refreshed from Pinterest about twice a day while the board stays linked.
• Pinterest data is used only for these features. It is never sold, never used for advertising, never shared with anyone outside your household and the service providers below, and never used to train AI models.
• Unlinking a board deletes its saved pins. Disconnecting Pinterest deletes your Pinterest access tokens from TwoKey right away. You can also remove TwoKey's access at any time in your Pinterest account settings.

Devices, weather and calendar links

• Nest and SmartThings are optional and read only. You approve access on Google's or Samsung's own page and pick the devices. TwoKey reads each device's name, room, and current state (temperature, humidity, thermostat mode and setting, whether a lock is locked, a door is open or a sensor is wet, power use and battery), at most every five minutes while someone has House open. Only the latest reading is kept, not a history. TwoKey can't lock, unlock, switch or change anything, and doesn't read cameras or doorbells. Access tokens are encrypted like bank tokens. Anyone in your household who can see House sees these readings.
• Garden weather comes from Open-Meteo. TwoKey's server sends it only the rough location of your ZIP code, never who you are. When it rains enough, TwoKey marks outdoor watering tasks as done by the rain.
• Weather on your House card (rain, snow, fog and the like, right now and the next few hours) comes from Open-Meteo too. It gets the same rough location, about a kilometer around your home, never your address or who you are.
• Sprinklers: the zones you add, how your timer is set and days you mark stay in TwoKey. To suggest a schedule, TwoKey uses the same rough-location weather, including last year's, from Open-Meteo. Nothing goes to your sprinkler's maker.
• Your calendar link is made only when you ask for one in Settings › Calendar. It shows the tasks, contractor visits, bill due dates and plans you choose, in any calendar app you add it to. Amounts are left out unless you turn them on, and it only ever shows what you can see in TwoKey. Anyone with the link can read it, so you can make a new one or turn it off at any time, which stops the old link working.

Rentals (host tools)

If your household is on the Keys plan and you add homes you rent out:

• Calendar links you paste from Airbnb, VRBO or other sites are stored encrypted. TwoKey reads them about once an hour and keeps each stay's dates, the site, the confirmation code and the guest's first name as the site shows it. TwoKey doesn't get guests' contact details.
• Your TwoKey calendar link for each home shares only the dates that are taken, never names or codes. Anyone with the link can see those dates, so you can make a new one at any time.
• Payouts files you import (for example Airbnb's earnings export) are kept as payout amounts, fees, taxes, dates, listing names, confirmation codes and guests' first names. The file itself isn't stored.
• Receipts and cleaning photos are stored privately like your other photos.
• Invoices you add to a project or task are stored privately like your photos, with who sent each one, the amount, its dates and number, and the card or bank charge that paid it. A PDF or a photo is read on your own phone or computer to fill those in (photos by Tesseract, which TwoKey serves itself); nothing is sent anywhere to be read. TwoKey links a charge only if the person looking can see that charge.
• Home inspection reports you add on House are stored privately like your invoices: the PDF or photos of its pages, the inspection date and company, and what TwoKey found in it (each item's name, where in the house, how serious, the inspector's words, the page and a cost guess). The words are pulled out on your own phone or computer and sent from our server to Anthropic to be read, with pictures of any pages that are only photos or scans. Nothing becomes a project until you pick it. Anyone who can see House can open the report.
• Mortgage statements you add in Settings, Banks: the words are pulled out of the PDF on your own phone or computer and sent from our server to Anthropic to be read. TwoKey keeps only what you check and save: what's owed, the rate, the payment and its escrow part, the monthly mortgage insurance (PMI) when it's listed, and the last month. The PDF never leaves your device, and your loan number isn't kept.
• Your wifi name and password can be filled in by scanning the router's wifi code with your camera, or from a photo of its sticker. The camera picture and the photo are read on your own phone or computer and never saved or sent; only the name and password you save are stored, the password encrypted like your door code.
• Cleaners and co-hosts you invite sign in the same ways. You see the name you gave them and the email they sign in with, and what they tick and write on your cleanings. They see only the homes you pick, their cleanings, and (co-hosts) the stays at those homes with first names and dates. They never see your money or the rest of your household. How to get in (a lockbox or door code) is stored encrypted and shown to a cleaner only from the day before their cleaning to the day after, and each time it's shown is logged. A cleaner or co-host can leave a crew at any time, and stops seeing it if you remove them or your plan no longer includes host tools.

Neighbor numbers on area pages

Every ZIP code has a free area page built from public government data. Once 10 or more homes in a ZIP code are on TwoKey, it also shows what's typical for them:

• What's counted. For each home with “Count my home in its ZIP's numbers” on (the switch is in the address sheet and the Your home sheet, and starts on): its ZIP code, its year built, what upkeep cost over the last year from costs logged on its tasks, and, for a household with one home it lives in, a typical month of power and water bills from Utilities. These are kept apart from everything else, only our server can read them, and nobody, your household included, can read another home's.
• What's shown. Only each number's middle and middle half across 10 or more homes, rounded (bills to $10, upkeep to $100), worked out once a month, and how many homes are counted toward 10. Never an address, a single home's number, or anything about you. Neighbor numbers aren't in the free download.
• Switching it off deletes your home's numbers right away, and your home leaves its ZIP's mix at the next monthly update. Deleting the home or your account does the same.

Listing a home (TwoKey Open Listings)

If you list a home for sale or rent, or set a would-sell price:

• What's public depends on who you pick. “TwoKey buyers” shows it to people signed in to TwoKey; “Everyone” puts it on the open web and in the open data under the Open Database License, where anyone can copy it. It shows the price, the address (never the street for a would-sell price, and its map spot rounded to about a kilometer), beds, baths, size, your description, and the house's file: when the roof, heat and water heater went in, how many upkeep jobs you logged, fair value and flood risk. On a sale or rental it also shows the rooms, finished projects (name and year), appliances (name, brand and year) and yard you leave in; tap any to leave it out. What each project cost shows only if you turn it on. A typical month of utility bills from your bank shows only if you turn it on. Photos show on the listing page, not in the open data. Your name, email and anything else from Money never show.
• Checking you own it. Each check runs only when you tap it, and any one is enough. Your bank: TwoKey asks your linked banks (only ones you can see) for your mortgage's property address and compares it with the home's; the address isn't kept, only whether it matched. The county record: TwoKey compares the owner names on it (from RentCast) with your household's names, or with the name you type as it's on the deed. Owner names are used only for that check and never shown; a name you type is kept only if it matched. Or you can send a photo of a tax bill or deed: it's stored privately, a TwoKey admin compares it with the address and your household's names, and it's deleted as soon as they answer. Only whether a check passed is kept. Changing the home's street clears every check.
• Asks. When someone asks about your listing, TwoKey keeps their name, email, message and when they'd like to visit, for you to answer. Anyone who can see House in your household sees them. Their email shows to you only if you say yes; your contact is never shown to them. Asks are deleted with the listing.
• Taking a listing down deletes it, its photos and its asks. Copies of open data made while it was public may remain elsewhere.

AI in TwoKey

TwoKey uses AI for a few helpers, and only when TwoKey's own tools can't do the job. TwoKey trains no AI model, and the AI company we use, Anthropic (maker of Claude), doesn't train on what we send it under its business terms (how Anthropic explains it). Everything goes from our server, never with your sign-in, email or money data.

• Upkeep cost guesses. When you open the upkeep sheet and a repeating task isn't in TwoKey's own cost table, Claude gets the task's name, how often it repeats and the appliance's name. Each answer is saved, so it's asked only once.
• Home inspection reports. When you add one, Claude gets the report's words and pictures of pages that are only photos or scans. These can include the address and names printed on the report.
• Mortgage statements. When you add one, Claude gets the statement's words, which include your name, address, loan number and balances as printed on it. TwoKey keeps only the numbers you save.
• Write it for me on a listing. Only when you tap it, Claude gets the facts you left in: beds, baths, size, year built, the city, room names, finished projects, appliances and the yard (project costs only if you show them), never the street.
• Write a how-to on a task. Only when you tap it, Claude gets the task's name, how often it repeats, where in the house it is, and its appliance's name, brand and model. TwoKey adds the video search link itself.
• Write its care on a plant TwoKey's plant guide doesn't know. Only when you tap it, Claude gets the plant's name and species.

These are all built in: there's nothing to set up and nothing to connect.

Apps you connect are separate and optional. Nothing in TwoKey needs them. Someone in your household can add TwoKey from inside an assistant app like Muse or Dots; TwoKey doesn't pay for it or pick it. That app can read what its person can see and add projects and tasks, nothing else (see Sharing). Its own privacy policy covers what it does with what it reads, so check whether its company trains on your chats.

How we use information

• To run TwoKey for you and your household: show balances and bills, work out what to pay from each account, track home projects, tasks and jobs, and show your linked Pinterest boards.
• To keep accounts secure, prevent abuse, enforce fair-use limits and fix problems.
• To contact you about your account, your plan or changes to TwoKey.
• To meet legal obligations.

We don't sell personal information, we don't “share” it for targeted advertising, we don't show ads, and your data and your household's data never train an AI model, ours or the AI company we use (see AI in TwoKey). We may count things in aggregate (for example, how many households use bank sync) to plan costs, without looking at anyone's content.

Who can see it

• Your household. Other members see shared data, limited by the access the owner gives them (Money, House and Jobs can each be edit, view or off; a partner has to agree to less, or gets 7 days' notice) and by each bank account's privacy setting. A family member sees only House tasks and projects. A vendor, cleaner or guest with a link sees only the one task, project or page it opens.
• Your resume details and LinkedIn contacts. Your partner sees your skills and past jobs unless you turn sharing off. Everyone in the household sees what you're good at around the house (for example "Electrical"), so a task can suggest you. Your LinkedIn contacts are only yours: others in your household see only that you know someone at a company, never who.
• Live Google Sheets are optional. You connect Google Sheets on Google's own page, separately from signing in, and allow only one thing: see and change the files TwoKey makes. TwoKey can't see anything else in your Google Drive. A live sheet holds a list as you see it in TwoKey (never an account your partner keeps private) and lives in your own Drive, where you decide who it's shared with. TwoKey syncs it as you, only while you have TwoKey open or tap Sync now: it reads the columns marked ✎ and puts your changes into TwoKey, then writes its own tabs again. TwoKey keeps the Google access token (encrypted like bank tokens), which list each sheet shows, what its ✎ columns held at the last sync, and the changes it took for 30 days so you can undo them. Disconnecting in Settings, or leaving your household, deletes all of that; the files stay in your Drive.
• Service providers that run TwoKey for us, only as needed to provide it, and bound to protect it:
  • Supabase (database and file storage) and Vercel (hosting), both in the United States.
  • Google (sign-in, travel times between places you add, and address suggestions while you type your home address).
  • Apple and Microsoft, when you sign in with them.
  • Resend (in the United States), which delivers sign-in codes and the waitlist's confirm email. It gets your email address and the code or link, nothing else.
  • Plaid, Teller and SimpleFIN (bank connections) and Pinterest (board connections), when you use them.
  • Google Nest and Samsung SmartThings, when you connect your devices. They see that TwoKey reads them.
  • Google Sheets, when you make a live sheet. Google holds the sheet in your Drive under its own terms.
  • RentCast (in the United States), FEMA and phzmapi.org, when you add your home's address or ZIP code. They get only the address or ZIP code, sent from our server, never your name, email or money data.
  • The USGS, OpenFEMA, the USDA, the National Park Service, the Department of Education (NCES), the US Forest Service, NREL, Overpass (OpenStreetMap) and Mapillary (street photos, run by Meta), for facts about the area around your home. They get only the home's spot on the map or its ZIP code, sent from our server.
  • Freddie Mac (with FRED, the St. Louis Fed, as a backup), for this week's average mortgage rates on the Mortgage plan. Our server downloads their public rate file; nothing about you or your home is sent.
  • Open-Meteo (weather, in Switzerland), for garden weather and the weather on your House card. It gets only a rough location, sent from our server.
  • Pl@ntNet (plant identification, in France), when you snap a plant to find out what it is. It gets only that photo, never your name, email or anything else, and doesn't keep the photo.
  • Anthropic (Claude, in the United States), when your house has a repeating task TwoKey's own cost table can't price, when you add a home inspection report or a mortgage statement, and when you tap Write it for me on a listing. For a task it gets only the task's name, how often it repeats and the appliance's name. For a listing it gets only what you left in: beds, baths, size, year built, the city, room names, finished projects, appliances and the yard (project costs only if you show them), never the street. For a report it gets the report's words and pictures of pages that are only photos, which can include the address and names printed on it. For a mortgage statement it gets the statement's words, which include your name, address, loan number and balances. All of it is sent from our server, never with your sign-in or email, and nothing from your linked banks goes with it, and doesn't train on it.
  • GBIF (the open species list, in Denmark), when you type a plant name TwoKey's own plant guide doesn't have. It gets only the words you typed, sent from our server, never who typed them.
  • Push services, when you turn on reminders: Apple (iPhone, iPad and Mac Safari), Google (Chrome and Android), Mozilla (Firefox) or Microsoft (Edge), whichever your device uses. They carry each reminder to your device encrypted, so they can't read it. In the phone app, reminders go through Expo (in the United States) and then Apple or Google; they carry the reminder's words but never your name or email.
  • Stripe (payments), once paid plans exist.
  • Job and place services (job boards, OpenStreetMap-based search and map tiles, Wikipedia for example photos, Walk Score for walk, transit and bike scores, and Wikipedia, Wikidata, GDELT, Google News and SEC filings for company facts and news). These get only search words, place names, addresses or a spot on the map, sent from our server, never your name, email or money data. Rents come from Zillow's public research files, which our server downloads without sending anything about you. Like any website, the map, photo and Walk Score logo services see your IP address when your browser loads their images.
  • Resend also handles Job emails and House emails, only if you set them up. It receives the emails you choose to forward to your private TwoKey address and hands them to our server, which reads each one to move your job to Applied, Interview, Offer or Closed. We keep only each email's sender, subject and date, never the email itself, and for emails that aren't about an application only who sent them. House emails are read the same way to move your projects along (see above). TwoKey never signs in to your Gmail or LinkedIn.
• Your rental crew. Cleaners and co-hosts you invite see only what's described under Rentals above.
• Apps you connect. A household member can add TwoKey from inside an assistant app like Muse or Dots, and says yes on a TwoKey screen first. The app can read what that person can see (never more) and add projects and tasks. It can't change or delete anything, reach banks, move money or contact anyone. Its pass lasts an hour at a time, and Disconnect in Settings › Connected apps ends it at once. What the app does with what it reads is covered by that app's own privacy policy.
• Links you share. If you share a PDF or a guest link with someone outside TwoKey (a contractor or a house guest, say), they see only what that link shows. Links expire and can be turned off.
• The law and safety. If the law requires it (for example a valid court order), to protect someone's safety, or to investigate fraud or a security problem. We push back on requests that are too broad.
• If TwoKey changes hands. If TwoKey is sold or merged, your information can move to the new operator, which must keep this policy's promises or tell you first.

Financial privacy notice

Because TwoKey handles bank data, US financial privacy law (the Gramm-Leach-Bliley Act) applies. TwoKey has no affiliates and doesn't share nonpublic personal information with companies outside TwoKey, except service providers that help run it, when you ask us to, and as the law allows or requires (for example to prevent fraud or answer a subpoena). Because we don't share it in other ways, there's nothing you need to opt out of.

How it's protected

All traffic uses HTTPS. The database is encrypted at rest, and Plaid, Pinterest, Nest and SmartThings access tokens are encrypted again with AES-256-GCM before they're stored. Database rules return data only to members of the household it belongs to, and access tokens can only be read by TwoKey's server, never by anyone signed in. Every account behind TwoKey's hosting uses two-factor sign-in. Connecting a bank always asks for Face ID, a passkey or an authenticator code first. An optional app lock asks for Face ID or a passcode. TwoKey follows a written security program based on the FTC Safeguards Rule.

If a breach exposes your information, we'll tell you promptly and as the law requires, and report it to the FTC when the rule says to.

Keeping and deleting data

• Data is kept while your account is active.
• A waitlist email is deleted when your invite is sent, when you join a home, or when you ask. One that's never confirmed is deleted 7 days after we email the link.
• Projects, tasks, plants, House info and trips you remove wait in Settings → Recently removed for 30 days so either of you can put them back, then they're deleted for good, photos included. Delete all now there skips the wait.
• Disconnecting a bank revokes TwoKey's access at Plaid and deletes that bank's accounts and transactions.
• Disconnecting Pinterest deletes your Pinterest tokens. Unlinking a board deletes its saved pins.
• Disconnecting Nest or SmartThings deletes its tokens and saved readings. So does leaving the household, for the devices you connected, along with your calendar link.
• Removing a calendar from a rental home deletes its saved stays. Deleting your account also takes you off any host's cleaning crew. If you only use TwoKey as someone's cleaner or co-host and want your sign-in deleted too, email us.
• Deleting your account removes your profile and settings, revokes any banks you connected and deletes their data. Things you added to a shared household, like tasks and projects, stay with that household. When the last member leaves, the whole household is deleted, photos included.
• We don't keep information we no longer need: a household no one has signed in to for two years is deleted after we email a warning.
• Deleted data drops out of our database provider's backups within 30 days.

Your choices and rights

Wherever you live, you can:

• See and download what TwoKey holds about you, in a format you can take to another app: Excel, CSV, a file you open in Google Sheets, or a live Google Sheet. An export only holds what you can see in TwoKey (never an account your partner keeps private), TwoKey makes it only when you ask, and doesn't send it anywhere itself. Once it's on your device, the app you open it in looks after it under its own terms.
• Correct it, most of it right in the app.
• Delete it, including your whole account.
• Appeal if we turn a request down, by replying to our answer. If we still say no, you can contact your state attorney general.

Email support@twokeyapp.com from the address you sign in with, or have someone you authorize do it for you. We answer within 30 days and never treat you differently for asking. We don't sell or share data for advertising, so there's no opt-out to offer, and we treat a Global Privacy Control signal as a request not to anyway.

Children

TwoKey is for adults. It is not meant for anyone under 18, and we don't knowingly collect information from children.

Where TwoKey works

TwoKey is offered in the United States, and its data is stored in the United States.

Changes

If this policy changes, the date at the top changes too. For a change that matters, like a new kind of data or a new kind of company we share with, we tell members by email or in the app at least 30 days before it applies. We never use data already collected in a new way without asking.

Contact

Questions or requests: Bryce Schuebert, support@twokeyapp.com.