Privacy Policy

twolk (“we”, “us”, or “our”) operates a walking companion platform that connects users for voice-guided walking conversations. We are committed to protecting your privacy and being transparent about how we handle your personal data.

This Privacy Policy explains what information we collect, why we collect it, how we use it, and the rights you have over your data. By using twolk, you consent to the practices described in this policy.

Profile information. When you create a walking profile, you may provide your display name, age, gender, languages spoken, general and specific interests, bio, location (city/country), timezone, and a profile photo or AI-generated avatar. This information is visible to other users on the platform.

Private verification data. To support identity verification, you may voluntarily provide your phone number, country of residence, government-issued ID type, ID number, and a photo of your ID document. This data is stored separately from your public profile and is never shown to other users.

Booking information. When you book or host a walk, we record the booking details including the partner's profile, scheduled date and time, conversation topic, and booking status.

Account information. Your email address and password (stored as a hash) are used for authentication. We may also store your role (user or admin) and account preferences.

Payment information. Subscription payments are processed by Stripe. We do not store your card number or full payment details — Stripe handles that securely. We receive a confirmation of your subscription status and plan.

Voice call data. Voice calls are delivered through LiveKit. We generate a unique room for each booking and issue short-lived access tokens. We do not record or store the audio content of your conversations.

Usage data. We may collect anonymized analytics about how you interact with the app to improve the experience.

We use your data to:

• Create and manage your account and walking profile.
• Match you with walking partners based on language, interests, and availability.
• Facilitate booking scheduling and voice call connections.
• Verify user identities to promote a safer community.
• Process subscription payments and manage your plan.
• Send you booking confirmations, reminders, and cancellation notifications.
• Allow ratings and reviews between walking partners.
• Investigate reports of misconduct and enforce community standards.
• Maintain and improve the platform's features and security.

Under the EU General Data Protection Regulation (GDPR), we process your personal data on the following legal bases:

• Consent — for the information you voluntarily provide when creating your profile or submitting identity verification documents.
• Contract performance — for processing bookings, payments, and voice calls that are necessary to provide the service you requested.
• Legitimate interests — for fraud prevention, community safety, and platform improvement.
• Legal obligation — where we are required to retain data by law.

Identity documents and certain personal characteristics may constitute special category data under Article 9 of the GDPR. We process this data only with your explicit consent, solely for identity verification and community safety purposes.

We do not sell your personal data. We share information only with the following service providers, each under appropriate data protection agreements:

• LiveKit — delivers the real-time voice call infrastructure. LiveKit receives your email (as a participant identifier) and processes audio streams during active calls.
• Stripe — processes subscription payments. Stripe receives your payment details directly; we receive only a confirmation of the transaction and your subscription status.
• Cloud infrastructure providers — host our database and application servers.

Your public profile information (display name, photo, bio, interests, languages, and availability) is visible to other registered users. Your private verification data, email, and booking details are never shared with other users.

We retain your personal data only as long as necessary for the purposes described in this policy:

• Profile data is kept while your account is active and deleted when you close your account.
• Identity verification documents are retained for the duration of your account plus a limited period for dispute resolution, then permanently deleted.
• Booking records are retained to support ratings, dispute resolution, and usage history.
• Payment records are retained as required by tax and financial regulations.

You can request permanent deletion of your account and associated data at any time (see Section 7).

Under the GDPR and other applicable data protection laws, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — request that we delete your personal data and account.
• Restriction — ask us to limit processing in certain circumstances.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — withdraw consent for processing that relies on it, at any time.

To exercise any of these rights, contact us at privacy@twolk.app. We will respond within 30 days.

We take reasonable technical and organizational measures to protect your personal data, including encryption in transit, access controls, and row-level security that isolates private data from other users. Identity documents are stored separately from public profiles and accessible only to you and authorized administrators.

However, no method of transmission or electronic storage is completely secure. While we strive to protect your data, we cannot guarantee absolute security.

Your data may be processed by our service providers in countries outside the European Economic Area. We ensure such transfers are protected by appropriate safeguards, such as Standard Contractual Clauses, or rely on an adequacy decision by the European Commission.

twolk is not intended for children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a minor has provided us with personal data, please contact us and we will promptly delete it.

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. For significant changes, we will provide a more prominent notice. We encourage you to review this page periodically.

If you have any questions about this Privacy Policy or how we handle your data, please contact us at:

Email: privacy@twolk.app