TwoKey+ Privacy Policy

TwoKey+ has no accounts, no servers that can read your messages, and no analytics of any kind. We do not know who you are, who your clients are, or when you talk to them.

TwoKey+ can keep a record of a conversation, if you turn recording on for it. That record is kept on your phone only, encrypted, and is never sent to us; we could not read it if it were. The person you are talking to is told before anything is recorded, and is shown it for as long as it is true.

1. Information we collect

None, through the app.

We have no account system. There is nothing to sign up for, no username, no email address and no phone number. We do not know that you use TwoKey+.

We do not collect: name, email, phone number, address book, location, device identifiers for advertising, usage analytics, or any behavioural data. The app contains no third-party analytics, advertising, attribution or crash-reporting software in any build.

If you have chosen in iOS Settings to share diagnostics with app developers, Apple may pass us a crash log when the app crashes. We do not ask for these, they contain no message content, and Apple's own privacy policy governs what Apple keeps.

If you email us, for example with the support or feature-request buttons, we receive your email address and whatever you write. The buttons fill in the app version, iOS version and device model, and nothing else. We use an email only to answer it. Please never put the content of a message in an email to us.

2. Information stored on your phone

Held on your phone, never transmitted to us:

• Your identity keys, generated on the phone on first launch and stored in the iOS Keychain, sealed by your iPhone's Secure Enclave. They never sync to iCloud Keychain, and they are never included in an iPhone backup in a form any other phone can open.
• Your pairings — the shared secret for each contact and their public identity key — stored in a file encrypted with a key that never leaves the phone. The file is excluded from iCloud and device backups.
• The names you give contacts, and the tags and matters you create. The other person never learns what you called them.
• Your app-lock settings and the passcode you set, if any. Face ID and Touch ID are handled entirely by iOS; the app is told only whether unlocking succeeded and never sees biometric data.
• A list of security events the app noticed, such as a contact's identity key changing.
• The record, for conversations you choose to record, described in §3.
• Your free-trial start date, a single date.

In a conversation that is not being recorded, messages are handled exactly as in TwoKey: held in memory only, never written to storage, and deleted on the lifetime you and your contact agree.

Contacts backup. You can make an encrypted backup of your pairings and contact names, protected by a passphrase you choose. It contains no messages, no identity key and no part of the record; records leave the phone only as an export you make (§3). We never receive a backup.

3. The record

What is recorded. Only conversations you turn recording on for, and only while it is on. For those, the record keeps:

• the text of every message you send and receive, with the time your phone recorded it;
• events in the conversation: recording starting and stopping, verification in person, an agreed message lifetime, a screenshot attempt by either person, and a code-reset notice (§4);
• the contact's name as you entered it, the date you paired, and the tags or matter the conversation belongs to.

It does not record whether a message was delivered or read.

An activity log. TwoKey+ also keeps a log of what was done with the record on your phone — pairing, verifying, starting and stopping recording, opening and closing matters, legal holds, retention changes, exports, deletions, policy changes — so you can show how the record was handled.

How it is protected. The record is stored in the app's own storage on your phone, encrypted under keys derived from the same key that protects your contacts. It is excluded from iCloud and device backups. Each message is sealed as it is written, so recording continues while the phone is locked, but the record can be read only by someone who can open the app. If you use the app lock's "require the code" setting, the record cannot be read at all until the code is entered.

Holds, retention and destruction. You can place a matter on legal hold, which prevents its record from being deleted by hand or by schedule. You can set a retention period, counted from when a matter is closed; TwoKey+ warns you 30 days before it ends and then destroys that record automatically the next time the app is opened, unless it is on hold or you postpone it. Destroying a record discards its keys and deletes its files; the matter's name and the log entries that mention it remain. A legal hold does not survive erasing the app (§12).

Exports. A record leaves your phone only when you export it, and only to where you send it through the iOS share sheet. An export is either an encrypted file, protected by a recovery key shown to you once and an optional passphrase, or — after a warning — an unencrypted PDF. Exports are signed by a key on your phone so later changes can be detected; the signature shows the record was not altered after export, not who wrote any message. The export file's name includes the matter or contact name and the date, even for the encrypted file. We never receive an export.

Who controls the record. You do. We never receive, store or have access to any record, so we cannot produce, correct, delete or hand one over. If you keep records about other people — a client, a source, a colleague — any obligations you have about them, including under privacy, professional and record-keeping rules, are yours.

4. The people you talk to

The people you talk to use the free TwoKey app.

• They are told before anything is recorded. If your pairing code says you keep a record, their app shows that before they pair, and they can decline. If you turn recording on later, nothing is recorded until their phone confirms it has shown them. While recording is on, their app shows that you keep a record beside your name and in the conversation, and it tells them when you stop.
• Reset notices. A contact's app can tell you if they use their reset code. It sends only the time it happened, and only if they left the switch for it on. TwoKey+ shows it to you and adds it to the record.
• Privilege notice. If you set one, TwoKey+ puts it in the message box after a new contact is verified. It is never sent unless you send it, and then it is an ordinary message.

What you do with what they send you is between you and them, and governed by the obligations described in §3.

5. Our relay servers

When two phones cannot reach each other directly, messages pass through a relay we operate. It exists only to hold an encrypted message for a phone that is offline until that phone comes back. The relay:

• Holds messages in memory only. There is no database and no disk storage. If the relay restarts, undelivered messages are gone.
• Forgets each message as soon as the receiving phone confirms it. Until then it is held for delivery, and anything not collected within 24 hours is discarded.
• Sees only an opaque mailbox address and encrypted bytes. It is never told who sent a message, who it is for, or which mailboxes belong to the same conversation, and it cannot tell a recorded conversation from any other.
• Keeps no access logs and does not record IP addresses.

Message content is encrypted on your phone before it reaches the relay and decrypted only on the other person's phone. We cannot decrypt it; we do not hold the keys.

The relay runs on a server rented from a hosting provider. Like any hosting provider, it can observe that traffic reaches the machine, and what it retains about that is governed by its own policies, not ours. It cannot see inside the encrypted connection.

6. Notifications

To deliver a message while the app is closed, we send a notification through Apple's Push Notification service. That notification is empty — no message content, no sender, nothing identifying the conversation.

To do this we hold your device's notification token, which Apple issues and which identifies your phone to Apple only, together with which of our apps it belongs to, so that the notification reaches TwoKey+ rather than TwoKey. It is kept in memory, never on disk, under a random handle chosen by your phone, and expires seven days after your phone last renewed it. Two separate servers are involved: the relay, which holds mailbox addresses and refers to your phone only by that handle, and the notifier, which holds the token and knows nothing about mailboxes. They run at different hosting companies in different countries, so neither, on its own, holds the link between your phone and a conversation. We operate both, and we say so.

What we cannot prevent: Apple learns that your device received a notification, and when.

7. Pairing, your local network, and permissions

Pairing happens in person: one phone shows a code, the other scans it with the camera. The code is never sent to us or to anyone.

• Camera. Used only while scanning a pairing code. Nothing is recorded or uploaded.
• Nearby Interaction. On iPhones with an ultra-wideband chip, pairing measures the distance between the two phones to check they are together. It is used only during pairing; the distance is not stored or sent anywhere.
• Local network. The two phones look for each other on the local Wi-Fi network to pair and to message directly when they can. iOS asks your permission. Other devices on the network can see that a TwoKey device is present, under a random name, but cannot connect.
• Face ID / Touch ID or your passcode. For the app lock, and to confirm it is you before exporting or deleting a record or changing your policy settings.
• Notifications. Optional; see §6.

8. What we share

We do not sell, rent or monetize your personal data or content, in any way. There are no third-party services in the app other than Apple's push notification service, described in §6.

We may share information only in these circumstances:

• to comply with applicable law, regulation, legal process or an enforceable governmental request;
• to enforce our terms and investigate a possible violation of them;
• to detect, prevent or address fraud, security or technical issues; or
• to protect the rights, property or safety of I Totally Need That LLC, our users or the public, as required or permitted by law.

In every case we can share only what we hold: encrypted bytes waiting for delivery, for at most 24 hours, and a notification token, for at most seven days. We hold no records, no message content, no contact lists and no logs. A demand for a TwoKey+ record can be met only by the person whose phone holds it, not by us.

9. Age and audience

TwoKey+ is for professionals and is not intended for anyone under 18. We do not knowingly collect personal information from children under 13, or from anyone else; we have no mechanism that could.

10. Your rights

Privacy laws such as the GDPR and CCPA give you rights to access, correct, export and delete personal data a company holds about you.

We hold no personal data about you, and no records. The only things we hold at all are a relayed message for at most 24 hours and a notification token for at most seven days (§5, §6). Everything else is on your phone.

If someone you talk to asks about a record you keep of them, that is a matter between you and them: we do not hold it and cannot access it. If they write to us, we will tell them so.

If you believe we hold information about you, write to support@itotallyneedthat.com and we will respond within 30 days.

11. Payment

Subscriptions are sold through Apple's in-app purchase system, including to organisations through Apple Business Manager. We never see your payment details, card number or billing address; Apple provides us with aggregate sales information only. The free trial is kept on your phone as a single date and is never sent to us.

An organisation that buys TwoKey+ Firm directly from us does so under its own written agreement, which says what business contact and billing details we keep for it.

12. Erasing

"Erase everything" in Settings, and the quick reset, destroy your identity, every pairing, every record — including records on legal hold — and every key, permanently and immediately. You can also set the phone to erase itself in the same way if the app has not been opened for a period you choose. Exports you have already made are not affected; they are wherever you put them.

13. What this policy does not protect you from

• The person you are messaging. They can screenshot, photograph the screen, or repeat what you said.
• A compromised or unlocked phone. Anyone who can open the app on your phone can read its records. The app lock helps; it is not a substitute for locking the phone.
• Legal process against you. A record on your phone can be sought from you, like any other record you keep.
• Your exports. Once exported, a record is protected only by how it was exported and where you keep it. An unencrypted PDF is readable by anyone who has it.
• Traffic analysis. Someone watching your network can see that you connected to a relay and when, though not to whom or what was said.

14. Changes

We will update this policy as needed so that it stays current, accurate and as clear as we can make it. Any change updates the date above, and anything material will be noted in the release notes of the app update that carries it and on this page.

15. Contact

support@itotallyneedthat.com — put "Privacy" in the subject line.

I Totally Need That LLC — TwoKey+
1909 E Ray Rd
Ste 9 - 1033
Chandler, AZ 85225
United States