privacy policy

your stuff.
your say.

Effective October 5, 2026

Period questions can be personal. This policy explains what Lonely Labs, Inc ("Hey Twin," "we," "us") collects, why we need it, who helps us process it, and the choices you have.

Hey Twin is not covered by HIPAA. We still treat period and symptom information as sensitive consumer health data. Read the separate consumer health data privacy policy for the categories, sources, disclosures, and rights that apply to that data.

the waitlist

When you join, we collect your phone number or, if you choose email instead, your email address, signup time, and a record that you confirmed you are 13 or older and agreed to the selected launch notification. We use this only to manage the waitlist and let you know when Hey Twin opens. Phone signup includes permission for one automated launch text; email signup includes a short confirmation email and the launch email. Joining does not start an iMessage conversation or create a period-tracking profile.

The list is stored in a private Cloudflare D1 database through our website host. Phone signups receive an on-screen confirmation; we do not send a verification or confirmation text now. Entering a number does not verify ownership. Before sending launch texts, we will use a messaging provider to process the opted-in numbers and deliver the notification. Resend processes email addresses to deliver confirmation and launch emails. We do not ask for period details or your exact age. To prevent spam, we temporarily store an hourly changing hash of your IP address and an attempt count; expired entries are removed during later signup requests. Our host may separately retain security and request logs.

We keep your signup until you ask us to remove it or until 90 days after the launch notification, whichever comes first. To leave, contactyo@heytwin.chat. For email signups, write from the address you used; for phone signups, tell us which number to remove so we can confirm the request. Reply STOP to a launch text to opt out of further messages. We do not sell the list or share phone numbers or messaging opt-in records with third parties for their own marketing. Launch permission does not enroll you in ongoing product check-ins.

what this policy covers

This policy covers the Hey Twin website and the private one-to-one messaging service you reach through the public Hey Twin number. It does not cover Apple, your mobile carrier, or other services you use independently.

information we collect

• Contact and messaging information: your phone number as needed to exchange messages, provider chat and message identifiers, delivery status, timestamps, and reactions. The application uses a pseudonymous identifier for ordinary internal recognition instead of keeping your full number in its main product records.
• Age eligibility: whether you are eligible, under 13, or have not completed the check. We do not keep the exact age you type.
• Messages and consumer health data: the text and reactions you send, Twin’s replies, period start and end dates, symptoms, flow, mood, how you felt, and details about how symptoms affected your day.
• Preferences and requests: check-in status and timing, corrections, deletion requests, language status, and conversation stage.
• Optional personal details: a name or nickname you choose, and everyday activities such as dance or reading that you explicitly ask Twin to remember. We do not build an inferred personality profile.
• Service and safety information: minimal delivery, security, reliability, rate-limit, and coded safety records. We do not put raw health messages or phone numbers in ordinary application logs.
• Website information: when optional analytics is enabled, Google Analytics measures page visits, broad traffic sources, device/browser types and fixed actions such as opening the waitlist or completing signup. We do not send phone numbers, email addresses, form contents, period details, conversation-example IDs, URL queries or fragments. We do not use advertising features or session replay. Our host separately processes request information to deliver and secure the website.
• Support information: your email address and what you send us if you contact support. Please do not include private health details in email.

how we use information

Twin explains memory in the conversation when it becomes relevant. For a tentative period start, Twin explains why remembering the date helps and asks before saving it. If daily check-ins are enabled, the introduction says they occur and that pause stops them. You can ask us not to save something, correct or forget a detail, pause check-ins, or delete your data.

We use information to:

• check eligibility before processing health content with AI;
• deliver messages and generate context-aware period support;
• save, show, correct, and delete the history you choose to keep;
• send privacy-safe check-ins and honor pause or opt-out requests;
• detect urgent safety situations and provide reviewed guidance;
• protect, debug, and improve the reliability of the service; and
• comply with law and respond to valid legal requests.

We do not sell personal information or consumer health data. We do not use it for targeted advertising, ad measurement, or data-broker profiles. We do not let OpenAI train its models on Hey Twin API inputs or outputs.

optional website analytics

On marketing and signup pages, Google Analytics is enabled by default for visitors our host identifies as being in the United States, unless you have declined or your browser sends a privacy signal. In the EEA, UK and Switzerland, we ask first. We also ask when location is unavailable. In other countries, analytics stays off unless you enable it through “cookie settings” in the footer. Period education pages do not load Google Analytics or automatically show the analytics panel. Declining leaves signup and the rest of the site working. Analytics is separate from the messaging service and is not linked to your email or conversation. Google receives technical information such as browser/device details and your IP address when receiving a request. Seehow Google uses information from partner sites.

Analytics cookies expire after 90 days. Your choice is saved in your browser for up to 180 days. Use “cookie settings” in the footer to change it; declining removes our Analytics cookies and stops future collection. We also honor Do Not Track and Global Privacy Control signals. Advertising storage, personalization and Google Signals are disabled.

Our host uses the request’s country to select this setting. This lookup does not use a separate location provider or save your country as an analytics event. A regional default is not saved as your consent choice.

who helps us provide the service

We disclose only the information needed to providers acting for us: Sendblue routes iMessage traffic; OpenAI generates AI responses; and our website, application, database, security, and email providers operate the service. Apple and your carrier process messages under their own terms. We may also disclose information when reasonably necessary to comply with law, protect rights or safety, investigate abuse, or complete a business reorganization subject to appropriate protections.

Sendblue may retain message content and messaging metadata under its retention policy. Provider systems have their own records and retention rules. Deleting Hey Twin application data does not remove the Messages conversation stored on your devices or delete copies held by Sendblue or other providers under their policies.

how long we keep it

• Before the age check, one initial message may stay only in temporary process memory for up to 10 minutes. It is not sent to the AI or added to product history unless eligibility is established.
• Encrypted conversation text in the Hey Twin application expires after 30 days.
• Saved period history, observations, eligibility, and preferences remain until you delete them or the service no longer needs them.
• Routine application delivery and job records expire after 30 days.
• Optional saved activities expire 180 days after you ask us to remember them again. You can ask what is saved, change or forget an activity, or say “don't remember personal stuff” to clear activities and stop saving them. This leaves your name, health records and 30-day chat retention alone. “Delete my data” clears your Hey Twin application data.
• Minimal coded safety records expire after 90 days.
• Support records are kept only as long as reasonably needed to answer the request, protect the service, and meet legal obligations.

your choices and rights

• Ask what do you remember? to see saved period history.
• Correct a detail in ordinary words.
• Ask Twin to forget a specific detail.
• Text pause to stop scheduled check-ins.
• Text delete my data to delete your Hey Twin application profile and retained history.
• Ask us to access, correct, or delete personal information, or appeal a denied privacy request, through contact & help.

We may need to verify a request before acting on it. We will not discriminate against you for exercising a privacy right. Some information may be retained when required by law or needed for security, fraud prevention, or legal claims.

age

Hey Twin is for people age 13 and older in the United States. If the age check says someone is under 13, we do not enable the service or process their health message with AI. If you believe a child under 13 provided personal information, contact us so we can investigate and delete it as appropriate.

security

We use administrative, technical, and physical safeguards designed for sensitive data, including encryption in transit and application-level encryption for retained message content. No system can promise perfect security. If a breach requires notice, we will notify affected people and regulators as required by law.

changes to this policy

We may update this policy as the service or law changes. We will post the revised policy with a new effective date and provide additional notice when required.

contact

Privacy questions and requests can be sent through contact & help or emailed to yo@heytwin.chat.

Operator: Lonely Labs, Inc · Rua João Infante 78, Cascais, 2750-384, Portugal