Privacy Policy

This Privacy Policy explains how GarlicApps (“GarlicApps”, “we”, “us”) collects, uses, shares and protects personal information when you use the TwoOne mobile application and related services (the “Service”).

TwoOne is a privacy-first platform for adults seeking serious relationships and marriage, designed primarily for users in Sri Lanka. We have built it so that you decide how much of your identity others can see, and so that those choices are enforced on our servers and not only in the app.

By creating an account you confirm that you have read this policy. If you do not agree with it, please do not use the Service.

Account and verification: your mobile phone number (used to sign in with a one-time passcode), the date of birth or age confirmation you provide so we can enforce our 18+ rule, and your account status.

Profile information you choose to provide: a username and nickname, gender, nationality, general location, education, profession, religion and cultural background, languages, lifestyle, relationship and marriage intentions, family and children expectations, relocation preferences, and optional health information. You may also complete a separate “ideal partner” profile describing the preferences you are looking for.

Identity information: if you choose to provide it, your legal name. It is stored separately from your public profile and is shown to another user only after you consent.

Photos: photos you upload. They are kept in private storage and are shown to others only according to your visibility settings and consent.

Communications: messages you send to people you have matched with, notifications we send you, and requests you make or receive to reveal photos or your legal name.

Safety information: users you block, and reports you submit or that are made about you, including their content and outcome.

Sharing and export records: your profile share-link settings (including whether a link is active) and records of profile exports you generate.

Device and technical information: device type, operating system and version, app version, language, push-notification token, IP address, crash logs and diagnostic data.

Usage information: how you use the app, such as screens viewed, features used, taps and navigation, session length, performance timings and errors (see “Analytics, diagnostics and similar technologies” below).

To create and secure your account, verify your phone number and enforce our age requirement.

To build your profile, calculate explainable compatibility between profiles, show you suggested people, and let matched users message each other.

To apply your privacy and disclosure choices, including photo and legal-name reveals.

To send service messages and notifications you have enabled, such as new matches, messages and reveal requests.

To keep the Service safe: detecting fake profiles, fraud, harassment and underage use, handling reports and blocks, and enforcing our Terms.

To understand how the app is used, find and fix problems, and improve the design, usability and performance of the Service.

To comply with legal obligations and to establish, exercise or defend legal claims.

We do not sell your personal information, and we do not use your private messages or hidden photos for advertising.

We process your information based on your consent (for example, when you create a profile, upload photos or enable notifications), because it is necessary to provide the Service you asked for, because we have a legitimate interest in keeping the Service safe and improving it, and where the law requires us to.

Where we rely on consent you can withdraw it at any time through the app settings or by contacting us. Withdrawing consent does not affect processing carried out before withdrawal, and some features may stop working.

Some information you may choose to share, such as religion, cultural background, relationship preferences and health information, is sensitive. Providing it is optional unless a field is marked required for account creation. We use it only to run the features you ask for, such as matching and disclosure, and we apply stricter visibility defaults to it.

Your legal name, phone number, health information and hidden photos are never shown on a shared public profile link or in a profile export unless you explicitly choose to include them.

To make TwoOne easier to use and to find problems quickly, we use, and may in future add, analytics, crash-reporting, performance-monitoring and user-experience tools (including tools that record how screens and features are used, such as event, funnel and session-based analytics). These may be provided by third parties acting on our behalf.

Information these tools may receive includes screens and features used, taps and navigation paths, timestamps and session length, device model, operating system, app version, language, approximate region derived from IP address, performance metrics, error and crash reports, and a pseudonymous identifier. We configure them so that they do not receive your legal name, phone number, message content, hidden photos or health answers.

We use this information to understand usage patterns, improve the user interface and experience, diagnose bugs and keep the Service reliable. We do not use it to sell your data or to build advertising profiles.

Where the law or the app stores require it, we will ask for your permission first and give you a way to opt out in the app settings. We will keep this policy up to date with the categories of tools in use, and we will update it before we begin collecting any new category of usage data.

With other users: only what your profile and privacy settings allow. Other users can see your nickname, age, general location and the profile information you have made visible. Photos and your legal name are revealed only as you allow.

With service providers who process data for us under contract: for example, cloud database, authentication, file storage and real-time messaging (Supabase); SMS delivery of one-time passcodes (Twilio Verify); push notifications (Firebase Cloud Messaging from Google); and analytics, crash-reporting and performance providers as described above.

With app-store platforms (Google Play and the Apple App Store) as needed to distribute the app and process any purchases in future.

With authorities or other parties where we are legally required to, or where it is necessary to protect the safety, rights or property of users, the public or GarlicApps.

In a business transfer, such as a merger or sale of assets, subject to this policy continuing to apply to your information.

Information you share via a profile link or PDF export can be seen by anyone who receives it. You can disable or regenerate your share link at any time.

Your data is stored on Supabase infrastructure. Every database table is protected by row-level security so that users can only read data they are permitted to see. Sensitive data such as legal names and phone numbers is held in separate tables from public profile data. Photos are stored in a private bucket and delivered through short-lived signed links.

Data is encrypted in transit and at rest by our infrastructure providers. No system is perfectly secure, so we cannot guarantee absolute security, but we work to protect your information and review our controls regularly.

Our service providers may process data in countries other than Sri Lanka. Where we transfer personal information abroad we take steps to ensure it remains protected in line with applicable law, including contractual safeguards with our providers.

We keep your information while your account is active and for as long as needed to provide the Service. When you delete your account we delete or anonymise your profile, photos, messages and identity information within a reasonable period, normally within 30 days.

We may keep limited records for longer where needed for safety, fraud prevention, dispute resolution or legal obligations, for example records of reports, blocks and enforcement actions, and backups until they are overwritten in the ordinary cycle.

Subject to applicable law, including Sri Lanka’s Personal Data Protection Act, No. 9 of 2022, you may have the right to access the personal information we hold about you, correct inaccurate information, delete your information, withdraw consent, object to or restrict certain processing, and receive a copy of your data.

In the app you can edit your profile, change visibility and photo settings, revoke previously granted reveals where supported, block or report users, turn notifications on or off, regenerate or disable your share link, export your profile, and delete your account.

To exercise any right you cannot complete in the app, contact us. Email us at hello@garlicapps.com. We may need to verify your identity before acting on a request.

You may also have the right to complain to the relevant data-protection authority.

You can delete your account in the app under Settings. If you cannot access the app, contact us using the details below from the phone number linked to the account and ask us to delete it. Deletion is permanent and cannot be undone.

TwoOne is only for adults aged 18 and over. We do not knowingly collect information from anyone under 18. If we learn that an account belongs to someone under 18 we will remove it. If you believe a minor is using the Service, please report it in the app or contact us.

We may update this policy from time to time, for example when we add new features or tools. We will post the new version here with a new “last updated” date and, for material changes, notify you in the app or by another suitable means. Continued use after a change means you accept the updated policy.

GarlicApps is the publisher of TwoOne. For privacy questions or requests: Email us at hello@garlicapps.com.