1. Who is responsible for your information

Twerll ("we", "us") operates the Twerll apps and sites, including app.twerll.com (the "Service"). Twerll is operated as a sole proprietorship based in Canada and is the organization accountable for your personal information under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and similar laws. Privacy contact: legal@twerll.com.

This policy applies to the Service. It does not cover what other users do with documents and information you choose to share with them.

2. What we collect

Information you provide

• Account details: email address, username, display name, optional profile details and photo, and password (stored in hashed form by our authentication provider). If you sign in with Apple or Google, we receive the identifiers those services share.
• Documents and agreements: the files, agreement text, form fields, and attachments you create or upload.
• Signatures and signing media: drawn or typed signatures and, where you use them, voice or video recordings captured as part of signing.
• Evidence Vault content: files you seal, including any metadata inside those files.
• Messages: chats, secure rooms, and related media you send through the Service.
• Connections and invites: the connections you make, and the email addresses or contact details of people you invite to sign or chat. If you give us someone else's contact information, you confirm you are allowed to.
• Support and reports: what you send us when you contact support or report abuse.

Information collected automatically

• Signing and custody records: timestamps, verification events (for example that a one-time email code was confirmed, or that a signing link was opened), IP address, and device or browser details connected to signing and Evidence Vault events. These records exist to make agreements and evidence trustworthy.
• Usage and diagnostics: app interactions, feature usage, crash logs, and performance data (via Google Firebase / Google Analytics for Firebase).
• Cookies and similar technologies (web): we use cookies and local storage needed to keep you signed in, remember preferences, and measure usage. We do not use third-party advertising cookies.

3. Why we use it

We do not sell your personal information, and we do not use the content of your documents, evidence, or messages for advertising.

4. AI processing

When you use an AI feature, the content needed for that feature (for example document text you ask about, or a drafting prompt) is sent to third-party AI model providers (currently Anthropic's Claude models, accessed through an API gateway) to generate the response. We send only what the feature needs, and we do not permit these providers to use your content to train their models under our agreements with them. Avoid submitting information you have no right to share. AI usage may be metered per account.

5. Who we share it with

• People you choose: counterparties, signers, room and chat participants, and anyone you give a signing, verification, or invite link to. A person holding a certificate's verification details can confirm the record's integrity on our public verification pages.
• Service providers (processors):
  • Google (Firebase: authentication, database, file storage, cloud functions, hosting, analytics, push notifications)
  • Payment providers, if and when paid subscriptions are offered; we do not store full card numbers
  • AI model providers, as described in section 4
  • Email delivery providers, for one-time codes, signing requests, and notices
• Legal: if required by law or a valid legal process, or to protect the rights, safety, or property of Twerll, our users, or the public.
• Business transfer: if the Service is reorganized (for example incorporated into a company) or sold, your information may transfer with it under the same protections; we will notify you of material changes.

6. Where your information is stored

The Service runs on Google Cloud infrastructure, and your information may be stored and processed in the United States and other countries where our providers operate. Those countries may have different data protection laws than yours, and their authorities may have lawful access to data held there. We use providers that commit to appropriate safeguards (including standard contractual clauses where required).

7. How long we keep it

• Account data: for as long as your account exists. When you delete your account it is disabled and signed out everywhere immediately, and permanently deleted after 30 days. During those 30 days you can ask us to stop it. See section 8 for how to delete, and for what deletion does and does not remove.
• Deleted items: items you delete may sit in trash with a grace period (currently 10 days) before permanent deletion; residual copies may persist briefly in backups.
• Signed agreements, signing records, and custody ledgers: these are shared records. They are kept as long as reasonably necessary for the parties who rely on them and for legal purposes, even if one party deletes their account. Sealed evidence and its custody ledger are hash-chained over the identity of whoever created each entry, so they cannot be anonymized without destroying the proof the other parties rely on.
• Messages in shared conversations: kept in the conversation for the other participants, with your name and photo replaced by "Deleted user".
• Usernames: retired permanently when an account is deleted, and never reassigned, because certificates and links issued earlier may still refer to them.
• Deletion record: after an account is deleted we keep a one-way cryptographic hash derived from the account's email address and account ID, together with whether the account had been suspended and the reason. This cannot be reversed to recover your email address. We keep it so an account suspended for abuse cannot be deleted and immediately registered again, and for no other purpose.
• Payment records: kept as required by tax and accounting law.

8. Your rights

Subject to the shared-record retention above and to applicable law, you can:

• access the personal information we hold about you and ask how it has been used and shared;
• get a copy of your data in a portable, machine-readable format, including your agreements, your signing records on both sides, your sealed evidence with its chain-of-custody ledger, your own messages, and download links for your files. Email legal@twerll.com to request one;
• correct inaccurate information (much of it directly in the app);
• delete your account and content, in the app under Settings › Account › Delete account, from our account deletion page, or by email;
• withdraw consent where processing is based on consent (for example unsubscribe from non-essential emails);
• if the GDPR or UK GDPR applies to you: request portability, restriction, or object to processing based on legitimate interests, and complain to your local supervisory authority.

To exercise any right, use the in-app controls or email legal@twerll.com. We may need to verify it is really you before acting. If you are unsatisfied with our response, you may contact the Office of the Privacy Commissioner of Canada (priv.gc.ca).

9. Security

We protect your information with measures including encryption in transit, encrypted storage on our cloud providers, sealed evidence storage with integrity hashes, tamper-evident custody ledgers, access controls, and security rules restricting who can read what. No system is perfectly secure; if we learn of a breach creating a real risk of significant harm to you, we will notify you and the relevant authorities as required by law.

10. Email and messages (CASL)

We send transactional messages needed to run the Service (one-time codes, signature requests you are a party to, receipts, security notices). Marketing or product-news messages are sent only with your consent, and every one includes a working unsubscribe. Signature requests and invites are sent at the request of the user who initiated them, and identify that user as the sender.

11. Children

The Service is for adults (18+, or the age of majority where you live) and is not directed to children. We do not knowingly collect personal information from children; if you believe a child has created an account, contact us and we will delete it.

12. Changes to this policy

We may update this policy as the Service evolves. For material changes we will give notice in-app or by email before the new version takes effect, and we will update the effective date above. Prior versions are available on request.

13. Contact

Privacy questions, access requests, and complaints: legal@twerll.com.