Who we are
Twikka is operated by Novansa OĂś, a company registered in Estonia (registry code 17445226). We are the data controller for personal data collected through the Twikka app and the twikka.com website. You can reach us about privacy at [email protected].
1. Our approach
Twikka helps people become active and stay active, with an AI coach and, if they choose, friends and small groups. To do that well, the app handles information that can be personal: what you tell your coach, your activity, and sometimes your health. We collect what we need to run the service, protect it, and never sell it. We don’t show advertising, and we don’t use your data to train AI models.
2. What we collect
Account data. Your email address and name. You sign in with a one-time code sent to your email; Twikka doesn’t use passwords. You can add a profile photo.
Profile information. Information you choose to give, such as your age, gender, city and time zone, what motivates you, and your preferences for check-ins.
Your conversations with your coach. What you write to your coach and what it writes back. These conversations can include information about your health, mood or circumstances if you choose to share it.
What your coach remembers. To give personal, consistent coaching, Twikka keeps short notes drawn from your conversations and activity; for example your goals, things that make activity harder for you (such as an injury), and what has worked before.
Activity and health data from your phone. If you allow it, Twikka reads your steps and workouts from Apple Health (iPhone) or Health Connect (Android). You can turn this off at any time in your phone’s settings.
Your location. You choose your city yourself; Twikka doesn’t read your location in the background. Twikka may ask for your location only if you choose to share it with people you know and are connected to on Twikka, for example to meet up with your group for a walk. It is shared only with them, only when you say so, and you can stop sharing at any time.
Partners and groups. If you pair up with an accountability partner or join a small group, we store the pair or group, your membership, and what you share there: messages, photos, reactions, nudges and a pair’s weekly goal. We also keep your settings for each one (what you share, notifications), the people you block or mute, and reports you make or that are made about you.
What partners and groups see. Your first name, your photo if you’ve added one, what you share with them, and which days you were active. They see what you did, or for how long, only if you choose to share it, and you can change this for each pair or group at any time. Because this activity is health information, we ask for your consent first. Your conversations with your own coach, and what it remembers about you, are never shared.
Photos you share. Before a photo leaves your phone, the app removes its location and other details (such as the camera and the time it was taken) and resizes it.
Website forms and newsletter. When you join early access, sign up for our newsletter, or contact us through twikka.com, we collect your name, email address, what you write, the time, and your IP address (to help prevent abuse).
Technical data. Device type, operating system, app version, and error reports that help us fix problems.
Payment data. Paid plans are sold through the Apple App Store, Google Play, or, on the web, Paddle, which acts as the seller. We receive your subscription status and a transaction record, never your full card details.
3. How we use it
- to create and run your account and sign you in
- to provide coaching: your coach’s replies, suggestions and check-ins
- to show your progress, and to share what you choose with partners and groups
- to run pairs and groups: delivering messages and notifications, the group’s coach, and moderation
- to keep people safe (see section 5)
- to answer your questions and send service messages, such as sign-in codes
- to send our newsletter and early-access updates, if you’ve asked for them
- to manage subscriptions and payments
- to fix problems and improve Twikka, using aggregated or pseudonymised information
- to meet our legal obligations
4. AI coaching
Your coach is an AI. To write each reply, Twikka sends the relevant part of your conversation to an AI model, together with context that makes the reply personal: your profile information, recent activity, and what your coach remembers about you. It doesn’t send your name, email address, phone number or account details: your coach writes a placeholder where your name goes, and the app fills it in. The models are provided by Google, Anthropic and OpenAI, reached through our backend provider Convex. We use their business services, whose terms do not allow them to use your content to train their models.
Coaches and pairs and groups. In a small group, the group’s coach (also an AI) reads the group’s messages, using first names, to welcome people, suggest something to try each week and reply when someone asks it something; Twikka sends recent group messages to an AI model to write those replies, in the same way. Your own coach can see which days your partners were active, as they share them with you, and your partner’s coach can see the days you share, so each can encourage you. No coach sees your messages with your partner, or what you tell your own coach.
Twikka personalises coaching from this information. It does not make decisions about you that have legal or similarly significant effects, and it doesn’t diagnose or treat health conditions. AI can make mistakes; your coach’s suggestions are general guidance.
5. Keeping people safe
If a message suggests someone may be at risk (for example a medical emergency or a mental-health crisis), Twikka responds with appropriate help and contact numbers, and the conversation is flagged for review. Flagged conversations can be read by a small number of trained members of our team, only to check that the person was given the right help and to improve how Twikka responds. If we think someone may be at risk, one of them may contact that person directly to offer help. Conversations are not monitored in real time.
Messages in pairs and groups are checked in the same automatic way. This isn’t moderation: the message is delivered either way. If it suggests someone may be at risk, their own coach checks in with them privately, in a group the group’s coach replies kindly, and our team is alerted.
Moderation. A small number of trained members of our team read messages and photos in pairs and groups only when they’re reported, when a photo is waiting for review, or when a message is flagged for safety. Each time they open one, it’s recorded. They can remove content and limit or close accounts, as our community guidelines explain, and we tell the person what we did and why.
6. Legal bases (GDPR)
We are based in Estonia and subject to the EU General Data Protection Regulation.
- Providing your account, coaching, partners and groups: performance of our contract with you (Article 6(1)(b)).
- Health information (from your phone, and anything about your health you share with your coach): your explicit consent (Article 9(2)(a)), which you can withdraw at any time.
- Sharing your activity with partners and groups: your explicit consent (Article 9(2)(a)). You can withdraw it at any time in Settings, which stops all sharing.
- Safety review of flagged conversations, and safety checks of messages in pairs and groups: our legitimate interest in protecting users (Article 6(1)(f)) and, in an emergency, vital interests (Article 9(2)(c)).
- Moderating pairs and groups: our legitimate interest in keeping Twikka safe (Article 6(1)(f)), and our legal obligations where they apply (Article 6(1)(c)).
- Improving Twikka and preventing abuse: legitimate interests (Article 6(1)(f)).
- Newsletter and early-access updates: your consent (Article 6(1)(a)).
- Payments and legal record-keeping: contract and legal obligation (Article 6(1)(b), (c)).
7. Who we share it with
We use these service providers, under data processing agreements:
- Convex: our backend and database (hosted in the EU, Ireland), and access to AI models.
- Google, Anthropic and OpenAI: AI models that write coaching replies (see section 4).
- Clerk: sign-in and sign-in emails.
- Postmark: other emails from Twikka, such as moderation notices.
- OneSignal: notifications on your phone.
- Cloudflare: network security and delivery for twikka.com, and file storage for photos and images (EU jurisdiction).
- Hetzner: hosting for the twikka.com website (EU).
- Sentry: error monitoring for the website.
- GoHighLevel: managing website enquiries, early-access sign-ups and our newsletter.
- Apple, Google and Paddle: payments, and Apple Health or Health Connect if you connect them.
We may also disclose information where the law requires it. We never sell your personal data.
8. Transfers outside the EU
Some providers (for example Clerk, the AI model providers, Postmark, OneSignal, Sentry and GoHighLevel) are based in the United States. Where we transfer personal data outside the European Economic Area, we rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses.
9. How long we keep it
- Account, profile, conversations, coach notes, activity and health data: while your account exists, then deleted within 30 days of you deleting it.
- Safety-review records: while your account exists, then deleted within 30 days of you deleting it.
- Messages and photos in pairs and groups: kept as part of the pair or group. You can delete your own at any time, and they’re removed within 30 days of you deleting your account (others then see “Deleted user: message removed”).
- Reports and moderation decisions: kept so we can keep Twikka safe and show what we did. When an account is deleted, the content and personal details in them are removed.
- Website enquiries and early-access sign-ups: up to 24 months after our last contact with you.
- Newsletter: until you unsubscribe.
- Payment records: 7 years, as required for tax and accounting.
- Error reports: up to 90 days.
- Backups: up to 90 days after deletion from our main systems.
10. Your rights
You can ask us to:
- access the personal data we hold about you
- correct it if it’s wrong
- delete it (you can also delete your account in the app)
- export it in a machine-readable format
- restrict or object to certain processing
- withdraw consent at any time, without affecting what we did before
Email [email protected]. We’ll reply within one month. You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or the data protection authority where you live.
11. Security
We encrypt data in transit and at rest, limit who in our team can access personal data, and review our security regularly. No system is perfectly secure; if you find a potential security issue, please tell us at [email protected].
12. Cookies
twikka.com uses only cookies needed for it to work, such as remembering your language. We don’t use advertising or cross-site tracking cookies. The app doesn’t track you for advertising.
13. Children
Twikka is for people aged 16 and over. We don’t knowingly collect data from anyone younger, and we delete it if we find we have.
14. Changes to this policy
We’ll update this policy as Twikka changes, and tell you about important changes by email or in the app before they take effect. See also our Terms and Conditions.
15. Contact
Novansa OÜ, Sepapaja tn 6, 15551 Tallinn, Harju Maakond, Estonia · [email protected]