Privacy Policy — Twinning
Version: 2026-10-22.v1
Last updated: 22 October 2026 (Asia/Shanghai)
Twinning (“Twinning,” “we,” “us,” or “our”) is an AI web app that helps you create matching-outfit portraits of you and your pet. Slogan: Match the look. Share the love.
Twinning is operated by an individual using the display name Echo. TODO: confirm legally required identity details before launch.
Site: twinningpets.com .
Contact: support@twinningpets.com. TODO: confirm this mailbox is active before launch.
1. What we collect
Depending on how you use Twinning, we may process:
| Category | Examples |
|---|---|
| Photos you upload | Owner (human) photo; pet photo |
| Generated images | Watermarked free previews; HD unlocks after payment |
| Consent records | Consent version, timestamp, adult / permission flags; region only if available |
| Session & account | Guest session cookie; optional email / Sign in with Apple if you create an account |
| Payment metadata | Stripe checkout IDs, SKU, amount, status — card details are handled by Stripe, not stored by us |
| Technical data | IP hash, user-agent hash, device/browser basics, error logs |
| Analytics (optional) | Product events via PostHog if enabled (e.g. generation started, purchase completed) |
| Communications | Messages you send to support |
We do not ask for a postal address for the core photo-generation product. We do not invent or collect phone numbers or government IDs for standard use.
2. Photos, faces, and biometric-style notice
Intended use
We process your photos only to generate the matching-outfit images you request. We do not use them for advertising profiles, selling access to your likeness, or unrelated products.
No face identification
- We do not use your photos for face recognition, identity verification, or “who is this person” search.
- We do not create, store, or sell face templates, face embeddings, or facial geometry databases.
- We do not run celebrity face matching against stored galleries.
- Uploads are sent to image-generation providers as whole images for editing / generation, then deleted per our retention schedule.
Illinois / biometric-style notice (BIPA-oriented): Photos are processed to create the images you request, not to identify you. We do not intend to collect “biometric identifiers” as that term is used under Illinois BIPA. If a provider’s internal processing could be characterized differently under local law, we still obtain your affirmative consent before upload and apply the short retention rules below.
Consent before upload
Before you can upload, you must check a consent box (unchecked by default). Create-flow one-liner:
I'm 18+, have permission for these photos, and agree to the processing described in Privacy details.
Full consent text (also on this page / Privacy details):
I confirm the person in the photo is me, or I have their permission, and everyone pictured is 18 or older. I agree that Twinning and its AI providers process these photos only to create the matching-outfit images I request. Photos are not used for face recognition or identity verification. Twinning does not use these photos to train its own AI models. Original photos are deleted within 24 hours; previews expire after 24 hours unless I unlock them.
We log consent version (2026-10-22.v1), time, and adult / photo-permission flags as evidence of consent. Region may be absent.
3. How we use data and legal bases
| Purpose | Examples | Legal basis |
|---|---|---|
| Provide the service | Generate matching portraits; show previews; unlock HD | Contract / consent |
| Safety & abuse | NSFW / minor screening; rate limits; fraud checks | Legitimate interests / legal obligation |
| Payments | Stripe Checkout; entitlements | Contract |
| Support | Answer email; fix failed jobs | Contract / legitimate interests |
| Product analytics (optional) | PostHog events to improve UX | Consent or legitimate interests |
| Legal | Defend claims; comply with law | Legal obligation / legitimate interests |
We will not use uploaded photos to train our own models. TODO: verify each production provider’s training and retention terms before launch.
4. Processors and AI providers
We use service providers (“processors”) to run Twinning. They process data on our instructions.
| Processor | Role |
|---|---|
| Netlify | Hosting / edge / serverless |
| Supabase | Database, auth helpers, object storage |
| Stripe | Payments |
| Bailian (Alibaba DashScope) | Image generation — test / development |
| OpenRouter (Qwen Image models) | Image generation — production candidate |
| PostHog | Product analytics — optional |
| OpenAI | Optional image fallback if enabled later |
Providers may retain limited abuse-monitoring logs for a short period under their own terms (often on the order of days).
We do not sell your personal information.
5. Retention
| Data | Retention |
|---|---|
| Original uploads (human + pet) | Deleted as soon as practicable after successful generation; hard delete within 24 hours |
| Guest / free watermarked previews | 24 hours, then deleted |
| Paid / unlocked HD outputs | 30 days, unless you delete sooner |
| Consent logs | Kept as long as needed to evidence consent and meet legal duties |
| Purchase / Stripe records | Kept for accounting and dispute resolution (images de-linked on deletion requests) |
| Analytics events | Per PostHog configuration if enabled |
You may request deletion of your images via in-product controls (where available) or by emailing support@twinningpets.com .
6. No training; optional future opt-in
Default: Your photos and generations are not used to train AI models operated by Twinning.
If we ever offer model-improvement training, it will be a separate, unchecked opt-in — never bundled into the main create-flow consent. Provider API terms must support a no-training posture for production human photos.
7. Your rights
Subject to where you live, you may have rights to:
- Access a copy of personal data we hold about you
- Correct inaccurate data
- Delete photos and related personal data
- Withdraw consent (stops new processing; may end your ability to use generation features)
- Object or restrict certain processing
- Lodge a complaint with a supervisory authority (e.g. EU/UK)
Requests: support@twinningpets.com . We may need to verify the request. EU/UK representative appointment: .
8. Children and age
Twinning is for adults 18 and older only.
- Do not upload photos of anyone under 18.
- We use automated screening to block high-confidence images of minors.
- If age is uncertain, we rely on your consent checkbox and may still reject the upload.
- The service is not intended for users under 13 (COPPA), and we do not knowingly collect their personal information. If you believe a child has submitted personal information, contact support@twinningpets.com so we can investigate and delete it where required.
9. International transfers
You may access Twinning from the US, UK, EU, Australia, and elsewhere. Data may be processed in regions where our processors operate (including, for test providers, infrastructure in China when Bailian is used).
Cross-border transfers rely on appropriate safeguards (e.g. Standard Contractual Clauses) where required.
10. Security
We apply reasonable technical and organizational measures, including:
- Encrypted transport (HTTPS)
- Private storage buckets; short-lived signed download URLs
- EXIF / GPS stripping on upload
- Access controls and audit-oriented logging
- Rate limiting and bot protection on generate
No method of transmission or storage is 100% secure. Report concerns to support@twinningpets.com .
11. Region-specific notices
- California (CCPA/CPRA) and other US states: Depending on applicable law, residents may request access to or a copy of their personal information, correction of inaccurate information, and deletion, subject to lawful exceptions. You may also have rights to opt out of sale, sharing or targeted advertising, limit certain sensitive-data uses, appeal a denied request, and exercise rights without unlawful discrimination. We do not sell personal information or share it for cross-context behavioral advertising. Photos are used to provide the requested service. Contact support@twinningpets.com to exercise your rights; we may verify access or deletion requests and explain any lawful exception. You may exercise rights via support@twinningpets.com .
- Illinois (BIPA) / Texas (CUBI) / Washington: See §2. We process photos to create images, not to identify you; short retention; affirmative consent.
- EU / UK (GDPR / UK GDPR): Photos are personal data. Our processing for generation is based primarily on your consent. You may withdraw consent at any time.
- Australia: We handle personal information in line with the Australian Privacy Principles where applicable.
12. Contact and updates
- Contact: support@twinningpets.com.
- Operator: an individual. TODO: confirm display name and contact address.
We may update this Policy. Material changes will be reflected by a new Version stamp (e.g. 2026-10-22.v1) and an updated “Last updated” date. Continued use after the effective date of a revised Policy, or a new consent checkbox when we require it, constitutes acceptance where permitted by law.
Twinning — Match the look. Share the love.
Email updates and pet reminders
Email preferences are optional and separate from the photo-processing agreement and Terms. Neither choice is pre-selected, and declining does not prevent payment, generation, or downloads.
- New looks and offers: With your separate opt-in, we may use your email to share new matching looks and occasional offers.
- Pet reminders: With a second separate opt-in, you may optionally provide your pet’s birthday or Gotcha Day for anniversary reminders. Dates are not required.
- Consent records: We record the choices, the exact checkbox wording, consent version, and time in private Supabase tables with row-level security. Email consent version: 2026-10-21.email.v1. Photo/legal consent version: 2026-10-22.v1.
- Unsubscribe anytime: Every future marketing message will include a one-click unsubscribe link. It immediately stops both offers and pet reminders. We then remove the contact email and pet dates, while retaining a limited consent record and suppression identifier to respect your choice.
- Order messages: Order confirmation, delivery, and refund notices are separate transactional communications. Unsubscribing from marketing does not stop these notices. They do not contain promotions.
This release records preferences and provides unsubscribe functionality only. No marketing campaigns or pet reminder messages are being sent.
Support questions
If you leave a support question, we collect your email, message, contact-consent version and timestamp so support can reply. The contact checkbox is separate and unchecked by default. This does not subscribe you to marketing. Support messages are stored privately with row-level security and are visible only to authorized administrators through the service. No support notification emails are enabled in this release. TODO: confirm support-message retention and reply arrangements before launch.