Legal

TwoSpark (hereinafter, “we” or “the platform”) is the controller responsible for processing the personal data collected through this site, in accordance with Regulation (EU) 2016/679 (GDPR) and applicable data protection law.

• Registration data: username, email address, date of birth (to verify you are of legal age), and encrypted password.
• Profile data: display name, profile photo, bio, and approximate location.
• Generated content: chat messages, rooms created, and private room invitations.
• Technical data: IP address, device type, browser, and platform usage data.
• Premium subscription data: managed by an external payment provider; TwoSpark does not store your full card details.

• Providing the service: creating your account, displaying rooms, and enabling real-time chat and video calls.
• Verifying that you meet the age requirement.
• Managing your Premium subscription and associated payments.
• Applying moderation and platform safety measures (reports and blocks).
• Sending you service-related communications.
• Analyzing aggregate platform usage to improve it.

The legal basis for this processing is, depending on the case, performance of the service contract, compliance with legal obligations (such as age verification), our legitimate interest in keeping the platform safe, or your consent when expressly requested.

To operate TwoSpark we share data with the following processors:

• Supabase — database, authentication, and storage.
• LiveKit — real-time video call infrastructure.
• Our payment provider, to manage the Premium subscription.

These providers only process your data following our instructions and to the extent necessary to provide the service. When any of them is located outside the European Economic Area, we ensure appropriate safeguards exist under the GDPR (such as the European Commission's standard contractual clauses).

We keep your data for as long as your account remains active. After you close your account, we will keep it only for the periods required by applicable regulations (for example, tax or security obligations), after which we will delete or anonymize it securely.

Under the GDPR, you can exercise the following rights at any time:

• Access: know what data of yours we process.
• Rectification: correct inaccurate data.
• Erasure: request deletion of your data (the ‘right to be forgotten’).
• Restriction: restrict the processing of your data in certain cases.
• Objection: object to a specific processing activity.
• Portability: receive your data in a structured, commonly used format.
• Withdraw your consent at any time, when processing is based on it.

You can exercise these rights by writing to our privacy contact email. You also have the right to file a complaint with your national data protection authority if you believe we have not handled your data correctly.

We apply reasonable technical and organizational measures to protect your data, including encryption in transit, access control, and database-level security policies (Row Level Security) that restrict who can read or modify each piece of data.

TwoSpark is intended exclusively for people 18 years of age or older. We do not knowingly collect data from minors. If we detect an account belonging to a minor, we will proceed to delete it.

We may update this Privacy Policy to reflect legal or service changes. We will publish any changes on this same page along with the date of the last update.