Privacy

Who we are

TwoGames+ is run by Snapstice LLC ("we"), a limited liability company based in Massachusetts, USA. For anything about this notice or your data, email privacy@twogamesplus.com.

What we keep, and why

Your account

You sign in with your email address and a 6-digit code, or the one-tap link that comes with it; there is no password. Your sign-in account is held by Supabase, the sign-in service we use: your email address, an account ID, your name, when the account was made and when you last signed in, and, for each browser you have signed in on, that browser's IP address and type, until you sign out on it or the account is deleted. If you sign in with Google instead, Supabase also holds what Google sends it about your Google account: its ID, your name, your email address, a link to your profile picture and, for a work or school account, its domain. In our iPhone app you can also sign in with Apple: Supabase then holds your Apple account's ID and the email address Apple gives, which is a forwarding address of Apple's if you choose to hide yours, and the name you choose to share, which Apple gives only the first time and the app saves to your sign-in account. A Google or Apple account with the same email address as a sign-in account signs in to that account, as long as Google or Apple has confirmed the address; an address Apple hides is a new one, so it makes a new account. You stay signed in on a browser until you sign out there. When Supabase needs to email you a code, it asks our server to send that email: your address, the code and the link pass through us for as long as it takes to send, and none of them is stored or written to a log. From your sign-in account we keep its ID, your name and your email address, and we show your name and email to the other members of your household, with your role there: Owner, Editor or Viewer. Signing in also puts you on your household's list of people, as an adult, under your first name, which only you can change. If your sign-in gives no name, as one with Apple may not, the list shows the start of your email address until you change it. Only people who sign in drive, and if you do, you say where you drive from: the same address as your household, or an address of your own, with its apartment, suite or unit number if you add one. Nobody else can add or change it, the Owner included, except that the Owner can say you don't live at your household's address, which takes that choice back. Only you see all of an address of your own: everyone else in your household sees its town and state.

Your household

Its name, which we start from your last name, or "My household" when your sign-in gives no name, and its Owner can change; which plan it is on, until when, whether it was complimentary or paid for, whether it renews, and whether its last payment failed; when it is paid for, how often, since when, and which plan its next renewal is for and at what price; when it is paid for on our website, the IDs Stripe gave its customer and subscription; when it is paid for in our iPhone app, the ID Apple gave the subscription, whether it was bought for real or as a test (in Apple's TestFlight or its review of the app), which member of the household bought it, which everyone in the household can see, and when Apple last told us about it; when it is paid for in our Android app, the token Google Play gave the purchase, whether it was bought for real or as a test (by an account we let test buying without being charged), which member of the household bought it, which everyone in the household can see, and when our server last asked Google Play about it; and nothing else about the payment; your household's home address, its Home base, with its apartment, suite or unit number if you add one, and, once it has been located, its map coordinates; and your time zone, whether it comes from that address, and whether the map has found it yet. Only the household's Owner, and anyone the Owner confirms lives there, see Home base's full address; everyone else in it sees its town and state. Drive times, and when to leave home, are worked out from the home each drive starts from: Home base, or the address of whoever drives, if they drive from their own. We keep the drive time and distance between each of those homes and each venue, and between venues on one day, and, on a day you drive to an event, the latest drive time with the traffic and when it was measured, with how many times that drive has been checked and when that count began, to count your plan's live traffic checks. A count covers 6 hours from its first check. Someone whose phone has a home's map position (see Your location) is shown the drives from and to that home unrounded. Everyone else in the household is shown each drive's time rounded up to the next 5 minutes, and its distance rounded to about 3 miles (about 5 kilometers). Even rounded, they can give a rough idea of where a home is.

A promo code you used

If we gave you a code for a complimentary plan and you typed it in, we keep which code it was and when, so it can't be used twice. Nothing about who gave it to you.

One plan per home

A plan covers one home: your household's, its Home base. So once the map has found it, we compare its map position, and any flat or unit number in its address, with other households' homes. When another household's home is the same place, its players, teams and schedule reads count toward the same plan as yours. If that stops you adding something, we tell you only that another household at your address uses TwoGames+: never who, or anything about them. The comparison reads counts, never names, and keeps nothing new. An address someone drives from on their own is never compared with anyone's.

The people in your household, and their teams

For each person in your household, a child or an adult: a name, a colour for the screen, whether they're an adult, and which of your teams they play on. For each person who signs in, also where they drive from, once they have said: the same address as your household, or an address of their own, with its map coordinates once it has been located; and, if they chose your household's address, whether and when the Owner confirmed they live there. Anyone already in a household when we began keeping where people drive from counts as confirmed from then. Someone you add who doesn't sign in, an add-on, never drives, so we keep no address for them: only their name, colour, whether they're an adult, and their teams. When a game, practice or other event is for only some of a team's players, we also keep which of them it's for. That is all we keep about a person, and we keep nobody else: not a team's other players, coaches or families. Each team's name, its level when you give one (an age group or division, such as "U12" or "Bantam A"), and its league and sport; when you pick a league from our list of leagues, which one it is and when you picked it; each team's games, practices and other events, with their dates, times, venues and opponents, and the name you give a tournament or another event, or the name a team's calendar gives an event when you import it from a calendar link, such as "Picture Day". A team's calendar link you keep when you import from it, with which of your teams it fills, what the calendar calls each of them, which of their events on your schedule it lists, when it was kept, and what we note of its reads (see Reading a calendar link). The venues' names and addresses, and their map coordinates once found: from our own list of Massachusetts rinks, a public record kept by the state, or from Azure Maps (below).

Your decisions

Which games and practices you're skipping, which adult in your household drives to which of them, which of your teams and leagues come first when two games clash (the Owner's ranking), your timing settings, such as how long a game runs (in a league, at one of its levels, or one game) and how early to arrive, and whether distances show in miles or kilometers.

Your location, if you turn it on

We don't keep it. It's used only if you turn on location in Settings, on the phone you carry, and only on that phone: TwoGames+ asks the phone where it is only on a day you drive, only while TwoGames+ is open on its screen showing today (the day's own page, or Home), and only from 90 minutes before you first leave, or before you're due at your first venue when the drive there isn't known yet, until you're due home. If you're late, it keeps asking until you get home, for at most 2 hours more. When your days leave out the drive home, it stops once you're free to leave your last event. Never with the app closed or in the background, and never on a day you don't drive. Turning it on asks the phone once, so that your browser, or in our Android app the phone, can ask you; where the phone is then isn't used. In our iPhone app, turning it on asks the iPhone for your permission alone, and reads nothing; if you allow it only once, the iPhone asks again the next time it's needed. The phone works out for itself whether you're at home or at one of the day's venues, from the map positions of the home you drive from and the venues, which the app already has, and sends your position nowhere to do it. So that a drop-off or a pick-up you've made isn't shown as still to do, the open page also remembers, for that day, when it saw the phone at home, at each of the day's venues and driving away from one, and, while it's asking, where the phone was over the last few minutes; it keeps none of it once the page is closed, and sends none of it anywhere. If you drive from the same address as your household and aren't its Owner, you see that address in full, and your phone gets its map position, only once the Owner confirms you live there, or at once if you were already in the household when we began keeping where people drive from. Until then, or while the map hasn't found the address you drive from, the phone can't tell when you're at home, and says so. On the Captain plan, if you agree to it in Settings on that phone, when you're somewhere the app doesn't know, such as a café or the road, TwoGames+ also times the drive from where you are: your phone sends our server its position, rounded to about 350 feet (about 100 meters), with how precise the phone says it is and when it was taken, and our server asks Azure Maps how long the drive from there to where you're going next takes with the traffic right now. You agree to that by tapping Turn on in Settings while it says so above the button, on the Captain plan, or later by tapping Also time drives from where you are there; a phone turned on any other way, such as under another plan before a move to the Captain plan, sends nothing. The phone sends it only while you're somewhere like that, with somewhere still to drive to, and, where it can't tell whether you're at home, only when you tap Refresh. Our server doesn't save the position, to our database or anywhere else, and doesn't write it to a log; it remembers, in its memory only, when it last did this for you, and doesn't ask the map again for you for about 5 minutes after that. Each copy of our server remembers only its own, and a restart, as when it's updated, forgets it, so the next time can come sooner. The drive time goes back to your phone, which keeps it in the open page's memory, for the drive it was timed for, until you're due home or the page is closed. Where you are, and every time worked out from it, is shown only on your phone: nobody else in your household sees it, and they see your day as planned. With reminders to leave on too, your next drive's reminder is set from it, on your phone alone, and keeps that time once the app closes.

Reminders on your phone, if you turn them on

We don't keep them, and nothing about them is sent anywhere. They're made only if you turn on Reminders to leave in Settings, in our Android or iPhone app, and only on that phone: the app works them out on the phone from the schedule it already has, and hands them to the phone, which shows each at its time, even with the app closed. While the app is using your location (see Your location), your next drive today is timed from where the phone is. They come before each time to leave on your schedule, whoever drives, and, if you choose, as a summary of your day in the morning, or the evening before a day that starts early, or right away if that time passed before the app could set it and the day's first event hasn't started; the app sets them up to two weeks ahead, each time it opens. Each says the event's team and place, as your household named them, when it starts and when to leave, and the name of whoever in your household drives it, or that it still needs a driver; the morning summary names who drives each event that day. We add no child's name to them. They show on your phone's lock screen, unless your phone is set to hide what notifications say there, and your phone may also show them on a watch paired with it. Turning reminders on asks your phone's permission to show notifications, which you can take back in the phone's settings at any time. A change someone else in your household makes reaches your phone's reminders the next time TwoGames+ loads your schedule on it.

What an import teaches

When you pick which venue a schedule meant, we remember that those words mean that venue, for your household only.

Schedules we read for you

For each picture or PDF our reader is asked to read: when, which member of your household asked, which model read it, how many pages it had, and how many games and recurring practices it found. Never the picture or what was on it. This is how your plan's reads are counted: a read counts only when something was read off the page.

A record of each plan bought or changed

When someone buys a paid plan, or changes one, we keep a record of what they agreed to: their email address then, the plan, its price and how often it renews, whether it was bought on our website or in our iPhone or Android app (and the app's version), when, the words they agreed to by the button they pressed (and, for a yearly plan, the box they ticked, where our app showed one), or, for a change made on Stripe's or Apple's own page, that it was made there, and the ID TwoGames+ gave the household, which the store's own record of the payment also carries. Some states' laws on plans that renew automatically ask us to be able to show that agreement, so we keep the record even after the household, or that person's account, is deleted, for as long as How long we keep it says, and use it for nothing else.

Invitations

When the household's Owner invites someone, we keep the address it was sent to, who sent it, whether it makes them an Editor or a Viewer, and a scrambled copy of the link's code, so the link can be checked without the code itself being stored. We keep them only until the invitation is used, withdrawn or expires.

A new Owner

When the household's Owner hands it to someone else, we keep, for each of the two of them, which side of it they were on, who the other person was and when, to show each of them a note about it in the app until they tap Got it.

When someone joins

When someone joins a household by an invitation, we keep when they joined, because the Owner can't remove them for 7 days after that. If they leave in those days, their place still counts toward the household's plan until the days are up. For that we keep only when the place stops counting, and nothing about who it was.

Asking the Owner who lives at home

When someone who signs in says they drive from the same address as the household, we email the household's Owner to ask whether they live there, at most once a day for each person. The email gives only that person's name and a link to the Household page: no address, and not the household's name. We keep when we last sent it, so we don't send another within a day.

A plan that ended

When a household's paid plan ends while it has more players or teams than the free plan allows, we email its Owner once, the next time anyone in the household opens TwoGames+, to say so and how to fix it. We keep when that plan ended, so we email about it once.

Your plan's emails

We email whoever pays for a paid plan: the household's Owner for a plan bought on our website, and whoever bought it for a plan bought in our iPhone or Android app. When the plan is bought or changed, we email them what it is, its price, how often it renews and how to cancel. Before a yearly plan renews we email them twice, about 35 and 25 days ahead; for a monthly plan, once a year, about 35 days before each year since it started; and for a monthly plan bought in our iPhone or Android app, after each charge, to say what was charged. Each names the household, never anyone's address. We keep which of these emails we owe and when each was sent, with the plan, price and dates it said, and nobody's address, for as long as How long we keep it says.

Emails you send us

When you write to support@twogamesplus.com or privacy@twogamesplus.com, we keep your message, your email address and our reply, to answer you and to keep a record of what was asked and answered.

Everyone in a household sees the same schedule. Its Owner and Editors change it; a Viewer changes only their own name, colour and where they drive from, and can take a game nobody is driving or give back one they drive. Each person who signs in changes their own name and colour, and nobody else can, the Owner included. Only people who sign in drive, and each of them says where they drive from: nobody else can, though the Owner can say someone doesn't live at the household's address, which takes that choice back. Only the Owner invites people, removes anyone who signs in, chooses what each of them can do, changes the household's name and home, and confirms who lives there. The Owner, and anyone the Owner confirms lives there, see the household's full address; when the Owner is asked to confirm someone, we say first that a yes shares that address with them.

Reading a picture of a schedule

When you import a schedule from a picture:

1. The picture or PDF goes from your device to our server over an encrypted connection. The server holds it in memory for that one request and never saves it: not to disk, not to file storage, not to our database.
2. The server sends it to GPT-5 mini, an OpenAI model that Microsoft runs in Azure, together with your leagues' and teams' names, levels and sports, today's date and your time zone, so the model can tell which rows are yours. Nothing else about your household goes with it: not the name of anyone in your household, your address or your email. The model does see whatever is in the picture itself, so if it shows something you'd rather not send, such as a child's full name on a registration receipt, crop it out first.
3. The model sends back the rows it read. You check them, and only what you save is stored.

We tell Azure not to store the request. At Microsoft, as Microsoft describes it:

• The picture isn't passed to OpenAI. Microsoft runs the model itself, and neither company uses the picture to train or improve AI models.
• Microsoft checks requests automatically for harmful content and signs of abuse. If a request is flagged, Microsoft may keep it so that authorized Microsoft staff can review it. That copy stays in the United States.
• The model runs only in the United States. Apart from a request Microsoft flags, as above, nothing is stored where it runs.

Microsoft does this under its Data Protection Addendum and explains it in Data, privacy, and security for Models sold by Azure. If we change which model reads pictures, this section changes before the model does.

From an import we keep the rows you save, a random ID on each saved event that says which import it came from, and the count of the read described under What we keep. The server's log notes that a picture was read, its type and size, and how many rows came back, never what was on it.

Reading a calendar link

You can also import a schedule from your team's calendar link: the link a team app gives to subscribe to its calendar, which starts with webcal:// or https://. When you do:

1. The link goes from your device to our server over an encrypted connection.
2. Our server asks the website in the link for the calendar, once, over an encrypted connection. That website gets the link, our server's internet address, and that the request comes from TwoGames+. It gets nothing about you or your household: not your name, your email address, your address or anything you've signed in with. If that website sends our server on to another website for the calendar, our server goes there, at most three times, and sends each of them no more than that. Our server reads only from public websites.
3. Our server reads the calendar's games, practices and other events itself: no AI model reads it. It holds the calendar in memory for that one request and never saves it.
4. You check the rows, and only what you save is stored, with the link itself if its box is ticked when you save.

From an import we keep the rows you save, and a random ID on each saved event that says which import it came from. We keep the link if its box is ticked when you save: Keep this calendar up to date on the Starter and Captain plans, and Keep this calendar's link on Rookie. That box starts ticked for teams that have no calendar link yet, and empty where one would be replaced, and you can change it before you save. Then we keep it with the teams it fills, what the calendar calls each of them, when it was kept, and the day and start time of each of their events on your schedule that it lists. We never show it again, to you or anyone in your household, in the app or in a copy of your data, and we never send it back to anyone's device, since it can work as a key to your team's calendar. It's deleted at once when you remove it on Teams, when the last team it fills is removed, or when the household is reset or deleted, and it's gone from our backups within 7 days, with what we note of its reads. Reading a calendar link isn't one of your plan's schedule reads. It isn't counted, and unlike a picture, we keep no note that it was read, apart from the server's log and, for a link you keep, what we note of its reads (below). The server's log notes that a calendar link was read, the website it was on (such as calendar.example.org), how big the calendar was, and how many events and rows it had, or why it couldn't be read, such as the website not answering; never the rest of the link or what was in the calendar. When you keep a link, the log notes that, with the link's ID, the website it's on and how many teams it fills. When a kept link is read again, it notes the link's ID, the website it's on, how big the calendar was, how many events and rows it had and whether it changed, or why it couldn't be read. When someone marks it reviewed or adds a team to it, or the app notes which events on your schedule it lists, it notes its ID and how many teams it fills, and when you remove one, its ID. Never the link.

On the Starter and Captain plans, our server reads a link you kept again, to see if the calendar changed. It does that when the Owner or an Editor of your household opens the app, or comes back to it after 15 minutes or more: at most once every 3 hours for each link, or every 15 minutes while a change waits to be reviewed or after a read that failed. And it does it at once when one of them taps Read again, Review or Add a team. It reads the calendar as in steps 2 and 3 above, and sends its events to the device that asked, which compares them with your schedule and says what changed. Nothing on your schedule changes until someone reviews it and saves. For each kept link, we note when it was last read and last tried, why the last try failed (such as the website not answering), how many teams the calendar names, and two fingerprints of the calendar: as it was last read and as it was last reviewed. A fingerprint is a short code worked out from the calendar's events. It tells us whether the calendar changed, and the events can't be read back from it. For each of your teams a kept link fills, we also note the day and start time of each of the team's events on your schedule that the calendar lists, as they were the last time someone reviewed it or the app found nothing in it to review, so the app can tell you when the calendar takes one off, and since when the calendar hasn't named the team, if it stops. We keep nothing else about the calendar or what changed. On the Rookie plan, a kept link isn't read again.

The website a calendar link is on is run by whoever runs your team's app or calendar, under its own terms and privacy policy.

Who else handles your data

Microsoft, Supabase, Google when you sign in with it or buy a plan in our Android app, Apple when you sign in with it or buy a plan in our iPhone app, Stripe when you pay for a plan on our website, and Cloudflare when you email us or ask for a sign-in code; the maps app you choose, such as Google Maps, Apple Maps or Waze, when you open Directions or a venue's map; and the website a calendar link is on, when you import from one or a link you kept is read again (see below):

Microsoft Azure

Runs our server and database in its East US 2 region, in Virginia, and serves the website.

Azure Communication Services

Sends the emails we send you — an invitation to join a household, the code you type when you sign in, when a household gets a new Owner, a note to the new Owner and the one before them, and, to a household's Owner, a request to confirm that someone lives at the household's address — with no open or click tracking. It also sends a note when something changes for you: when the Owner changes your role, removes you from the household, deletes it, or says you don't live at its address; when you delete your account, to say it's done; to the Owner, when a paid plan ends while the household has more than the free plan allows; and, to whoever pays for a plan, when it's bought or changed, before it renews, and after each monthly charge of a plan bought in our apps. Those come from an address that doesn't take replies, and each says where to write instead. Its data stays in the United States.

Azure OpenAI in Microsoft Foundry

Reads the pictures you import, as described above.

Azure Maps

Finds where an address is, how long the drive between two places takes, and which time zone your household's home is in, and offers places as you type a venue or a street address. We send it your household's home address, and the address of anyone in it who drives from their own, but never the apartment, suite or unit number typed in its own box; a venue's address when our own list of rinks does not know it; your household home's map coordinates, to find its time zone; pairs of map coordinates for the drives your days need, and, on a day you drive to an event while the app is open, the pairs for your next drives again, to ask how long they take with the traffic right now; and, where a venue field or a street address field offers places off the map, the words you have typed there so far, with your household home's map position, rounded to about 3 miles (about 5 kilometers) unless you can see its full address, so the places nearest you come first; and, on the Captain plan with location turned on and sending agreed to, your phone's position, rounded to about 350 feet (about 100 meters), as the start of the drive to where you're going next (see Your location). Never a person's name, a team or a game. The places and coordinates that come back are kept with your schedule only when you pick or save them, and a time zone only as your household's; the drive times are kept for the drives your days need, and of the traffic on a day you drive to an event only the latest. A drive timed from your phone's position isn't kept by us at all. We send every request to Azure Maps' address for the United States, and Microsoft says a request sent there, what's in it included, is stored only in the United States; it doesn't say for how long. Microsoft also says Azure Maps shares the addresses and places it's asked about with TomTom, which supplies its maps, without anything that links them to you. Microsoft processes these requests under the Azure terms and does not keep the addresses to build anything of its own.

Supabase

Handles signing in: it holds your sign-in account, as described under What we keep, and checks the code you type, the link you tap, or your sign-in with Google or Apple. When you delete your account, our server tells Supabase to delete your sign-in account. Before our server makes a new household for a sign-in, it asks Supabase whether that account still exists, so a phone or computer still signed in after an account was deleted gets nothing made for it. It stores the account on Amazon Web Services in the United States, in Virginia. It keeps its logs of requests to it for up to 7 days, and any backups of its database, sign-in accounts included, for up to 7 days. It does this for us under its terms, which include its Data Processing Addendum, and its privacy policy.

Google

For signing in: only if you choose "Continue with Google". You then sign in on Google's own pages: on the website and in our iPhone app, where they open in Apple's sign-in window, or on your phone's own Google sign-in screen in our Android app. Google sends Supabase, through the app on a phone, your Google account's ID, your name, your email address, a link to your profile picture and, for a work or school account, its domain, which Supabase keeps with your sign-in account. For paying: only in our Android app, and only if your household's Owner buys a plan there. Google Play takes the payment from the payment method on the Owner's Google Account, and works out sales tax; we never see the payment method or the Google Account's details. With the purchase, our app gives Google Play your household's ID, so that what Google Play tells us about it names the household it's for. To sell plans, our Android app includes Google Play's own billing code, which Google requires. It works with the Play Store app on the phone, and may send Google its own reports on how it is working, under Google's privacy policy. Our app hands our server the purchase's token, Google Play's name for the purchase, when it's made or switched to another plan, again each time the app opens until our server has it, and again if it's restored, and Google Play tells our server whenever it changes, through a service in our own Google Cloud account (Pub/Sub) that passes on the token with what changed and when, our app's name and which plan it's for, and, for a refund, Google Play's number for the order, and holds them in the United States until our server has them; our server checks that each comes from Google with the keys Google publishes. Each time, our server asks Google Play about the purchase by its token, signed in to Google as TwoGames+ without any stored password or key: which plan was bought, how often it's paid for and at what price, when it was bought, until when, whether it renews, whether a switch to another plan waits for the renewal, whether a payment failed and Google Play is trying again, whether it was refunded, and whether it was bought as a test. Our server then tells Google Play the purchase was received, as Google Play requires. It also asks Google Play about the purchase whenever your household's Owner looks at the plans in our Android app, while Google Play bills the household, to show which plans it can switch to. A plan bought through Google Play is charged to the Google Account that bought it: leaving the household or handing it over doesn't cancel it, and Google Play goes on charging that account until it's cancelled. Deleting that person's account, or the household, does: our server asks Google Play to stop it renewing. Google Play keeps its own records of the purchase, and handles refunds and cancelling under its own terms. Beyond that, our server sends Google nothing about your household; what Google Maps, or Waze, which is Google's, is given when you open Directions or a venue's map is described below. Google knows that you signed in to TwoGames+, or bought a plan in it, and handles your Google account under its own privacy policy.

Apple

For signing in: only in our iPhone app, and only if you choose "Continue with Apple". You then sign in on Apple's own screen, where you choose whether to share your name, and whether to share your email address or hide it behind a forwarding address of Apple's. Apple gives the app your Apple account's ID and that email address, and your name the first time if you share it, which Supabase keeps with your sign-in account. Emails we send to a forwarding address reach you through Apple. When you delete your account in our iPhone app, Apple asks you to confirm once more, and our server sends Apple the one-time code it gives, asking Apple to forget that you signed in to TwoGames+; nothing Apple sends back then is kept. For paying: only in our iPhone app, and only if your household's Owner buys a plan there. Apple takes the payment from the payment method on the Owner's Apple Account, and works out sales tax; we never see the payment method or the Apple Account's details. With the purchase, our app gives Apple your household's ID, so that what Apple tells us about it names the household it's for. Our app hands our server what Apple signed about the purchase when it's made, again when the app next opens if our server didn't have it, and again if it's restored, and Apple tells our server itself whenever it changes. Between them, they say which plan was bought, how often it's paid for and at what price, when it was bought, until when, whether it renews, and as which plan and at what price, whether a payment failed and Apple is trying again, and whether Apple refunded it, each signed by Apple; to check a signature, our server asks Apple only whether Apple's own certificates are still good. A plan bought through Apple stays with the Apple Account that bought it: deleting your account or the household, leaving the household or handing it over doesn't cancel it, and Apple goes on charging that account until it's cancelled with Apple. Our app says so before the person paying does any of those, and before anyone deletes the household; if someone else deletes it, the email a deleted household sends tells the person paying too. Apple keeps its own records of the purchase, and handles refunds and cancelling under its own terms. Our server sends Apple nothing about your household. Apple knows that you signed in to TwoGames+, or bought a plan in it, and handles your Apple Account under its own privacy policy.

Stripe

Takes payments for paid plans bought on our website, on its own checkout and billing pages. When the household's Owner buys a plan we send Stripe the household's ID and the Owner's email address; on Stripe's pages the Owner gives the card, the name on it and the billing address, or pays with an Apple Pay or Google Pay wallet, which passes Stripe the payment and billing details saved in it. Stripe needs these to take the payment and work out sales tax. Card details never reach us. When the household is handed to a new Owner, we send Stripe the new Owner's email address, and Stripe's billing emails and receipts go to them from then on; the payment method on file stays as it is until they change it. If Stripe doesn't get the address then, we send it again the next time the new Owner opens the app or Manage billing. In Manage billing the new Owner can also see the payment method on file, though never a full card number, and past invoices, with the billing name and address on them. When an Owner hands the household over as they delete their account, we also tell Stripe to stop renewing the plan and to remove the payment methods on file, so the card is never charged again; the plan stays until the end of the period paid for, unless the new Owner chooses a plan. Stripe keeps the payment records, and emails receipts when they are switched on, and also uses payment information to prevent fraud and meet its legal duties, under its own privacy policy, in the United States. Stripe sends us back which plan was bought, how often it's paid for, at what price and since when, until when, and whether it renews or a payment failed. The plans and how paying works are in the terms.

Cloudflare

Runs our domain's DNS, and passes emails you send to our addresses on to our mailbox, which Microsoft 365 keeps in the United States. For each email it passes on, Cloudflare keeps a record of who sent it, the address it was sent to, its subject, its message ID, its spam-check results, when it came and whether it was delivered, for 31 days, and says it doesn't store or read the email itself. When you ask for a sign-in code, Cloudflare's Turnstile first checks that a person, not a program, is asking. It sees your IP address, details about your browser and its connection, and that the check is for TwoGames+. Before Supabase sends the code, it checks Turnstile's answer with Cloudflare, sending your IP address with it. Cloudflare says it uses these details to tell people from programs, and to get better at that, not to identify, profile or target anyone, under its Turnstile privacy addendum.

Directions, and a venue's link to the map, open the maps app you choose: Google Maps, Apple Maps or Waze, or, in our Android app, another maps app on your phone. Google Maps and Apple Maps are then given the venue, or both ends of the drive: a home, when a drive starts or ends at one. Waze, and any other maps app, is given only the venue, or where the drive goes, which is a home only on the drive back to it. A home is given only where you may see its address, or your phone has its map position: a drive from any other home opens with only its end, and a drive to one offers no directions. That goes from your device when you tap, never from our server, and those companies handle it under their own privacy policies.

When you import from a team's calendar link, or a link you kept is read again, our server asks the website in the link for the calendar, as Reading a calendar link says. That website gets the link, our server's internet address and that the request comes from TwoGames+, and nothing about you or your household, and handles the request under its own terms and privacy policy.

We don't sell or rent your data, share it with advertisers, or use it for anything but running TwoGames+. Apart from the services above, we give your data to anyone else only when the law requires it, such as a court order; to the police, in an emergency where someone could be killed or badly hurt; or when it's needed to stop abuse of TwoGames+; and then only what's needed. If something goes wrong, such as someone getting at our data, our lawyers, our insurer and the security experts helping us may see what they need to deal with it, and must keep it confidential. If TwoGames+ passes to another company, your data goes with it, still under this notice, and we'll tell you before it does.

How it's protected

• Your connection to TwoGames+ is encrypted, and so are our server's connections to the database and to the services it uses. The database is encrypted where it is stored.
• Our server signs in to the database, email and AI services as itself, through Microsoft Entra, never with a password or a stored key. The keys it does hold are Stripe's, limited to what paying for a plan needs; one that proves a request to send a sign-in email came from Supabase; Supabase's own key, which our server uses only to delete a sign-in account when you delete your account and to check that an account still exists; and a key from Apple, which our server uses only to ask Apple to forget a sign-in with Apple when its account is deleted; all kept in Azure Key Vault.
• The database isn't open to the internet. It accepts connections only from our server's private network and from our own maintenance access.
• Every request is answered for one household, and the database itself refuses rows that belong to any other, as a second wall behind the app's own checks.
• The people who run TwoGames+ can reach the database to operate and repair it. We look at a household's data only to run and repair TwoGames+, to answer a request from that household, to stop abuse, or when the law requires it.
• No way of storing or sending data is perfectly secure, so we can't promise that nobody who shouldn't will ever reach it. If someone who shouldn't gets at your household's data, we'll tell you as soon as we can, whether or not the law requires it, and tell the authorities where it does.

Your browser

• TwoGames+'s app, website and server set no cookies. The companies below can, when you use them.
• Once you sign in, this browser's storage keeps your session: the tokens that show it's you, with your email address and name. Closing the browser doesn't remove it; signing out does. While you're signing in, a random one-time value is kept there too, and signing out removes that as well.
• When you start signing in, this browser's storage keeps the page you were going to, such as an invitation, so that you arrive there whether you finish in that tab or with the link in the sign-in email, and then forgets it. If you don't finish, it isn't used after 30 minutes, and it's deleted the first time TwoGames+ opens in this browser after that. Signing out deletes it too.
• If you turn on location, this browser keeps that it's on, and whether you agreed to your position being sent to time a drive from where you are, for this phone only, until you turn it off in Settings or you're signed out on it, whether you sign out or your session ends. Your browser, or in our Android and iPhone apps the phone itself, asks your permission before TwoGames+ can read where the phone is, and you can take it back in its settings at any time. The phone's position is held only in the open page's memory, never in the browser's storage.
• If you choose a maps app for Directions and a venue's map, this browser, or our app on your phone, keeps which one, or that you'd rather be asked each time, until you change it in Settings or you're signed out on it, whether you sign out or your session ends. To list the maps apps on your phone, our Android and iPhone apps ask the phone which ones it has; the answer is held only in the open app's memory, and is never stored or sent anywhere.
• In our Android and iPhone apps, once you turn on reminders to leave or answer the offer to, the app keeps on that phone whether they're on, how early they come, when the morning summary comes or that it's off, and whether you've answered that offer, until you're signed out on it. So that none comes twice, it also keeps which reminders it has set and the time each was set for, a number and a time with nothing they say. It drops each the first time the app opens a day after that time, and turning reminders off or signing out clears them all. The phone's own notifications keep each reminder still to come, with its words, its time and the day and event a tap opens, until it shows; then until you open or dismiss it, or until TwoGames+ is next open after its event has started, which clears it. Turning reminders off or signing out takes them all off the phone, those already showing too; if your session ends some other way, that happens the next time TwoGames+ opens.
• Stripe's checkout and billing pages, which the household's Owner goes to to pay, set cookies of their own.
• On the website, if you sign in with Google, the page sends you to Supabase, our sign-in service, which sends you on to Google's own sign-in pages and brings you back. Supabase answers at our web address, auth.twogamesplus.com, so on the way its network stores a cookie under that address, though we don't set it or read it. The cookie helps tell people from automated traffic, and it expires 30 minutes after you last pass through. Cloudflare, which runs that network, says the cookie isn't used to follow anyone from site to site. Google's pages set cookies of their own.
• In our Android and iPhone apps, signing in with Google or Apple happens on your phone's own sign-in screens, never in the app's pages, and Supabase's network stores no cookie. On an iPhone, Google's pages open in Apple's sign-in window, which shares Safari's cookies, so Google's cookies there are kept in Safari.
• When you ask for a sign-in code, and not before, the page loads Cloudflare's Turnstile to check that a person is asking, as described under Who else handles your data. It runs in a small frame of Cloudflare's own, which may keep cookies and browser storage of its own for the check. Most people never see it; when it isn't sure, it shows a box to tick.
• The demo, which has no account, keeps your changes in this browser's storage and nowhere else.
• TwoGames+ uses no advertising or tracking cookies. Apart from Cloudflare's check when you ask for a sign-in code, above, the site loads nothing from anyone else: no scripts, fonts or images. To sign you in, the page sends your email address, and then the code or the link, to Supabase, or, in our apps, what Google or Apple gave the phone, and Supabase sees your IP address as any site you visit does.
• We don't track you across other sites, so a browser's Do Not Track setting changes nothing here.
• No other company collects information through TwoGames+ about what you do over time and across other sites, except Stripe on its checkout and billing pages and Google on its sign-in pages, under their own privacy policies. Cloudflare's check when you ask for a sign-in code also runs on other sites, and Cloudflare says it uses what it sees only to tell people from programs, and to get better at that, never to identify, profile or target anyone.

How long we keep it

Your household, its schedule and your account details

Until the household's Owner deletes the household, you delete your account (your own details, and the household too if you're the only one in it), or you ask us to delete them.

Your sign-in account

At Supabase until you delete your account in the app, or ask us to delete it. A browser's IP address and type are kept until you sign out on it, or the account is deleted. Supabase keeps its logs, and any backups, for up to 7 days, so a deleted account is gone from them within about a week.

Invitations

Until the invitation is used or withdrawn, or the household is deleted. An unused invitation stops working 7 days after it was sent, and is then deleted automatically.

A note about a new Owner

Until you tap Got it, the household is handed over again, you leave it or are removed, you delete your account, or it is deleted. When the one who handed it to you has since left, or deleted their account, your note no longer names them.

When someone joined

While they're in the household. The time a place stops counting after someone left is deleted the first time anyone in the household opens TwoGames+ after it, or with the household.

Where someone drives from

Their answer, and whether the Owner confirmed it: until they choose again, leave the household or are removed from it, delete their account, or the household is deleted. A choice of the household's address also ends when its Owner says they don't live there. An address of their own is replaced when they change it, and deleted when they choose the household's address instead. When we last emailed the Owner about someone: as long as that person is in the household.

A plan that ended

Until the household's next plan ends, or the household is deleted.

Pictures you import

Not kept (see Reading a picture).

Calendar links you import from

Not kept, unless you keep it as you save (see Reading a calendar link). One you keep, with what we note of its reads: until you remove it, its last team is removed, or the household is reset or deleted, when it's deleted at once, and from our backups within 7 days. What we note of one of its teams goes with that team, the same way. The website a link was on stays in our server logs for their 30 days.

Your location

Not kept (see Your location). All our server holds is, in its memory, when it last timed a drive from your position for you.

Reminders on your phone

Not kept by us (see Reminders on your phone). On your phone, as Your browser says.

Payments

Stripe keeps payment records for as long as the law requires, even after a household is deleted. We keep the Stripe IDs only as long as the household, and in our server logs for their 30 days. Apple keeps its own records of a plan bought through it, under its own terms. We keep Apple's ID for the subscription only as long as the household, and who bought it only as long as their account too: once that's deleted, the household knows only that someone who has left bought it. We keep Apple's ID for each notice it sends us about it in our server logs for their 30 days. Google Play keeps its own records of a plan bought through it, under its own terms. We keep Google Play's token for the purchase only as long as the household, and who bought it only as long as their account too: once that's deleted, the household knows only that someone who has left bought it. Our server logs name the household a notice from Google Play was about, never the token, for their 30 days. A notice our server hasn't taken yet waits in our Google Cloud account for at most 7 days.

A record of each plan bought or changed

3 years after the end of the time last paid for under the plan it's about, then deleted automatically, even when the household, or the account of the person who agreed, was deleted before then. For a plan bought in our iPhone app that Apple goes on charging after the household is deleted, the 3 years run from the last end Apple tells us of.

Your plan's emails

Which we owe and when each was sent: as long as the household, and at most 400 days after an email was sent. One we couldn't send is dropped after 14 days.

Server logs

30 days. For each request to our server they record when it came, what it asked for and the IP address it came from, never the contents of what was sent or answered, apart from what Reading a picture and Reading a calendar link say the log notes. We keep some other logs for troubleshooting for the same 30 days, such as how many emails went out, never who they went to or what they said. These logs can hold the IDs TwoGames+ gives a household and what's in it, like a person, a team, a place, an invitation or a kept calendar link, Stripe's IDs for a payment, Apple's ID for a notice about one, and the website a calendar link you import from was on, such as calendar.example.org. Next to an ID they say what happened, like which plan a household moved to and when it renews. We use them to find what went wrong. We don't put names, email addresses or street addresses in them.

Daily totals

No end date. For troubleshooting, we also keep a total for each day across all households, such as how many households, people who sign in and schedule reads there were. They name no one.

Database backups

7 days, so anything deleted is gone from the backups within about a week.

Cloudflare's check when you ask for a sign-in code

Cloudflare keeps what its check sees under its Turnstile privacy addendum, which doesn't say for how long. We never receive any of it: only the check's answer, which Supabase uses once.

Emails you send us

In our mailbox, for as long as we need them to answer you and to keep a record of what was asked and answered. No period is set, and nothing deletes them automatically. Cloudflare, which passes them on, keeps its record of each one (who sent it, the address it was sent to, its subject, its message ID, its spam-check results, when it came and whether it was delivered) for 31 days.

Seeing, changing and deleting it

• Most of what we hold is on your household's pages in the app, and much of it can be changed there. For anything you can't change yourself, email us and we'll change it.
• Anyone but the Owner can leave a household whenever they like. The Owner can remove anyone else, but not in their first 7 days after joining. While others are in it, the Owner can leave, or join another household, only after handing it to one of them, who becomes its Owner. Leaving or being removed takes a person off that household's schedule, and deletes the address they drive from there; neither deletes their account.
• A household is never left with nobody in it. The last person in a household can't leave it, and can join another only once it has no people or teams left in it: they delete it, or empty it, first. So we never keep a household that no member can see or delete.
• The Owner can delete the household from its Household page at any time. It's deleted at once, for everyone in it: its schedule, home addresses, people's names, teams and their calendar links, venues and decisions, any invitations, and every member's name and email address. The record of each plan bought or changed for it stays, as How long we keep it says. A plan paid for on our website is cancelled first, and its customer record at Stripe deleted, apart from the payment records Stripe must keep. A plan bought in our iPhone app isn't: only the Apple Account that bought it can cancel it, in the iPhone's Settings, and Apple goes on charging it until it does. The app says so first, and so does the email the person paying gets, if they're someone else in the household. A plan bought in our Android app is cancelled first too: our server asks Google Play to stop it renewing, and the email a deleted household sends tells the person who paid for it, if they're someone else in the household. Its IDs stay in our server logs until those logs are deleted, within 30 days, and its own ID stays in the record of each plan bought for it. Deleting a household deletes nobody's sign-in account: everyone in it can sign in again, to an empty household of their own, or delete their account as below.
• You can delete your account at any time, in the app: Delete my account, in the menu under your initials or at the bottom of the Household page. Our website's Delete your account page shows how. It's deleted at once, and can't be undone: your sign-in account at Supabase, and your name, email address and role in your household, with your place on its list of people and the address you drive from. If you sign in with Apple, our iPhone app first has Apple ask you to confirm, and nothing is deleted until you do; our server then asks Apple to forget that you signed in to TwoGames+. Deleting on the website or in our Android app can't reach Apple, so the page there tells you how to remove TwoGames+ from your Apple Account in your iPhone's settings. If you're the only one in your household, the household goes too, with everything in it, as when its Owner deletes it, and a plan paid for on our website is cancelled first. If you share it and aren't its Owner, you leave it, and the others keep it; in your first 7 days after joining, your place still counts toward its plan until then, as when you leave. If you're its Owner, you first choose: give it to one of the others, who becomes its Owner, or delete it for everyone. If you give it away while it pays for a plan on our website, the plan stops renewing and its payment methods are removed, as described under Stripe above. A plan you bought in our iPhone app goes on until you cancel it with Apple, as described under Apple above, and the app says so before you delete your account. A plan you bought in our Android app is cancelled as your account is deleted, whatever becomes of the household: our server asks Google Play to stop it renewing, as described under Google above. So is one anyone else in the household bought there, when the household is deleted with your account. We email you once to say it's done. When you give the household to someone, we email them, and when you delete it for everyone, everyone else in it gets the email a deleted household sends. We read those addresses just before the deletion, and keep them nowhere after. A phone or computer still signed in to your account is signed out the next time it opens TwoGames+. Some records stay for a while, as How long we keep it says: payment records at Stripe, Apple or Google Play, the record of each plan you bought or changed, our server logs for up to 30 days, backups for up to 7 days, and emails you've sent us.
• The Owner can also reset the household from its Household page at any time, to start the season again. It's reset at once, for everyone in it. That deletes every game, practice and other event, and every skip, driver and timing set for them; the leagues and teams, the ranking of which come first, and the calendar links kept for them; the people added who don't sign in; the venues, apart from anyone's home, with the drive times measured to them and what an import taught us about them; and the timing settings, which go back to their defaults, apart from miles or kilometers. The household stays, with its name, home address and plan. So does everyone who signs in, in their role and with where they drive from. Invitations stay, and so does the record of the schedule reads already used.
• If you can't sign in, or would rather we did it, email privacy@twogamesplus.com from the address you sign in with. If you sign in with Apple and hid your email address, write from any address and tell us the forwarding address Apple gave TwoGames+ (on your iPhone: Settings, then your name, then Sign-In & Security, then Sign in with Apple); we'll write to that address, and your reply confirms it's yours. Within 30 days we'll delete your household, with its schedule, home addresses, people's names, teams and their calendar links, venues and decisions, and your sign-in account, and tell you when it's done. If you share the household, say whether you want only yourself removed or the whole household deleted. Deleting it removes it for everyone in it, so that needs its Owner to ask.
• Turn location off in Settings on the phone you turned it on, or take the permission back in the browser's settings, or in our apps the phone's, at any time: the phone stops being asked at once, and your times go back to the plan's. Signing out, or your session ending on that phone, turns it off there.
• Turn reminders to leave off in Settings on the phone you turned them on, or take back their permission in the phone's settings, at any time. Signing out turns them off there and takes every reminder off the phone; if your session ends some other way, that happens the next time TwoGames+ opens there.
• You can ask for a copy of what we hold about your household the same way. In a copy we send you, an address someone else drives from shows only its town and state, and so does the household's address, unless you're its Owner or the Owner has confirmed you live there. A calendar link you kept shows the teams it fills, the website it's on, which of their events it lists and what we note of its reads, never the link itself.
• Depending on where you live, you may have the right to see, correct, delete or get a copy of your data. Ask us the ways above, and we'll answer within 30 days. If we say no, you can appeal by replying to our answer. We answer appeals within 60 days, and if we still say no, we'll tell you how to complain to your state's attorney general.
• We don't sell personal information. If you live in Nevada, you can still tell us not to, at privacy@twogamesplus.com.

Children

Accounts are for adults: children don't use the app and shouldn't sign up. All we keep about a child is a name to label their games (a first name or nickname is enough), a colour for the screen, that they're a child, which teams they play on, and which games and practices are theirs when not the whole team's. We don't ask for a surname or a birthday, though your household's name, which starts as your last name, may show a surname, and a team's level, such as "U12", says roughly how old its players are. We don't send a child's name to the model that reads pictures, though a picture you import may show one (see Reading a picture).

Only a child's parent or guardian, or an adult they've allowed to, should add a child to a household: by adding one, you confirm that you are. If you think a child was added without that permission, or that a child has made an account, email privacy@twogamesplus.com and we'll delete it.

Changes to this notice

When what we do with your data changes, this page changes first, with a new date at the top. If a change sends your data somewhere it didn't go before, we'll also say so in the app before it takes effect. We won't use data we already hold in a new way without asking you first.

Before a phone's location is read at all, Settings on that phone says what happens to it, and nothing is asked of the phone until you tap Turn on there: that is how the app tells you. The same goes for sending its position: a phone turned on when your plan sent nothing sends nothing after your household moves to a plan that does, until Settings on that phone has said so and you tap Also time drives from where you are.

Questions: privacy@twogamesplus.com.