Your data, your business

Last updated: October 16, 2026

This policy covers the Two to Tango iPhone app and this website. The short version: the app collects nothing about you, and the website keeps only what it needs to run an optional account and answer support messages.

The app

No accounts, no tracking

The app has no sign-up and no login. It contains no analytics, no advertising and no third-party code.

What stays on your device

Your saved cards, the cards you write, your progress and your settings (including the names you enter) are stored only on your device, inside the app. We can't see them. Deleting the app deletes them.

App settings download

From time to time the app downloads a small settings file from our website, for example to update reminder texts. The request contains no personal data, no identifiers and nothing you've written or saved. Like any website, the server may briefly log technical details such as your IP address; we don't use them to identify or track you.

Notifications

If you allow it, the app schedules gentle reminders locally on your device. No push server is involved, and you can turn them off at any time in the app's Settings.

The website

Website accounts

A website account is optional and isn't needed to use the app; the two aren't connected. If you create one, we store:

Your email address, to identify your account.
Your password, only as a salted one-way hash (PBKDF2). We never store or see the password itself.
When the account was created and when the password last changed.
A sign-in session: a random token in a secure, HTTP-only cookie, valid for 30 days. We store only a hash of it. This is the only cookie the site sets, and it is strictly necessary for signing in.

You can delete your account at any time on the Account page. Deletion is immediate and removes your email, password hash and all sessions.

Support messages

If you write to us through the support form, we store your email address, the topic and your message so we can reply. We delete support messages after 12 months at the latest. The same applies if you email us at ezmeraldabenitez@icloud.com. To have a message deleted sooner, just ask.

Abuse protection

To slow down password guessing and spam, we count recent sign-in, sign-up and support attempts. These counters store only a one-way hash of your IP address or email, never the address itself, and are deleted within a day.

No analytics, no third parties

The website has no analytics, no ads, no tracking pixels and no third-party scripts or fonts. It is hosted on Cloudflare, which processes requests on our behalf to deliver the site and protect it from attacks.

Selling and sharing

We don't sell or share your data with anyone, and we don't use it for advertising.

Children

The app and website are not directed at children under 13, and we don't knowingly collect information from them.

Your rights

You can see the email on your account and delete the account yourself at any time. For any other request about your data, including access or correction, contact us through the support form or at ezmeraldabenitez@icloud.com.

Changes

If this policy changes, we'll update this page and the date at the top.