Security at Twinr

Your Twinr account

Your Twinr account is where you build, publish and run your apps, so it is protected at sign-in and when you give anything else access to it.

1. 2-Step Authentication. Turn it on in My Profile and every sign-in to the Twinr Builder or the Preview App needs your password and a 6-digit code texted to your phone. Each code works for one sign-in.
2. Account deletion. Deleting your account from My Profile permanently removes your apps, configurations, build history and account data.

Encryption

Every connection to Twinr uses HTTPS, so data is encrypted between your browser, your app and Twinr. Twinr’s databases and file storage are encrypted at rest.

Payments

Payments for Twinr plans are processed by Stripe. Twinr does not collect or store your payment card details.

AI connections (MCP and Copilot)

You can connect Claude, ChatGPT, Cursor and other AI tools to your Twinr account through the Twinr MCP server. Each connection is limited to what you approve:

1. Approved by you. Connecting opens Twinr in your browser, where you sign in and approve the request. The AI tool never sees your password. Approval links work once and expire after a few minutes.
2. Your choice of access. Choose View only to let the AI tool look at your apps, builds and documentation, or View & edit apps to also let it change your app icon and launch screen and start builds.
3. Only the apps you pick. You tick the apps the connection can reach. It cannot see any other app on your account.
4. Revoke anytime. Every connection is listed in My Profile under AI connections, where you can change its apps or revoke it.

Twinr Copilot works inside your dashboard with your own account’s access. It shows you what it will do before anything goes live, and a push campaign is sent only after you approve it.

API access

Account secrets let your own server call the Twinr API. They are separate from AI connections.

1. Shown once. Twinr shows a secret in full only when you create it and stores just a hashed copy. Nobody, including Twinr support, can show it to you again.
2. Scoped and expiring. Each secret reaches only the apps you choose, and can be set to expire on a date.
3. Revocable. Revoke a secret in My Profile under Account secrets and it stops working.

Your app users’ data

When your app uses Twinr push notifications and analytics, Twinr stores the data those features need, such as push tokens, app sessions, screens visited, device type and language, and orders made in the app. Twinr uses this data only to provide those features to you.

Under the GDPR and similar privacy laws, you are the controller of your app users’ personal data and Twinr processes it on your behalf. Your own privacy policy covers how you use it.

If one of your app users asks for their data to be exported or deleted, email [email protected] and we will help.

Reporting a vulnerability

If you find a security issue in Twinr, email [email protected] with the steps to reproduce it. Please do not access other customers’ data or disrupt the service while testing, and give us reasonable time to fix the issue before you share it publicly.

Person in charge of personal information

Gaurav Parvadiya, Founder and CEO, is responsible for the protection of personal information at Twinr. Contact: [email protected].