Privacy notice

Julius Bung Tidblom, trading as Svift Design Studio, is the controller for the personal data described here. Complete identity, VAT and contact details are under Seller and contact.

Privacy requests can be sent to juliustidblom@gmail.com. We may need to verify that a request concerns your account.

• Account and authentication data, including email address and account identifiers.
• Content you choose to save, including ideas, titles, tags, groups, connections, Reflections, Guided-reflection drafts, Landscape conversations and perspectives.
• AI request and usage metadata, such as feature route, weighted credits, token counts, cost estimates, timestamps, status and cached AI output.
• Subscription and transaction data, including Stripe/Link customer, Checkout, subscription, invoice and webhook identifiers. Tvillingen does not receive your full card number.
• Your monthly or annual plan preference if you ask to join the founding waitlist.
• Purchase-contract and withdrawal evidence, including the legal-text version, confirmation timestamps, receipt delivery, your name and any optional withdrawal message.
• Technical and security data made available by service providers, such as request timestamps, IP address, browser/device information, errors and authentication events.
• Messages and contact details you provide when requesting support.

Tvillingen does not use third-party advertising trackers or product-analytics scripts. The app and its infrastructure providers still use necessary browser storage, cookies, request logs and security data to operate the service.

• Contract: create and secure your account, save and synchronise your work, provide requested AI features, manage your subscription or requested founding-waitlist place, and answer support requests.
• Legal obligation: retain and use records required for accounting, tax, consumer rights, fraud and lawful requests.
• Legitimate interests: protect accounts, prevent abuse, diagnose failures, enforce bounded usage and improve the reliability of the beta without using your idea content for advertising.
• Consent: only where a feature expressly asks for it. Consent can be withdrawn without affecting earlier lawful processing.

• Supabase provides authentication and database storage. The production database is hosted in Frankfurt, Germany.
• Vercel hosts the web app and server functions. Requests and operational logs can be processed outside the EEA, including in the United States.
• Google Gemini processes the content needed for AI requests and related technical metadata under its paid-service terms.
• Stripe and Link process billing and act as merchant of record for Managed Payments purchases, including tax, transaction emails, fraud, disputes and transaction-level support.
• Resend sends Tvillingen's purchase confirmations and withdrawal receipts and processes the recipient address and message delivery metadata needed for those emails.
• Google Gmail processes messages sent to the published support address.

Where personal data is transferred outside the EEA, the relevant provider's contractual safeguards, approved transfer mechanism or applicable adequacy decision is used as required. Provider processing is also governed by its own terms and privacy documentation.

• Anonymous browser data remains until you delete it or clear the browser storage.
• Signed-in content generally remains until you delete the item or account. Trashed Ideas, Reflections and recoverable Guided-reflection drafts are normally purged after approximately 30 days when cleanup runs.
• AI usage metadata currently remains until account deletion so monthly/daily limits, cost and abuse controls can be audited.
• A founding-waitlist preference is removed when paid access activates or the account is deleted.
• Support messages are kept while needed to resolve the request and establish what was agreed or done.
• Minimal purchase contracts, withdrawal/refund records, billing, accounting, fraud and content-free webhook evidence may remain after account deletion where applicable law or a provider obligation requires it. Accounting evidence is generally retained for up to seven years after the relevant financial year.

Account deletion removes app content controlled by Tvillingen, subject to temporary backups, deletion safeguards and records that must be retained by law. It does not delete records independently controlled by Stripe or Link.

Subject to applicable law, you may request access, correction, deletion, restriction, portability or object to processing based on legitimate interests. You can delete the account from the Account page or contact us for help. You can withdraw consent where consent is the legal basis.

You may complain to your local data-protection authority. In Sweden, this is Integritetsskyddsmyndigheten (IMY).

We use access controls, encryption in transit and provider security controls. No internet service can promise absolute security. Please contact us promptly if you suspect unauthorised access.

Tvillingen and its AI features are intended only for people aged 18 or older. We do not knowingly collect accounts from children.

Material changes to this notice will be announced in the service or by email. The version and effective date at the top identify the current notice.