Privacy Policy

Last Updated: 27 October 2026

Summary

TwinHop works on your computer: the content of your phone, your backups and your Apple Account password never reach us. We process only what we need to sell you a license, keep TwinHop working and answer your questions: your email, purchase and license data, technical data about how the Software works, basic website logs, and the messages and logs you choose to send to our support team. Our support team prepares replies with the help of an AI model (Section 2.2(c)). We do not sell your data. The Website uses Google Analytics and Google Ads to measure visits and our advertising: in the European Economic Area, the United Kingdom and Switzerland only if you accept their cookies, elsewhere unless you opt out (Section 7). You can turn off usage statistics at any time in Settings → “Share transfer statistics” and contact us at privacy@twinhop.com to exercise your rights.

1. Introduction

We are UNICGLOBAL ENGINEERING LTD, a company registered in the Republic of Cyprus, registration number HE 359668, registered office at Irodi Attikou 8A, Lakatamia, 2332 Nicosia, Cyprus (“Company” or “We”). In this Privacy Policy, we describe how we collect and process your personal data.

This Privacy Policy applies to the TwinHop software for macOS and Windows, its updates and associated services (collectively, the “Software”), and to the website twinhop.com (the “Website”). We are the controller of your personal data processed in connection with the Software and the Website.

This Privacy Policy operates alongside and is supplemented by our End User License Agreement (“EULA”). Capitalised terms not defined in this Privacy Policy have the meanings given to them in the EULA.

2. What Personal Data Do We Process?

2.1. The Software is designed so that the content of your devices does not reach us. Backups, photos, messages, contacts and app data are stored and processed only on your computer, and we never receive them. The list of your apps also stays on your computer, unless you choose to send us the Software’s logs, which contain app names (see Section 2.2(d)). Your Apple Account password and verification codes, together with an identifier of your computer required by Apple, are sent directly to Apple and are never sent to us. If the Software remembers your Apple Account password so that you do not have to enter it again, the password is stored only on your computer and only in encrypted form: on a Mac in the macOS Keychain, on Windows in an encrypted file protected by Windows Data Protection (DPAPI) for your Windows user account. It is never sent to our servers. We process only the limited personal data described below.

For reviewers: new on 21 October 2026. The previous text said that the list of apps never reaches us; this was not accurate, because logs that the user decides to send contain app names (Section 2.2(d)). Also added how the Software stores the Apple Account password on the computer. Please confirm the wording.

2.2. Data You Provide to Us

(a) Contact Information. Your email address, which you provide at checkout and which we use to send you the License Key and messages about your purchase, and, if you have agreed to receive them, marketing emails. You can unsubscribe from marketing emails at any time using the link in each email.

For reviewers: at present the Website has no opt-in for marketing emails and we send none. The wording is kept as you drafted it.

(b) Payment Information. When you make a purchase, your payment card details are processed by our payment provider. We do not receive or store your payment card details. From the payment provider, we receive only the payment status, the amount, the plan, the payment identifier and the email address you entered at checkout. If you came to the Website from one of our advertisements, we also keep with the payment the campaign tags and the advertising click identifier (for example, gclid from Google Ads) contained in the address of the page where you started the payment.

For reviewers: changed against your draft. We do not receive or keep the cardholder name, card type, issuing bank, country, last four digits or expiry date.

(c) Data Provided to Our Support Team. When you contact us by email or from the help window of the Software, we process your email address, your name if you give it, the contents of your message, any attachments and any other information you choose to share with us. We prepare replies with the help of an AI model: our support system writes a draft, and a member of our team reads and edits it before anything is sent to you. To write the draft, the text of your message and excerpts of the logs you sent us (see paragraph (d)) are passed to the Qwen model through the OpenRouter service. Before that, email addresses, phone numbers and License Keys in the text are replaced with placeholders, and user names in folder paths are removed. We use only model providers that, under our OpenRouter settings, do not collect the data and do not keep it after the reply is generated (data collection denied, zero data retention). When a new message arrives, our support team receives a notification in Telegram with the subject, your name, your email address and up to the first 1,000 characters of your message. Attachments, including logs, are stored for 30 days.

For reviewers: new on 21 October 2026: AI-assisted drafts (OpenRouter, Qwen, providers with data collection denied and zero data retention), Telegram notifications to the support team and the 30-day storage of attachments. Note for the record: email addresses, phone numbers (Russian and international formats), License Keys and long card-like numbers are replaced on our server before the text goes to the model (extended on 21 October 2026). Please confirm the wording and whether a separate notice or consent is needed for AI processing of support messages.

(d) Logs You Choose to Send. The Software keeps a technical log of its work on your computer. It is sent to us only if you decide so: when you tick “Attach logs” in the help window of the Software or click “Send Logs to Developers”. The logs contain the names of the apps on your iPhone, the name of your iPhone (which often includes your first name) and the paths of folders on your computer (which may include your user name), and may also contain the model and iOS version of your iPhone and the messages of errors that occurred. With the logs, the Software sends its version, platform, operating system, language and region, the place in the Software from which they were sent and, if your License Key is activated on that computer, your License Key and the identifier of the computer, so that we can link the logs to your email address. We use the logs only to answer your request and to fix errors in the Software.

For reviewers: new on 21 October 2026. Before sending logs with the button, the Software tells the user that they include app names, the iPhone’s name and folder paths. Please confirm the legal basis (performance of the contract or consent) and the wording.

2.3. Data We Collect Automatically

(a) License Data. Your License Key, the plan, amount and date of purchase, the record of your acceptance of the EULA at checkout, and, when you activate and use the Software, a pseudonymised identifier of your computer, a pseudonymised identifier of each iPhone used with your License Key, the platform, the version of the Software and the dates of activation and license checks. When the Software checks for updates, it sends your License Key, the identifier of your computer, the platform and the version of the Software, so that we can offer you the update that matches your license. If usage statistics are turned on (see paragraph (b) below), the random installation identifier is also sent with license checks, so that we can tell test runs apart from real use.

For reviewers: added against your draft: the data sent by the update check, and the installation identifier sent with license checks while usage statistics are on.

(b) Usage Data. Technical information about the use of the Software, such as the result, duration and mode of a transfer, the version of the Software and iOS, the iPhone model, the number of apps by transfer result (numbers only, without app names), the error category and a short error description cleared of personal details, and a random installation identifier. Usage data does not include the content of your devices, file names or the list of your apps. Sending usage data is enabled by default. You can turn it off at any time in the Software under Settings → “Share transfer statistics”. Once it is turned off, the Software stops sending usage data, including the installation identifier.

If you downloaded the Software through a link with campaign tags or an advertising click identifier (such as utm parameters or gclid), the Software reads them from the download, keeps them on your computer and sends them to us in two cases: with the report the Software sends when it starts, if usage statistics are turned on, and in the address of the purchase page when you open it from the Software. This tells us which advertising led to the installation and to the purchase.

For reviewers: new on 21 October 2026: campaign tags and the advertising click identifier read by the Software from the download. Please confirm the wording and that legitimate interest is a sufficient basis while usage statistics are on.

(c) Website Data. When you visit the Website, our server records your IP address, browser type, requested page and time of request. When you download the Software, we also record the address of the page you came from (the referrer) and the campaign and referral tags contained in the download link, such as utm or ref parameters, or the advertising click identifier (gclid). We use this data for security, abuse prevention and troubleshooting, including counting recent requests from the same IP address to prevent automated abuse of the purchase and email forms, and to count downloads by source. We count visits without cookies and without storing IP addresses: the page tells our server only which page was opened, its language, the website or campaign tag you came from and whether you use a phone or a computer, and we keep only daily totals.

(d) Cookies and Similar Technologies. The Website uses a cookie that stores your language preference, a technical cookie that links your browser to the payment you started, a cookie that stores your cookie choice, the browser’s session storage on the page shown after payment and, depending on your choice, cookies of Google Analytics and Google Ads. See Section 7 (Cookies).

(e) Google Analytics and Google Ads. The pages of the Website load the Google tag. It sends information about your visit to Google Analytics and Google Ads: the pages you open, the website or advertisement you came from (including the advertising click identifier, such as gclid), the type of device and browser, the language, the approximate location that Google derives from your IP address (Google Analytics does not store IP addresses), and three actions: a click on a download button (with the operating system you chose), the start of a payment (with the plan and price) and a completed purchase (with the plan, amount, currency and payment number). We never send Google your email address, name, License Key or payment card details, and we do not use Google’s “enhanced conversions”, which would send your email address in hashed form. We use this information to see how visitors find and use the Website and which advertising leads to downloads and purchases.

Whether Google may store cookies on your device depends on your choice and on where you are (Section 7). Until you accept, or after you refuse, the Google tag does not set or read cookies. It then sends Google only signals without cookies or other identifiers stored on your device (for example, that a page was opened or a purchase was made, the time, the browser type and your choice), which Google uses to estimate the number of visits and purchases in aggregated reports. In this case the advertising click identifier may also be kept in the address of the pages as you move around the Website.

For reviewers: paragraphs (c) and (d) and Section 7 are extended against your draft to list everything the Website actually stores and records. New on 27 October 2026: paragraph (e), Google Analytics 4 and Google Ads with Google Consent Mode v2 in “advanced” mode: the tag loads for every visitor and sends cookieless signals while consent is not given. Please confirm that advanced mode is acceptable in the EEA, the UK and Switzerland, or whether the tag must not load at all before consent (basic mode), and what legal basis applies to the cookieless signals.

3. Legal Basis

We process your personal data only to the extent necessary for the purposes described in this Privacy Policy. Our legal basis for processing depends on the type of data and the context in which we process it. We rely on:

• performance of a contract with you, to sell you the license, deliver the License Key, check the validity of your license, process refunds and provide support;
• our legal obligations, to keep records of payments for accounting and tax purposes;
• our legitimate interests, to keep the Software and the Website secure, prevent fraud and abuse, and improve the reliability of the Software based on usage data, which you can turn off at any time as described in Section 2.3(b), and, outside the European Economic Area, the United Kingdom and Switzerland, to measure visits and our advertising with Google Analytics and Google Ads, which you can refuse at any time (Section 7);
• your consent, where required by law, for example to send you marketing emails about our products and offers, which we send only if you have agreed to receive them, or, in the European Economic Area, the United Kingdom and Switzerland, before Google Analytics and Google Ads cookies are placed on your device (Section 7). You can withdraw your consent at any time without affecting the lawfulness of processing before the withdrawal.

4. Who Do We Share Your Personal Data With?

We do not sell your personal data. We may share it only with the following recipients:

• Service Providers. Third parties that help us operate the Software and the Website, such as payment providers, hosting and storage providers and email providers. They process personal data on our behalf, only on our instructions and under data processing agreements that require them to protect it. Some payment providers may also process certain data as independent controllers under their own privacy policies, for example for fraud prevention and compliance with financial regulations.
• Google. Google receives the information described in Section 2.3(e) through Google Analytics and Google Ads. If you are in the European Economic Area, the United Kingdom or Switzerland, the recipient is Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland); elsewhere it is Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). For Google Analytics, Google processes the data on our behalf. For measuring advertising in Google Ads, Google may also use it as an independent controller under its own privacy policy. In addition, when a purchase followed a click on our advertisement, we report to Google the advertising click identifier, the time and the amount of the purchase. We do not send Google your email address, name or License Key. How Google uses this data: policies.google.com/technologies/partner-sites; Google’s Privacy Policy: policies.google.com/privacy.
• AI Model Providers. To prepare draft replies to support messages (Section 2.2(c)), we send the text of your message and excerpts of your logs, with email addresses, phone numbers and License Keys replaced, to OpenRouter, which passes it to a provider hosting the Qwen model. We allow only providers that do not collect the data, do not use it for training and keep no copy of it after the reply is generated.
• Telegram. Notifications about new support messages are delivered to our support team through Telegram. A notification contains the subject, your name, your email address and up to the first 1,000 characters of your message.
• Public Authorities. Where we are required to do so by law, a court order or a lawful request.
• Protection and Security. Where necessary to protect the rights, property or safety of our users, us or others.
• Corporate Transactions. In connection with a merger, acquisition or sale of assets, as part of the transferred assets.

For reviewers: new on 21 October 2026: OpenRouter (with the model providers it routes to) and Telegram as recipients. Please check whether data processing agreements with OpenRouter and Telegram are in place or needed, and how Telegram should be described (processor or independent controller).

Anonymous information that does not allow the identification of an individual user is not personal data. We may use and disclose such information, for example aggregated statistics on the success rate of transfers, without restriction.

5. International Transfers of Personal Data

We primarily store and process personal data in the European Union. Some of our service providers may be located, or belong to groups located, outside the European Economic Area. Where personal data is transferred outside the EEA, we ensure that appropriate safeguards are in place, such as an adequacy decision of the European Commission or the Standard Contractual Clauses approved by the European Commission.

Support messages are also processed outside the EEA: OpenRouter is based in the United States, the providers that host the Qwen model may be located in other countries, and Telegram delivers notifications through its own servers. For these transfers we rely on the safeguards described above.

Google LLC, which may receive data from Google Analytics and Google Ads, is located in the United States and participates in the EU-U.S. Data Privacy Framework.

For reviewers: new on 21 October 2026. Please confirm which safeguard applies to OpenRouter (EU-U.S. Data Privacy Framework or Standard Contractual Clauses) and to Telegram, and whether the paragraph needs to name it.

6. Data Retention

We keep personal data only for as long as necessary for the purposes for which it was collected:

• Purchase and payment records are kept for as long as required by accounting and tax laws.
• If you start a payment but do not complete it, the email address you entered is deleted from the record of that payment after 90 days.
• License data is kept for the license term and for a reasonable period afterwards to handle refunds, disputes and support requests.
• Usage data, that is the events of the Software described in Section 2.3(b), is kept for 13 months and then deleted.
• Support messages are kept until our support team deletes them. Attachments, including the logs you sent us, are deleted after 30 days.
• Website logs are kept for a limited period and then deleted or anonymised.
• Google Analytics keeps the data of visits and actions on the Website for 14 months and then deletes it. Google Analytics cookies expire after 13 months, Google Ads cookies after 90 days.
• Backup copies of our database are kept for 14 days, so data deleted from the database also disappears from the backups within 14 days.

For reviewers: Section 6 is made specific on 21 October 2026: usage data 13 months, the email address in unfinished payments 90 days (the deletion is being set up now), support messages until a member of the support team deletes them (please advise whether a maximum term is required), attachments 30 days, database backups 14 days. Website logs remain without a fixed term.

7. Cookies

The Website uses two kinds of cookies and similar technologies.

Necessary. They provide the functions you request, are always on and are not used for any other purpose:

• Language cookie (th_lang). If you choose a language in the language switcher, the Website stores your choice in this cookie for one year. It contains only the language code.
• Payment cookie (am_pid). When you start a payment, the Website sets this technical cookie for two hours. It contains the identifier of the payment you started, is readable only by our server, and is used to show you your License Key when you return from the payment page and to resume the same payment instead of creating a new one.
• Cookie choice (th_consent). Stores whether you accepted or refused analytics and advertising cookies, for 12 months. After that, we ask again.
• Session storage on the page shown after payment. While your payment is being confirmed, the page refreshes itself and counts the refreshes in your browser’s session storage. After a purchase, the page also notes there that the purchase has been counted, so that it is not counted twice if you reload the page. Both notes are deleted when you close the tab.

Analytics and advertising (Google). Google Analytics and Google Ads use cookies to recognise your browser across visits and to link a purchase to the advertisement you clicked: _ga and _ga_… (Google Analytics, 13 months), _gcl_au, _gcl_aw and _gcl_gb (Google Ads, 90 days).

• In the European Economic Area, the United Kingdom and Switzerland, these cookies are placed only if you click “Accept” in the banner. If you click “Reject” or make no choice, they are not placed.
• Elsewhere, they are placed by default. You can refuse them at any time with the “Do not track me” link at the bottom of every page. If your browser sends the Global Privacy Control signal, we treat it as a refusal.

We tell which rules apply by the time zone set on your device: if it is a European time zone, or if it cannot be determined, we ask for your consent first. In addition, Google applies the rules of the European Economic Area, the United Kingdom and Switzerland to visits that it locates there by IP address.

Changing your choice. Use the “Cookie settings” link at the bottom of any page to accept or refuse at any time. Refusing stops data from being collected with cookies from then on; to delete cookies that are already stored, clear them in your browser settings. You can also block cookies in your browser or install the Google Analytics opt-out browser add-on (tools.google.com/dlpage/gaoptout).

For reviewers: Section 7 is rewritten on 27 October 2026 for Google Analytics and Google Ads. The banner has two equal buttons, “Accept” and “Reject”, and is shown when the device’s time zone is European or unknown; outside these regions tracking is on by default with a “Do not track me” link and Global Privacy Control honoured. Please confirm that this opt-out approach is sufficient for California (CCPA/CPRA: “sharing” for cross-context behavioural advertising) and other US states, and whether a “Do Not Sell or Share My Personal Information” wording is needed.

8. Data Security

We maintain appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

9. Children

The Software is not intended for children under the age of 16, and we do not knowingly collect their personal data. If you believe that we have received personal data of a child, please contact us at privacy@twinhop.com and we will delete it.

10. Your Rights

Depending on your country of residence, including if you are located in the European Economic Area, the United Kingdom or Switzerland, you may have the right to:

• access the personal data we hold about you and receive a copy of it;
• correct inaccurate or incomplete personal data;
• request deletion of your personal data;
• restrict or object to the processing of your personal data, including processing based on our legitimate interests;
• receive the personal data you provided to us in a portable format;
• withdraw your consent at any time, where processing is based on consent.

To exercise your rights, please contact us at privacy@twinhop.com from the email address you used for your purchase, so that we can verify your identity. We will respond within the time limits set by applicable law.

You also have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection in Cyprus or with the data protection authority in your country of residence. We would, however, appreciate the chance to address your concerns first.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make significant changes to how we process your personal data, we will notify you. The date of the current version is shown at the top of this Privacy Policy.

12. Contact Us

If you have any questions about this Privacy Policy or your personal data, please contact us at privacy@twinhop.com.