TogetherWeBePrivacy policy
TogetherWeBe is an Android app for couples, published by DeadGroup (“we”). This page explains what data we process, why, how long we keep it and the choices you have. It applies to the app and to together.deadgroup.dev.
1. A quick overview
- Shared content is available only to the two people in your couple.
- Server photos are deleted after 30 days. Long-term copies stay on your phones.
- We do not back up the database or moment photos.
- The app automatically sends technical crash reports to Google Firebase Crashlytics to help fix bugs.
- The free app may show Google AdMob ads. We do not sell data or use Google Analytics.
- You can export data, unpair and delete your account in the app.
- Data is encrypted in transit (HTTPS), but the app does not use end-to-end encryption.
2. The data we process
| Data | What it includes | How long we keep it |
|---|---|---|
| Google account | Your Google account identifier, email, name and Google profile-photo URL, received when you sign in. | Until you delete your account. |
| Profile | Your chosen name, emoji or uploaded avatar (saved as a 512 px WebP without metadata), and your private nickname for your partner, visible only to you. | Until you change it or delete your account. The previous uploaded avatar is deleted when you replace it. |
| Couple | Pairing time, relationship start date, day-count convention and the couple’s time zone. | Until either person unpairs or deletes their account; then deleted within a few minutes. |
| Moment photos | The exact original you upload and one display WebP. The original retains EXIF metadata, which may include the capture time, device model and location if recorded by your camera. The WebP has no metadata. | 30 days after sending, then deleted from the server (earlier if the couple ends). |
| Moment content | Captions, moods, sending time, sender and reactions. | Until the couple ends or you delete your account. This text is not deleted after 30 days as photos are. |
| Couple calendar | Titles, places, notes, times, reminders and surprise reveal times for events you create. | Until the event is deleted (only a dated deletion marker remains, without user text) or the couple ends. |
| Nudges | The nudge kind: heart, missing you, hug or goodnight. | Not stored; delivered immediately to your partner’s phone. |
| Devices and sign-in | A random installation ID created by the app, the platform (Android), refresh session tokens (stored as hashes, not raw tokens), and the device’s Firebase Cloud Messaging (FCM) token. | Sessions expire after 30 days without use or when you sign out; the notification token is removed on sign-out. Remaining records are deleted with your account. |
| Pairing invitation | Only a keyed hash is stored, never the original code. Each code can be used once within 15 minutes. | Expired records are kept until you delete your account. |
| Rate limits | Counters keyed by user ID to prevent excessive pairing, calendar writes and nudges. | Expire automatically within at most one day. |
| Technical logs | Method, filtered path, status, processing time and error type. No IP addresses, content, email, captions or tokens. | About 2 MB per service at most: the oldest entries are overwritten when full, and all are removed when the service container is recreated. |
| Firebase Crashlytics reports | The app automatically sends crash traces, relevant technical app state, device information, app versions and installation/diagnostic session identifiers to Google to identify crashes and freezes. We do not attach names, emails, account IDs or shared content to these reports. | Google keeps crash traces and associated identifiers for 90 days before beginning removal from its live and backup systems. These reports are not linked to your app account. |
We do not collect your contacts or access your device location. The information the advertising SDK may process is described in the Google AdMob section below. The website uses only a functional language-preference cookie, described below.
3. Date albums
Date albums store date or trip details, cover selection and photo links you both choose. Either partner can create an album once the event starts and any surprise has been revealed. Albums share moments with the memory journal without duplicating photo files. Deleting an event keeps the album and its last event details; removing a photo link or deleting an album keeps the moment.
Server album details and photo links remain until the album is deleted or the couple ends. Adding photos or changing the cover does not extend the 30-day period from when the moment was sent. After expiry, your partner can only see it if their phone already saved the photo. The app does not upload old photos again. A phone without the photo shows a placeholder, even with a connection.
When unpairing, keeping memories also keeps album organization, including empty albums, and downloaded photos in a separate archive for the former couple to read. Erasing memories removes them. A new couple cannot access the old archive through its active data. Account deletion erases data on the phone used to confirm it, but cannot erase copies your partner chose to keep.
Data export includes albums.json with album details and linked moment IDs, including retained archives. The ZIP references photo files already on your phone without duplicating them and marks missing photos. Export does not support importing or restoring data into the app. Albums provide no cloud backup.
4. Date Jar and external links
The Date Jar stores titles, categories, places, notes and links you enter manually, the creator, status, linked calendar event and completion details. Only the two active couple members can access it; both can edit and delete ideas. The app does not obtain your location automatically, look up maps or send the content to AI.
Ideas stay on the server until you delete them or the couple ends. Deleting an idea immediately removes its text, leaving a content-free deletion marker for sync. Unpairing or account deletion removes the shared jar within a few minutes. The 30-day limit applies to moment photos, not to the Date Jar.
Synced ideas are cached in app-private storage for offline reading. Data export includes the active couple’s Date Jar as it exists locally at export time. Signing out, unpairing or deleting your account removes the local jar and drafts, even if you keep photo memories; past-memory archives do not include the jar. We do not back up the jar.
Links are passed to a browser or another app only when you choose to open them. The app does not fetch links in advance or generate previews. External websites process data under their own policies.
5. What stays on your phone
- The memory journal, downloaded photos and calendar live in app-private storage. This is your long-term memory copy, because server photos are kept for only 30 days.
- The camera and QR scanning (including QR photos you choose) run on your device. Images used for scanning are not uploaded.
- Android app backup is disabled, so your data does not automatically enter a Google Drive backup. To keep a separate copy, use Export data under Me → Privacy.
- Local data is lost if you clear app data, uninstall the app or lose your phone.
6. Language preferences
The app and website support Vietnamese and English. The app follows your device language until you choose either language. Your app language is stored only on this installation, without syncing to your account. Signing out or unpairing preserves it; clearing app data, uninstalling or deleting your account resets it.
The website saves the functional cookie twb_locale only when you explicitly choose a language. It contains only vi or en, lasts for one year, and selects your preferred language when you open an unprefixed URL. A /vi or /en URL always determines that page’s language. The cookie is not used for tracking or advertising; language links still work when cookies are blocked.
When you share an invitation, the receiving app may receive the picture and a link containing your pairing code. You choose the recipient and sharing app, which handles that copy under its own policy. Only send it to the person you want to pair with. On the invitation landing page, the code follows # in the link and is read in your browser for display or copying. It is not sent to the website server, saved in cookies or browser storage, or included in the Google Play link. This page does not check invitation validity or show the inviter’s identity.
7. Why we use this data
Only to operate what you see in the app:
- sign in and maintain your session;
- pair you and show your profiles to each other;
- deliver moments, reactions, calendar events and nudges between your phones;
- send notifications and reminders;
- prevent abuse and keep the service stable.
We do not send couple content for ad targeting or sell or rent your data. Advertising uses technical information as described below. We process it based on your consent when using the app and to provide the service you request.
8. Google AdMob and advertising choices
The free app may show banners below the tab bar and labeled ads in Memories and Albums. Ads do not block sending or viewing photos; an ad space collapses when loading fails.
Google AdMob may process your IP address (which can estimate location), device information, identifiers, diagnostics and ad interactions to deliver and measure ads and prevent fraud. We do not send photos, captions, names, email addresses, calendar content or Date Jar text for ad targeting, and do not request personalized ads. The app applies under-age-of-consent treatment and a PG ad content rating limit.
The app checks privacy choices through Google UMP before loading ads. When Google requires it, you can reopen choices under Me → Privacy → Ad privacy choices. Your private couple content is not used as targeting data.
Google processes and retains data under its Privacy Policy. Deleting your TogetherWeBe account does not automatically delete data Google processes independently. This website does not embed an advertising SDK.
9. Who else processes data
- Your partner sees the profile, moments, reactions, calendar and nudges you share within your couple. No other users see your shared content.
- Google: Google sign-in and Firebase Cloud Messaging for notifications. Firebase automatically collects a Firebase installation ID and app/device version information to deliver notifications. TogetherWeBe push messages contain no names, captions or event titles.
- Firebase Crashlytics (Google): receives automatic crash reports to help us fix bugs. Its SDK also uses Firebase Installations and Firebase Sessions for installation IDs and stability metrics, including foreground-session start times and network connection type even when there is no crash. We do not add Google Analytics or user-action logs.
- Google ML Kit (on-device QR scanning) may send Google diagnostic information: device type, operating-system and app versions, a per-installation identifier and performance measurements. It does not send images or QR content.
- Cloudflare: the network in front of our server, which receives HTTPS connections and forwards them to us.
- Google Play: app distribution.
We do not share data with anyone else unless required by law.
10. Where data is stored
Data is stored and processed on a server operated by DeadGroup in Vietnam. Google and Cloudflare process their related data (sign-in, notifications and connections) on their own infrastructure, which may be outside Vietnam.
11. Security
- All connections use HTTPS. Access sessions last only 15 minutes and are renewed securely.
- Each request checks your membership in the correct couple. Photos are never publicly served.
- Refresh session tokens and invitation codes are stored only as hashes.
- TogetherWeBe does not use end-to-end encryption: the server can read content to deliver it between your phones. No system is completely secure; if an incident affects your data, we will notify you as required by law.
12. Backups and deletion
- We do not back up the database or moment photos. Deleted data cannot be recovered.
- Unpair ends the couple for both people. Shared server data (moments, photos, reactions and calendar) is deleted within a few minutes. Each person chooses to keep or erase memories on their own phone.
- Delete account removes your profile immediately, ends the couple and deletes all your server data within a few minutes. Only an anonymous record of a deletion request remains. See how to delete your account.
13. Your choices and rights
In the app, you can:
- change your name, avatar and nickname;
- export memories, albums, the calendar and the active Date Jar as a ZIP;
- unpair, sign out and delete your account.
You can also email [email protected] with questions about your data, or to request access, correction, a copy, deletion, restricted processing or withdrawal of consent. Write from the Google address you use to sign in so we can verify you. We will respond as soon as we can.
14. Age
TogetherWeBe is for people aged 13+ and is not directed at children. If the law where you live requires a parent or guardian’s consent to process personal data at your age, use the app only with that consent. If we learn an account belongs to a child under 13, we will delete it.
15. Changes and contact
When our data practices change, we update this page and the effective date at the top; important changes are highlighted there. Send any questions to [email protected].