Legal - 02
Privacy Policy
Valid from August 9, 2026
1. Who is the controller
The data controller is Localio Labs s.r.o., Štefánikova 100, 664 53 Újezd u Brna, Czech Republic, ID: 24338770, operator of the TwoUp! app. Contact for privacy questions and GDPR requests: [email protected].
2. What data we process
Data you enter yourself
| Data | Purpose |
|---|---|
| First name only | shown in the app to other riders |
| Date of birth | age calculation and 18+ verification |
| Gender | display and matching by preferences |
| Height, occupation, languages (optional) | profile detail |
| Profile description, hashtags, “vibe” | profile detail |
| Photos of you and your bike | shown in the app |
| Motorcycle, riding style, favourite routes | matching by shared interests |
| Who you are looking for (gender, age, distance) | selecting the profiles we show you |
Device data
| Data | Purpose | Note |
|---|---|---|
| Location | finding riders nearby, hotspots, ride planning | With your consent. We never show your precise location to anyone - others only see an approximate distance. |
| Push notification identifier | delivering messages and alerts | Can be removed by turning notifications off in your system settings. |
| App version, device model, crash reports | fixing crashes and bugs |
Usage and payment data
| Data | Purpose |
|---|---|
| Rides / Super Rides given, matches, chat content | core app functionality |
| Points and rewards | the rewards system |
| Subscription tier, payment history | subscription management |
What we do NOT collect: we do not scan ID documents or driving licences, we do not ask for a national ID number, we do not read your phone contacts, and we never process your card number - payment happens entirely inside the app store, and we never see card details.
3. Special categories of data
Two things in the app fall into a special (more sensitive) category and are processed only with your explicit consent:
Who you are looking for may reveal sexual orientation. It is used solely to select the profiles we show you and is never shown to other users.
The selfie taken during profile verification is biometric data. Verification is optional - you can use the app without it, you just won't get the green badge. How it works: you take a selfie, the system automatically compares whether it is the same person as in your profile photo, and the result is only yes/no. The comparison is performed by Amazon Rekognition (Amazon Web Services). Verification images are never visible to other users and are deleted after evaluation; we keep no biometric template from the comparison.
4. Why we process it and on what legal basis
| Purpose | Legal basis |
|---|---|
| Running the app, matching, chat | performance of a contract |
| Subscriptions and payment event records | performance of a contract |
| Location | consent (revocable any time in system settings) |
| Face verification, who you are looking for | explicit consent |
| Photo screening, handling reports, blocking | legitimate interest - user safety |
| 18+ age verification | legal obligation and legitimate interest |
| Crash and error reporting | legitimate interest - app functionality |
5. Automated processing
Photo screening. Every uploaded photo goes through an automated check for inappropriate content (Google Cloud Vision). If the check flags the content, or if it cannot be performed, the photo is not published. You can request a human review at [email protected].
Face verification - see section 3. Here too you can request a human review.
Profile recommendations are not decisions with legal effect - they only order who you see first, based on distance, bike and shared interests.
6. Who we share data with
We do not sell your data. We share it only with processors acting on our instructions:
| Processor | Purpose | Data location |
|---|---|---|
| Google (Firebase) | authentication, database, photos, notifications, crash reporting | EU (europe-west1, Belgium) |
| Google Cloud Vision | automated photo content screening | EU |
| Amazon Web Services (Rekognition) | face comparison for profile verification | EU (eu-central-1, Frankfurt) |
| Google Play / RevenueCat | subscription processing & entitlement tracking (Android) | EU / USA |
| Apple | Sign-In, App Store payments, APNs notifications (iOS) | USA / global |
| Resend | transactional email delivery (Founder codes, notices, form messages) | EU (Ireland) |
| Cloudflare | web hosting, security and bot protection for forms (Turnstile) | global network |
| Google Analytics | website traffic measurement - only with your consent in the cookie banner | EU / USA |
For transfers outside the EU we rely on the EU-U.S. Data Privacy Framework and the European Commission's Standard Contractual Clauses.
7. How long we keep data
For as long as you have an account. After account deletion, your profile and photos are removed from production systems within 30 days and from backups within 90 days; payment records must be kept for the statutory accounting period. Face verification images are deleted immediately after evaluation. User reports are retained after account deletion so that a removed user cannot immediately return - only to the extent necessary to protect other users.
8. Your rights
You have the right of access, rectification, erasure, restriction of processing, portability, and the right to object. You can withdraw consent at any time - for location by turning it off in system settings; for face verification and for who you are looking for, by request at [email protected]. Withdrawal does not affect processing carried out beforehand.
You can delete your account inside the app: ☰ → Settings → Delete account.
You may lodge a complaint with the Czech Data Protection Authority (uoou.cz) or your local supervisory authority.
9. Age limit
The app is for people aged 18 and over only. We check date of birth at sign-up. If we find an account belonging to a minor, we remove it.
10. Security
Access to data is restricted by server-side rules, not just in the app. More sensitive content is protected more strictly - chat photos are visible only to the participants of that conversation, and verification images are visible to no user. Contact details and links in profiles are blocked to protect you from scammers.
11. Changes
We will inform you about material changes to this policy in the app or by email - not by silently editing the text on the website.
Contact
Localio Labs s.r.o., Štefánikova 100, 664 53 Újezd u Brna, Czech Republic, EU · ID: 24338770 · VAT: CZ24338770 · [email protected]