Two Lights

Last updated 6 October 2026

Privacy

This covers Two Lights: the landing page, the waitlist, the demo, and the app couples use. It’s short because we collect very little.

Who we are

Two Lights is a small project run by two people. For anything about your data, write to hello@twolights.app.

The waitlist

When you join, we keep:

We use it to let people in a few at a time: when it’s your turn we email you a personal link, and your sky starts in the two cities you gave us: yours for you, theirs for your person when they join. We also look at which cities and distances people are joining from, and we note whether you’ve been invited and started a sky. We don’t send newsletters, and we never sell or share the list. We keep it on the basis of your consent, which you can withdraw at any time.

The list is stored with Supabase (our database provider, servers in Frankfurt, Germany) and the site is served by Vercel. Both act only on our instructions. The list can’t be read from the website; only we can see it.

We keep your entry until you’ve been invited and have decided, or until you ask us to delete it. A personal link works once, for 14 days, and only with the email you joined with. Ask and we’ll delete it within 30 days, usually much sooner.

If you start a sky

To sign in you give us an email address; we send it a code (through Resend, our email provider) and use it for nothing else. Everything you and your person leave (photos, voice notes, songs, letters, the cities you choose to share) is stored with Supabase in Frankfurt. Inside the app only the two of you can see it; no other couple and nobody on the internet can. It isn’t end-to-end encrypted, though: the two of us who run Two Lights could reach it through the database, and we only look when you ask us to fix something or delete it. It’s never shared, sold or used to train anything. We never ask for your names or your partner’s email: you invite them with a link you send yourself, and the names in the app are whatever you type in Settings.

Photos keep only what’s needed to show them: the location and other hidden details a phone adds are removed before they’re stored. There’s no live location, ever. The app remembers which things each of you has opened, so it can show what’s new.

If you turn on notifications, we keep your phone’s notification address and time zone, and each note passes through Apple’s or Google’s notification service, encrypted so they can’t read it. If you make a home-screen widget, we keep only a scrambled copy of its key. Searching for a song asks Apple’s music catalogue (or Spotify, for a pasted Spotify link) through our server, with only what you typed. The weather on each sky comes from MET Norway, asked by our server with only the city’s rough position (to about 10 km), never who you are.

Your phone keeps a copy of your sky, its photos and anything waiting to send, so it opens quickly and works with a weak connection. Signing out removes it. Song previews and covers load straight from Apple and Spotify, so they see your phone’s internet address, as any website would.

Once a week we make an encrypted backup of the database and files, kept for 90 days with GitHub, so a mistake can’t lose what you’ve left. Supabase and Vercel also keep short technical logs (addresses and times of requests) to keep the service running and safe.

To delete your sky and everything in it, write to us and we’ll do it within 30 days; its copies in backups age out within 90 days after that.

The demo

Alex and Sam are made up. Anything you make in the demo (a photo, a voice note, a letter) stays in your browser and is gone when you close the page; none of it is sent to us. Searching for a song asks Apple’s music catalogue for matches (or Spotify, if you paste a Spotify link), through our server, with only what you typed. The two skies you see on the site show the real weather in the two cities you chose, from MET Norway, asked by our server with only each city’s rough position.

Weather data from MET Norway (the Norwegian Meteorological Institute), under the CC BY 4.0 licence, drawn as rain, snow, cloud and fog on the sky.

Measuring the site and the app

On this site and in the app we use Vercel Web Analytics and Speed Insights to count visits and see how fast pages load. They set no cookies and don’t follow you across other sites; we only see totals (pages, countries, devices, where visits came from). They never see what’s inside a sky: before anything is sent, the parts of an address that could point to you (invite links, sign-in codes, which thing you opened) are removed.

Our short links (like twolights.app/s/…) count each visit: which link it was, the country, and whether it was a person or a service drawing a link preview. The landing page and the demo also count the steps of a visit: that someone came, how far down the page they scrolled, which parts of it they saw, which questions they opened, which buttons they pressed, how far they went through the demo’s guided tour, and whether they started the waitlist form. Each count says only the step, where the visit came from (a link’s word, a campaign name or the site that sent you), the country, and whether it was a phone or a computer. No address, cookie, city you typed or anything else that identifies you.

These counts, our short links’ counts and our error records (which page failed, never who was using it) are deleted after 13 months, and so is the record of which notifications were sent.

Your rights

You can ask to see what we hold about you, correct it, or delete it, by writing to hello@twolights.app. If you’re in the EU or UK and unhappy with how we handled your data, you can also complain to your local data protection authority.

Changes

If this changes in a way that matters, we’ll update the date at the top, and tell people on the waitlist before it applies to them.