Privacy Policy

Last updated: 12 July 2026

Two in the Bush is built so that we cannot read your messages, and so that there is almost nothing about you for us to hold in the first place.

The short version

• Your messages, photos, voice notes, and videos are end-to-end encrypted. Our server only ever relays sealed data it cannot open, and deletes it once it has been delivered.
• We do not use analytics, advertising, tracking, or profiling of any kind.
• We do not access your contacts, your location, or your photo library beyond the single image you choose to send.
• Your conversation history lives only on your own devices, encrypted behind a password we cannot recover.

What we collect, and why

To run the service at all, our server holds the following:

• An account identifier from Sign in with Apple. When you sign in, Apple gives us a stable, app-specific user ID so we can recognise your account on return. We request no name and no email; if Apple sends a relay email address, it is used only for account-related contact and never shared.
• A pairing record. The two public keys of a paired couple, so encrypted messages can be routed between exactly those two devices. Public keys are not secret and cannot decrypt anything on their own.
• Undelivered ciphertext, briefly. If your partner is offline, their sealed (unreadable) message waits in a queue and is deleted the moment their device confirms receipt.
• A device token for notifications. An Apple push token so we can send a content-free "new message" nudge. The notification never contains message text or sender identity.

What we do not collect

• Message, photo, voice, or video content (end-to-end encrypted - inaccessible to us).
• Your contacts or address book.
• Your location.
• Analytics, usage tracking, device fingerprinting, or advertising identifiers.
• Any data used to track you across other apps or websites.

Where your history lives

Your conversation history is stored only on your own device, encrypted with a key derived from a password you choose. We do not have that password and cannot recover it. If you forget it, that history cannot be recovered by anyone - this is intentional.

Who else is involved

We keep third parties to the minimum required to run an iPhone app:

• Apple - Sign in with Apple (authentication) and the Apple Push Notification service (delivery nudges). Apple's handling of that data is governed by Apple's own privacy policy.
• Our hosting provider (Hetzner, in Germany) - runs the server that relays sealed data. They see only encrypted traffic, never message content.

We do not sell, rent, or share your data with anyone for advertising or any other purpose.

Retention

• Undelivered messages and media: deleted immediately on delivery.
• Account identifier, pairing record, device token: kept while your account exists.
• Everything tied to your account is permanently deleted when you delete your account (below).

Your choices and rights

You can delete your account and everything associated with it directly in the app (Settings → Delete account). This erases your account, your pairing, and any queued data from our server. You may also unpair at any time, which destroys the shared conversation.

If you are in a region with data-protection rights (such as the EU/EEA under the GDPR), you have rights of access, rectification, erasure, and portability over the small amount of account data described above. Because we hold no readable content and no analytics, most of what such a request would cover simply does not exist. To exercise any right, contact us below.

Children

Two in the Bush is not intended for anyone under 17.

Changes

If this policy changes materially, we will update this page and the "last updated" date. Continued use after a change means you accept the revised policy.

Contact

Questions about privacy: support@twointhebush.app.