Privacy

Twistly is operated by [[LEGAL ENTITY NAME — NOT YET CONFIRMED]] [[COMPANY REGISTRATION NUMBER, OR SOLE TRADER — NOT YET CONFIRMED]], who is the data controller for the personal data described here. You can write to us at hello@twistly.co.uk, or by post at [[POSTAL ADDRESS FOR LEGAL AND DATA-PROTECTION CORRESPONDENCE — NOT YET CONFIRMED]].

We are based in the United Kingdom, and this policy is written against the UK General Data Protection Regulation and the Data Protection Act 2018. Our registration with the Information Commissioner’s Office is [[ICO REGISTRATION NUMBER, OR THE EXEMPTION RELIED ON — NOT YET CONFIRMED]].

Twistly is in beta. The product is changing quickly, and this page changes with it — the date at the top is the last time the text below was actually revised, not the day you happen to be reading it.

Your prompt is sent to OpenRouter, which passes it to the language model that answers — today, Google’s Gemini. Nothing that identifies you personally goes with it: no name, no email address, no account id. The model receives the words you wrote and the geography they describe, and nothing else.

We do not use your prompts or your routes to train anything. Nor does anyone we send them to: every request carries a routing rule that makes a provider ineligible to answer it unless that provider undertakes not to train on, or retain, what it is sent. It is a condition of being chosen rather than a promise added afterwards, so a provider without that undertaking is never offered the text in the first place.

• Your account. Your email address, and your name if you gave one or signed in with Google. If you set a password we store a bcrypt hash of it and never the password itself.

• The drives you ask for. The description you typed, the start and finish points, and the constraints read out of your words — distance, duration, the kind of road you asked for, places you wanted to include.

• The routes we generate. Their shape, the roads they use, their name and description, and whether you have kept them private, unlisted or public.

• What you publish. Comments and photographs you add to a route, and any rating you give one.

• Reports you send. The title and detail you wrote, plus the page you were on, the version of the site you were running and your browser’s user agent — the three things needed to reproduce a bug.

• A short list of product events. That a generation started, finished, failed or was rate-limited; that a route was exported, refined or rated; that a drive was started. Nothing about how a drive went is recorded — no pace, no timings, no completion.

• Your IP address, for rate limiting. Free generations are counted per person and, for signed-out visitors, per IP address. That address is stored against the count.

• Apps you have connected. If you connect Twistly to Claude or ChatGPT, we store which app it is and what it is allowed to do. Access tokens are stored only as SHA-256 hashes, so reading our database does not give anyone access to your garage.

• Cookies. Described in full on the cookies page.

• No timings, ever. There are no leaderboards, no road records and no “fastest” anything, in the product or in the data. Drive logs are private and produce private statistics only.

• No background location. Twistly knows where a drive starts because you told it. It does not follow you around.

• No selling your data. We do not sell your personal data, and we do not use it for advertising or profiling.

• No Google Places data. The places on your route come from OpenStreetMap.

• To give you what you asked for — your account, your routes, your garage. The lawful basis is performance of a contract with you.

• To keep the service standing up — rate limiting, blocking abuse, acting on bug reports, and understanding which parts of the product are used. The lawful basis is our legitimate interests, and we have weighed them against the fact that a prompt can reveal where you live.

• Analytics. Google Analytics, and only if you agree to it. The lawful basis is your consent: you are asked once, nothing is loaded until you answer, and you can change the answer on the cookies page at any time.

Each of these does one job, and receives only what that job needs. Two things are worth knowing before the list: the routing engine is ours — Twistly runs its own GraphHopper on its own server, so the roads you ask about are never sent to a routing company — and we take no payments, so no payment processor is involved and none holds anything of yours.

The database is on a machine we rent and administer ourselves — Hetzner, Helsinki, Finland — and so is the routing engine — Hetzner, Helsinki, Finland. The website’s server code runs on Vercel and is pinned to Vercel, Stockholm, Sweden. All three are in the EEA.

Some of the companies in the table above operate outside the UK and the EEA. Where personal data reaches them, the safeguard we rely on is [[INTERNATIONAL TRANSFER SAFEGUARD — NOT YET CONFIRMED]].

Your account, your routes and the prompts behind them are kept for as long as your account exists. Beyond that, Twistly does not currently delete anything on a schedule: the retention periods for prompts, route specifications, product events and rate-limit records are [[RETENTION PERIODS FOR PROMPTS, ROUTES AND LOGS — NOT YET DECIDED]]. Saying so is more useful to you than a period we have not built.

If you ask us to delete your account, we will remove your personal data within 30 days. Routes you made public and comments you posted may be removed at the same time; tell us if you want them left in place and disassociated from you instead.

Under UK GDPR you can ask for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use of it, and ask for it in a portable form.

Some things you can already do yourself: delete an individual route, delete a comment or a photograph you posted, change a route’s visibility, change your password, and disconnect any app you have connected, all from within the app.

If you think we have handled your data badly, you can complain to the Information Commissioner’s Office at ico.org.uk. We would rather you told us first, but you do not have to.

Twistly is a driving product and is not aimed at children. The minimum age for an account is [[MINIMUM AGE — NOT YET DECIDED]], and nothing in the product currently checks age.

The site is served over HTTPS only. Passwords are stored as bcrypt hashes. Authorisation codes and API tokens are stored as SHA-256 hashes, so they cannot be read back out of the database. The database is on our own server, reached over TLS with a publicly trusted certificate, and the application connects as a role with only the privileges it needs.

No system is perfectly safe. If something goes wrong in a way that puts your data at risk, we will tell you and the Information Commissioner’s Office as the law requires.

Map data © OpenStreetMap contributors, under the Open Database Licence. Our scored road database is derived from it and stays on our own servers. See the about page for what we do with it and the terms for what the routes we generate are.

When this policy changes we update the date at the top. If a change materially affects what happens to data we already hold, we will tell account holders by email rather than leaving it here to be found.