Privacy

This is a translation of the German original. The German version is the authoritative version. Translations may contain errors. In case of any discrepancy, the German version prevails, unless mandatory law provides otherwise. This Privacy Policy informs you in accordance with Articles 12 and 13 GDPR which personal data TWO EQUALS processes, for what purposes, on what legal basis and for how long. TWO EQUALS is a service of Ecolution GmbH for matching and documenting consensual agreements between two people. What is recorded is the consent or match in the specific matching session. We do not store medical findings — in particular HIV status, hepatitis, PrEP and test data. Use is permitted from the age of 18. The age limit is implemented through the store age rating and the date of birth you give at registration. No verification takes place. We do not use any analytics, tracking or advertising services. Version 2.3.0 · Effective October 26, 2026.

The controller within the meaning of the GDPR is: Ecolution GmbH Bellevue 35 22301 Hamburg Germany Managing Director: David Kytzia Email: info@ecolution.gmbh Phone: +49 40 – 28 00 25 55 Website: twoequals.app A data protection officer has not currently been appointed. Please send data protection enquiries to info@ecolution.gmbh.

To set up, secure and restore your account, we process: • account data and technical identifiers, in particular the account ID • email address for sign-in and recovery, and mobile number as proof at registration (kept by the sign-in service) • display name / alias (we store it with your account on our server so that it is there again after you sign in on a new device; when you delete your account, we delete it) • your actual date of birth (required at registration). We store it encrypted in the TWO EQUALS database in the EU, not with the sign-in service. With each confirmed agreement we also store it in the record of agreement (see “Matching and history”). If your date of birth shows that you are under 18, we do not store it and you cannot use TWO EQUALS. You cannot change your date of birth yourself in the app. If it is wrong, please contact support. • the age the other person sees: your actual age, no age, or a different age. You choose this for each encounter. The displayed age is your own statement and is not checked. • if you previously confirmed that you are at least 18 years old: that confirmation with timestamp (it remains stored) • the versions of the Terms of Use and consents you have agreed to, with timestamp • your decision on consent to the processing of your personal details (granted, declined or withdrawn) with version and time; we also record every change in a log so that we can prove the consent • support data, if you contact us Your mobile number and email address remain with the sign-in service. In the TWO EQUALS database we store your account ID for this. When you confirm an agreement, we additionally store your verified mobile number and email address in encrypted form with the record of agreement (see "Linking records of agreement"). Before deleting your account, you can have your account ID and recovery key sent to your verified email address (Amazon SES, EU). We do not store the recovery key in plain text. Legal basis: Art. 6(1)(b) GDPR (contract for the use of TWO EQUALS) and Art. 6(1)(f) GDPR for account security and for evidencing the age statement, the age confirmation and your consents. We store the proof of your consent because, under Art. 7(1) GDPR, we must be able to demonstrate that you consented (Art. 6(1)(c) GDPR). Taking over a number. If a mobile number that still belongs to another account with us was newly assigned to you, you can take it over in the app with an SMS code. The number is then removed from the other account and assigned to your account; we notify the person of the other account by email without naming the number. We log the process without the number; to prevent abuse, we store a check value (HMAC) of the number for 40 days. Legal basis: Art. 6(1)(b) GDPR (operating your account) and Art. 6(1)(f) GDPR (security and prevention of abuse). We keep this log for as long as the log of device binding.

For matching and traceable documentation, we process: • your presets (wishes and boundaries, including self-written boundaries) • specific consent decisions and preferences (yes/no match), including agreements on sexual acts, protection, boundaries, media and duration • your statement for the respective encounter on whether alcohol or other intoxicating substances are involved. This statement may constitute health data within the meaning of Art. 9 GDPR. It is not added to your permanent profile, is visible to the other person and is kept with the record of agreement. We do not infer from it whether anyone can validly consent. • both people's confirmation that no payment or other consideration has been agreed • your actual date of birth at the time of confirmation. It is also stored in the record of agreement, is not visible to the other person and is not shown in the app. We use it only for internal documentation of the age you stated for the agreement, and to establish or defend legal claims and for authority requests where we are obliged to. We do not check it and do not perform age verification. • history of completed matches • audit trail for binding consent: IP address, device model, operating system and OS version, server-side timestamp (UTC), each together with the account ID • Contact anchor: your verified mobile number and email address in encrypted form, plus check values derived from them (see “Linking records of agreement”) • for the inviting person with TWO EQUALS Premium: the Apple transaction ID of the purchase, encrypted • if both people turn on “Confirm proximity”: the result of the proximity check (for example “under 25 m”), not the location • the result of the device check by Apple (App Attest) • checksum and digital signature of the record of agreement • cancelled confirmations: if someone changes the selection after only one person has confirmed, that confirmation is cancelled. We log this with the time and the state of the confirmation at that point. The log is kept like the record of agreement • when ending: the time at which you tapped “End” and the time at which the notice reached our server Only the consent or match in the specific session is recorded — not medical findings and not the content of a personal conversation. Open points on which you did not agree are not part of the record of agreement. This information concerns special categories of personal data within the meaning of Art. 9 GDPR (data concerning sex life and possibly health data). Legal basis. We process your presets on the basis of your explicit consent (Art. 6(1)(a), Art. 9(2)(a) GDPR), which you give via a separate checkbox, independently of the Terms of Use and privacy information. If you withdraw it, we delete your presets. We keep the proof that you consented and, where applicable, withdrew your consent separately from this. As soon as both people have confirmed an agreement, we keep the record of agreement. We do this so that both people involved can establish, exercise or defend legal claims (Art. 9(2)(f), Art. 6(1)(f) GDPR). This also applies after a withdrawal of consent or an account deletion. The retention period is 10 years from the end of the agreement. After that, we delete the record automatically. If a dispute or an enquiry from an authority is known, we keep it until that matter is concluded, but no longer than 30 years. If both people involved request deletion, we delete it earlier. We keep the date of birth as part of the record of agreement, for the same reason and with the same retention periods. The audit trail documents when, and with which device or connection, a binding agreement was made. It is an integral part of the record of agreement and is kept and deleted together with it. GPS coordinates are not stored (for the optional proximity check, see "Linking records of agreement"). Wi-Fi network names (SSID) and hardware IDs (e.g. EID/IMEI) are not collected. Security. Data is transmitted encrypted via TLS. The database is operated in the EU (Frankfurt am Main), is not publicly accessible and is encrypted at rest (AES-256), as are its backups. We additionally encrypt consent, preference and audit data and the date of birth in the record of agreement at application level with our own keys. Recipients. In the match, the other person sees your display name, your age if you choose to show it, the matches and open points, the chosen duration and your statement on alcohol or other substances for this encounter. Both people can view the agreement later in their history. TWO EQUALS does not permanently store this information locally on the other person's device. The other person never sees your email address, phone number or date of birth. They only see the age you choose to show for that encounter. You choose your name and age separately for each encounter (name freely chosen, show age, hide it or give a different one); your profile does not change as a result. When you confirm, we record how you were displayed to the other person and keep this with the agreement record.

A record of agreement should still be linkable to a real person after an account has been deleted, for example if an authority or a court is investigating an encounter. For this purpose, we store the following with the record when an agreement is confirmed: Contact anchor. Your verified mobile number, email address and account ID are stored in encrypted form. The key is held in a separate key service (AWS Key Management Service, Frankfurt am Main). Our server can only use it to encrypt, not to decrypt. We also derive check values (HMAC) from your number and email address. On request, these only let us confirm whether a given number or email address belongs to a record, without disclosing it. Purchase ID. If the inviting person has TWO EQUALS Premium, we store the Apple transaction ID of their purchase in encrypted form with the record. Access. Neither the app, nor the other person, nor our server in normal operation can read the contact anchor or purchase ID. They are only opened through a separate, specially protected access of Ecolution GmbH, and only when an authority or a court requires it and we are legally obliged to comply (see "Requests from authorities"). Every access is logged with time, reason and case reference. Proximity check (optional). Before confirming, you can turn on "Confirm proximity". The app then uses your device's location once, with your permission, and sends it to our server. If both people have turned on the proximity check, the server calculates the distance between the two devices. Only the result is stored (for example "Proximity confirmed (under 25 m)" or "Proximity not checked"). The location itself is kept in memory for no more than 120 seconds, then discarded, and is not stored in our database or in logs. The legal basis is your explicit consent (Art. 6(1)(a), Art. 9(2)(a) GDPR, Section 25(1) TDDDG), which you give by turning it on. You can confirm just the same without it. You can withdraw your consent for future confirmations at any time by not turning on the switch or by revoking location access in your device settings. Device check (App Attest). When you confirm, we use Apple's App Attest service to check that the confirmation comes from the unmodified TWO EQUALS app on a genuine Apple device. Your device creates a key that Apple certifies. We store the ID of this key for your device and only the result in the record ("passed", "not available" or "failed"). This never prevents the confirmation. Digital signature. We digitally sign every record when it is confirmed. The checksum and signature are included in the record and in your data export. Our public key (twoequals.app/.well-known/evidence-key.pem) can be used to check that the record comes from us and has not been changed. Legal basis and retention. The contact anchor, purchase ID, device check and signature serve to establish, exercise or defend legal claims and to help investigate criminal offences (Art. 6(1)(f), Art. 9(2)(f) GDPR). Disclosure to authorities or courts is based on Art. 6(1)(c) GDPR. The data are kept and deleted together with the record of agreement, including after an account is deleted (Art. 17(3)(e) GDPR).

TWO EQUALS does not store medical findings. In particular, the following are not collected or kept: • HIV status • hepatitis information • PrEP information • test data and test dates • vaccination status • diagnoses or laboratory values In the match, you can record whether you want to talk about sexual health (for example status, last test, known infections, symptoms or prevention). Only this consent or match is recorded — not the content of a medical conversation and no test results. Such medical information is not part of the history and is not communicated to the other person via the app. This is distinct from the statement on alcohol or other substances for the respective encounter (see "Consent and history").

To provide the Service, for security and for troubleshooting, we process device and technical data. Legal basis: Art. 6(1)(b) and (f) GDPR. When a binding agreement is concluded, we additionally store the device model, operating system and OS version, your IP address (determined via the load balancer, X-Forwarded-For) and a device identifier for device binding, unalterably in the agreement record. If you have chosen “Confirm proximity”, we store only the result, not your location. We do not collect Wi-Fi network names. The timestamp is set server-side in UTC and is not taken from the device. Technical operating logs of the API may contain IP addresses and technical information about requests. We keep them for 30 days and then delete them automatically. We do not keep access logs for the website. App error reports. If an error occurs in the app, for example when signing in, the app sends a technical error report to our server in the EU. It contains the affected step, an error code and a short technical description, app version and build, device model (for example “iPhone 12”), iOS version, language setting and time. If you are signed in, we associate the report with your account ID. The report contains no passwords or codes, no email address or phone number, no content of your consents, wishes or boundaries, and no device identifier. We do not use any third-party providers for this and use the reports only to find and fix errors. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a functioning and secure service. The reports are part of the technical operating logs and are deleted after 30 days. When a consent is confirmed, the app also sends a brief report of each step for troubleshooting (name of the step, duration in milliseconds, result), even when everything works; these reports are not associated with any account ID. Face ID, Touch ID and app PIN. You confirm an agreement with Face ID or Touch ID, or with your iPhone passcode as a fallback. If you have set an app PIN (optional), you additionally confirm with that PIN. Face ID, Touch ID and the iPhone passcode are checked only by your device. Your app PIN is stored only as a check value on your device, never on our server. We do not receive or store biometric data. We only receive the result of whether the confirmation was successful and by which method (Face ID or Touch ID with app PIN, or device confirmation without PIN). Nearby search. Nearby search is optional. If you start it, the app uses your device's location with your permission for about two minutes to find people within a radius of about one hundred metres who are searching at the same time. The location is processed only for this search and then discarded. It is not stored in our database, in the record of agreement or on the other person's device. Only people who are searching themselves at that moment are visible. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) of the German Telecommunications Digital Services Data Protection Act, TDDDG), which you give by starting the search and granting location access on your device, and which you can withdraw at any time in your device settings. The optional proximity check when confirming is separate from this (see "Linking records of agreement"). Device binding. Your account is bound to one device. For this we store the ID and public key of your device’s App Attest key, a counter, the link to your account and the time of binding. This allows us to show that a confirmation came from the device of your account (Art. 6(1)(f) GDPR). For a new device, you confirm the switch with a code sent to your mobile number or, if you no longer have access to it, to your email address. We store the email code only as an irreversible check value; it is valid for ten minutes. After a switch by email you confirm your mobile number again by SMS. We log the switch (time, key ID, IP address, channel SMS or email); we do not store the phone number or email address with it. Your iPhone exchanges data with Apple for this (see “Service providers and transfers to third countries”). The link to your account remains as long as the account exists; afterwards the key stays stored without any reference to your account.

You buy TWO EQUALS Premium via the Apple App Store or Google Play. Apple or Google handle payment, invoicing and refunds under their own responsibility; their privacy policies apply. We do not receive your payment data. To activate Premium, we verify the purchase on our server: for Apple, using the transaction signed by the store; for Google Play, using the purchase token via Google's interface, through which we also acknowledge the purchase. For this purpose, we transmit the purchase identifiers to Apple or Google. We store the following with your account: the entitlement (Premium), its status, its source (Apple, Google or free activation by us), the product and transaction ID, and the time of activation and of the last verification. We do not link this data to your wishes, boundaries or decisions. Premium is linked to your store account. If you delete your account, we remove the assignment. We then keep the purchase details (transaction ID, product, purchase date and platform) without a link to your account, so you can assign the purchase again with a new account via "Restore purchases". We delete them if the purchase is refunded or we discontinue the service. Legal basis: Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR for keeping them after account deletion.

Clerk. For sign-in, identity verification and securing your account, we use Clerk, Inc., 101 California Street, Suite 2750, San Francisco, CA 94111, USA, as a processor pursuant to Art. 28 GDPR. Clerk acts on our behalf and processes in particular: • account ID • mobile number and email address • technical session and security data (e.g. sign-in and device information) Clerk stores and processes this data in the USA and uses its own sub-processors to send verification codes by SMS and email. Clerk is certified under the EU-U.S. Data Privacy Framework (DPF); the transfer is based on the European Commission's adequacy decision (Art. 45 GDPR). In addition, we have agreed the European Commission's Standard Contractual Clauses (Art. 46 GDPR) with Clerk as part of the data processing agreement (DPA). Further information: clerk.com/legal/privacy, clerk.com/legal/dpa and clerk.com/legal/dpf. Amazon Web Services. We operate the API, database, file storage and email delivery (Amazon SES) with Amazon Web Services EMEA SARL in the eu-central-1 region (Frankfurt am Main). Matching data is stored in the EU. AWS acts as a processor; the AWS GDPR DPA applies. Apple. For the device check (App Attest), your iPhone exchanges data directly with Apple so that Apple can certify your device's key. Apple processes this data under its own responsibility and privacy policy. We do not send any data to Apple for this. The AWS Key Management Service used for contact anchors and signatures runs in the eu-central-1 region (Frankfurt am Main). The website twoequals.app is delivered from storage in Frankfurt via the Amazon CloudFront content delivery network. To load the page quickly, your IP address may be processed briefly by CloudFront servers outside the EU. This is based on the AWS GDPR DPA with the Standard Contractual Clauses (Art. 46 GDPR) and Amazon's certification under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). The legal basis for delivery is Art. 6(1)(f) GDPR. We host the website's font ourselves. No fonts are loaded from Google servers. Ecolution GmbH remains the controller for the processing.

Police, public prosecutors or courts may request information about records of agreement from us. We review every request and only disclose data if we are legally obliged to do so (Art. 6(1)(c) GDPR, Art. 9(2)(f) GDPR) or if you expressly ask us to. We only disclose the data necessary for the request. The history in the app is not an export for authorities. This may include opening encrypted contact anchors or purchase IDs, or confirming whether a given mobile number or email address belongs to a record. Every such access is logged. We disclose the date of birth stored in the record of agreement only if the request requires it and we are obliged to.

You can send us a request via twoequals.app/en/support/. For this purpose, we process your email address so that we can reply, the description of your request, screenshots if you upload them, and the time of the request. The message is sent to support@ecolution.gmbh and delivered via Amazon SES in the EU. To protect against automated requests, we use an invisible check field and limit the number of requests per IP address. We only hold the IP address briefly for the respective time window and do not store it permanently. We do not use any third-party providers for this. The legal basis is Art. 6(1)(b) GDPR for handling your request and Art. 6(1)(f) GDPR for preventing abuse. Where screenshots may contain information about sex life, we additionally obtain your explicit consent (Art. 9(2)(a) GDPR). You can withdraw this consent with effect for the future, for example by email to support@ecolution.gmbh. The mandatory checkboxes are not pre-checked. We only store the request for as long as necessary to handle it. You can also use the support form to report display names or self-written boundaries that you consider unlawful (see Terms of Use, section 5.4). You can also report the other person’s display name or one of their own wishes directly in the app. For this, we store the reported text, the reason, your optional note, the ID of the matching session and your account ID, and send the report to our support mailbox. The other person is not informed. Legal basis: Art. 6(1)(f) GDPR (protecting users and enforcing the Terms of Use). We delete the report automatically 12 months after receipt.

We only store personal data for as long as necessary for the respective purposes: • account at the sign-in service: as long as your account exists; after account deletion, the sign-in service deletes the contact data in accordance with the DPA. The account ID remains in the matching record as a key that is never reassigned. As a contact anchor, your mobile number and email address remain stored in encrypted form with your records of agreement (see next point) • presets: until you withdraw your consent or delete your account • after account deletion: hash of a recovery key (not the key itself), so that you can later attribute the consent to yourself • records of agreement including audit trail and date of birth: 10 years from the end of the agreement; if a dispute or an enquiry from an authority is known, until it is concluded, but no longer than 30 years; earlier if both people involved request deletion • date of birth on the account: for as long as your account exists. After account deletion, only the copy in the record of agreement remains. • Contact anchor, encrypted purchase ID, results of the proximity and device checks, and signature: same as the respective record of agreement, including after an account is deleted • Log of access to contact anchors and purchase IDs: as long as the record concerned • proof of your consent to the processing of personal details (decision, version, time, log entry) and the device binding log: as long as the last record of agreement you took part in; if you never had an agreement, until your account is deleted • link between your account and your device (device binding): as long as your account exists • Location during the proximity check: in memory for no more than 120 seconds, not stored • Premium entitlement and purchase assignment: as long as your account exists • Purchase details with no link to an account (after account deletion): until the purchase is refunded or the service is discontinued • unalterable archives of contracts: ten years, where a statutory retention obligation applies • technical operating logs of the API, including app error reports: 30 days • automatic database backups: 7 days. Deleted data may still be contained in backups until then. • support messages: as long as necessary to handle them • reports made in the app: 12 months from receipt After the periods expire, we delete or anonymize the data, unless a statutory retention obligation prevents this.

In relation to Ecolution GmbH, you have in particular the following rights: • access (Art. 15 GDPR) • rectification (Art. 16 GDPR) • erasure (Art. 17 GDPR) • restriction of processing (Art. 18 GDPR) • data portability (Art. 20 GDPR) • objection (Art. 21 GDPR, see below) • withdrawal of consent with effect for the future (Art. 7(3) GDPR) Your right to object (Art. 21 GDPR) Where we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims. To object, write to info@ecolution.gmbh. Under "Account", you can request a copy of your data. It includes account and profile information, verified contact details, settings and your records of agreement with audit trail. The date of birth stored in the record of agreement is not included; you can obtain information about it on request at info@ecolution.gmbh. The export also shows whether a contact anchor is stored for a record, the results of the proximity and device checks, and the checksum and signature. After account deletion, you can obtain information about your records of agreement on request to info@ecolution.gmbh if you identify yourself with your account ID and recovery key. Deleting your account ends sign-in and ongoing use: your phone number and email are deleted at the sign-in service, and your preferences are deleted. As a contact anchor, your mobile number and email address remain stored in encrypted form with your records of agreement, and with Premium also the purchase ID (see "Linking records of agreement"). Documented matches remain stored in the EU database for the retention period stated above, including your account ID and your audit trail (Art. 17(3)(e) GDPR). The other person still sees your display name, your age where shown, and the matches in their history, but not your account ID or your audit trail. Your date of birth in the record remains stored for the retention period, but is not visible to the other person. Using the same number later creates a new, empty account — without the old history. The old account ID is never reassigned to anyone. No solely automated decision with legal effect within the meaning of Art. 22 GDPR takes place. To exercise your rights: info@ecolution.gmbh.

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority is in particular: The Hamburg Commissioner for Data Protection and Freedom of Information (Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit) Ludwig-Erhard-Str. 22 20459 Hamburg, Germany datenschutz-hamburg.de

Preferences are not fully disclosed to the other person in advance. The match shows matches and open points. For an open point, both see who said yes and who said no, or who has not decided yet. Consent and its record only come into being when all points match and both have confirmed. Saved presets are not consent to a specific person or situation. This policy describes the actual state of processing.

This Privacy Policy was written in German. The German version is the original and authoritative version. The other language versions are translations, which may contain errors. In case of discrepancies, the German version prevails, unless mandatory law provides otherwise.