Privacy Policy

This policy explains what personal data Twoglot collects when you use the Service, why, and what control you have over it. Twoglot is a small, independently-run project. We don't run ads, we don't sell data, and we don't use any third-party analytics or tracking scripts.

1. Data we collect

When you sign in with GitHub, we receive and store your:

• GitHub numeric user ID and username;
• display name, if you've set one on GitHub; and
• avatar image URL.

We don't request your email address, and our sign-in flow doesn't ask for any GitHub scopes beyond your public profile — it can't read or write your repositories by itself. Repository access is granted separately, only for repositories you install the Twoglot GitHub App on (see Section 4).

Beyond your GitHub profile, we store the data you create while using Twoglot:

• projects you create or are a member of (repository name, file path, chosen languages, and whether you've marked the project private);
• translation submissions you make or receive, including the proposed text;
• your role on any project you're invited to (translator, reviewer, or admin);
• a session token and your GitHub authentication tokens, used solely to keep you signed in and to act on GitHub on your behalf (for example, opening a pull request when a submission is approved).

2. Cookies

We set three cookies, all first-party and none used for tracking or ads:

• session — keeps you signed in; expires after 180 days or when you sign out;
• gh_oauth_state — a short-lived value used to protect the GitHub sign-in flow against cross-site request forgery; expires after 10 minutes; and
• gh_oauth_return_to — remembers which page to return you to after signing in; expires after 10 minutes.

We don't use any analytics, advertising, or third-party tracking cookies or scripts on this site.

3. Repository access through the GitHub App

Committing translations and opening pull requests requires a separate GitHub App installation with Contents and Pull requests permissions (read & write). This is only active for repositories you or a repository admin explicitly install the App on through GitHub — Twoglot never gains repository access just because you signed in. You can review or revoke this access at any time from your GitHub account's installed-apps settings.

4. How we use your data

We use the data described above only to:

• authenticate you and keep you signed in;
• operate the Service — show you your projects, let collaborators see who submitted or reviewed a translation, and compute translation-completion statistics;
• open pull requests on GitHub when a project owner or reviewer approves a submission; and
• enforce project roles and access controls (public vs. private projects).

We process this data on the basis that it's necessary to perform our contract with you (providing the Service you signed up for) or, where that doesn't apply, on the basis of our legitimate interest in operating and securing the Service.

5. Who we share data with

We share data with GitHub as an unavoidable part of how Twoglot works — signing in, reading translation files, and opening pull requests all happen through GitHub's API. We don't sell your data, and we don't share it with advertisers, analytics providers, or any other third party. If you submit a translation that gets approved, the resulting commit and pull request are visible on GitHub according to your repository's own visibility settings, the same as any other pull request.

6. Data retention and deletion

We keep your data for as long as your account exists. Deleting your account from Settings is permanent and immediate: it removes your profile, revokes your GitHub authentication token at GitHub's end, and deletes every project you own along with its translations and submissions, your memberships on other projects, and your submissions to other people's projects. This can't be undone, so make sure any repositories you care about are otherwise backed up on GitHub before deleting your account.

Deleting a single project (without deleting your account) permanently removes that project's languages, translations, and submissions the same way.

7. Your rights

Depending on where you live, you may have the right to access, correct, or export your personal data, to object to or restrict certain processing, and to have your data erased. You can exercise most of this yourself at any time — your GitHub profile data updates automatically when you sign in again, and account deletion (Section 7) covers erasure. For anything else, or if you'd like a copy of your data, email [email protected]. If you're in the EU/EEA, you also have the right to lodge a complaint with your local data protection supervisory authority.

8. International transfers

Our infrastructure may be hosted outside your country of residence, and GitHub itself is a US-based service. Where personal data is transferred outside the EEA, we rely on the transfer mechanisms GitHub and our infrastructure providers make available, such as the EU Standard Contractual Clauses.

9. Children's privacy

Twoglot isn't directed at children, and you must be at least 16 (or the minimum age of digital consent in your jurisdiction) to use it, consistent with GitHub's own age requirements.

10. Changes to this policy

If we make material changes to this policy, we'll update the "Last updated" date above. We encourage you to review this page occasionally.

11. Contact

Questions about this policy or your data? Email [email protected].