Privacy policy

Who we are

This website is run by Twinwright (company details pending). Contact for privacy questions: privacy@twinwright.com.

What we collect

What you send us in a form: your name, e-mail address and what you write (plus country, organisation or role where a form asks for them). With it we keep the page you sent it from, the time, the country your IP address belongs to, and a salted hash of your IP address that only limits repeated submissions and is deleted after 30 days. We use no advertising cookies and no cross-site tracking.

Why

To answer you, to keep the founders’ list and the early-access list, to send the monthly newsletter if you ask for it, and to keep the forms free of abuse. The legal basis is your consent, the steps before a contract you asked for, and our legitimate interest in secure forms (GDPR Art. 6(1)(a), (b) and (f); PIPL Art. 13).

Where it is stored

This website and its forms run on our own server at Alibaba Cloud in Hong Kong; what you send is kept in a database on that server. When a form arrives, the server passes it to our team in a chat message over Telegram and over WhatsApp (sent through the CallMeBot relay service). Mail to our addresses is handled by Alibaba Cloud's enterprise mail service. These providers may process data outside your country; we rely on their terms and, where the law asks for it, on your consent.

How long

Enquiries and list sign-ups: up to 2 years after the last contact, then deleted automatically. Newsletter: until you unsubscribe, and the record 30 days after that. Unconfirmed newsletter sign-ups: 14 days after we e-mailed you the confirmation link. IP hashes: 30 days. E-mails: in our mailbox for as long as the conversation needs them.

E-mails from us

We do not send automatic e-mails at the moment: we answer enquiries by hand. Before the first newsletter goes out, we e-mail you a link to confirm your subscription and add you only when you confirm (double opt-in). Every newsletter has a link to unsubscribe, or write to privacy@twinwright.com.

Your rights

You can ask for a copy, correction or deletion of your data, object to processing, withdraw consent and complain to your data-protection authority. Write to privacy@twinwright.com.

Studio

Studio works offline. By itself it contacts us only to start a free trial and to activate and renew a paid licence, as described under “Trials, licences and payments”, and, while a report you sent is open, to ask whether we have answered (see “Support”): it has no telemetry and does not check for new versions. Studio keeps an audit log and your program versions on your own computer (Documents\Twinwright Studio); they are never uploaded. The audit log (one file a day, audit-YYYY-MM-DD.jsonl in the log folder) records the first 180 bytes of each message in the AI panel and what the AI and you had the machine do; keys, tokens and passwords are written as ***. If Studio crashes, it prepares a cleaned report without paths, file names, G-code, AI conversations, licence codes or the computer's fingerprint; a diagnostic bundle you make holds only the items you tick (your program and setup are not ticked at first). You see either before you decide whether to send it; Studio never sends them itself. What the AI assistant sends when you connect it to a cloud service is described under “AI features in Studio”.

Trials, licences and payments

When Studio starts a free trial, it sends the edition, a fingerprint of your computer (described below) and Studio's version; we keep the fingerprint with the edition and the trial's dates, so that each computer has each trial once. Until online sales open, we issue paid licences on order: we keep the holder's name, the e-mail address the activation code goes to and the order, to send the code, to renew the licence and for our accounts, for as long as tax law requires. When online sales open, a reseller (named here then) will be the merchant of record: it will take your payment, address and tax details under its own privacy notice and tell us your name, e-mail address and what you bought, which we will keep in the same way. We store your activation code only as a hash: not even we can read it back, and a lost code is replaced by a new one. When Studio activates or renews a licence it sends the activation code (on a renewal, the licence's id instead), a fingerprint of your computer — a one-way hash of the identifier your operating system gives it, never the identifier itself — and Studio's version; we keep the fingerprints of up to three computers a seat with the dates they were first and last seen, so that you can free one on the licence page. From the IP address the request comes from we look up the country and region (never the city; see “Places and downloads”). A log of trials, activations, renewals and changes to a licence — with the computer's fingerprint, Studio's version, the country and region and your IP address shortened to its network part — is kept for 90 days to detect shared or stolen codes. From the same requests we count trials, activations and renewals by month, country and region, edition and Studio version: the counts hold no licence, no computer and no address, cannot be traced back to you, and we keep them to plan our products, translations and markets. These hashes are pseudonymous data. The legal basis is the contract, and for a trial the steps before a contract that you ask for (GDPR Art. 6(1)(b)); for the log, the counts and keeping each trial to once a computer, our legitimate interests in preventing misuse and in knowing where and how Studio is used (Art. 6(1)(f)); you can object by writing to privacy@twinwright.com. Trials, activation and renewal send nothing about your work.

AI features in Studio

Studio's AI features send nothing until you set them up and use them. The AI assistant works with the service you choose. With a cloud service, Studio sends it — from your computer, with your account and your API key — your messages with the conversation so far and, while the box to attach the window's program, setup and check results is ticked (it is by default), that program, setup and those results; the results of the tools the assistant uses in Studio, such as checks and simulations, go to the service too. Before the first message to each cloud service, Studio shows you once what will go there and offers a local model instead. That service handles all of this under its own terms; Twinwright receives none of it. An AI client you connect over MCP, such as Claude or ChatGPT, likewise sends what it reads from Studio to its own service. Studio stores your API keys encrypted with Windows DPAPI on your computer. With a local model (LM Studio, Ollama), everything stays on your computer.

Visit statistics

Our web server logs every request: the address it came from, the time, the page, the browser's identification and the page you came from. Our pages' script adds a short note to this log: the screen and window size, the time zone and language, how long a page was visible, how far it was scrolled and which download was clicked; it sends nothing when your browser asks not to be tracked (Do Not Track or Global Privacy Control). From this log we count the visits once a day by browser, system, device type, country (looked up from the address in DB-IP's database on our own server) and referring site, and how many visitors open the download page, download Studio and start a trial. The counts contain no address and no identifier; the log itself is kept for at most 90 days (its older parts sooner, as it grows). We use no cookies and no outside analytics service for this. The legal basis is our legitimate interest in knowing how the website is used (GDPR Art. 6(1)(f)); you can object by writing to privacy@twinwright.com.

Your account

Your licence's activation code opens your account; you can then add a passkey and sign in with it. We keep the name you give, an address to reach you if you give one (we never send anything to it by ourselves), the public keys of your passkeys (never a private key), and the devices signed in to it: their browser, address and approximate place while they stay signed in. The security log on the account pages keeps sign-ins and changes for 400 days, each address cut to its network (IPv4 /24, IPv6 /48). Closing the account deletes all of it; the licences you bought stay with their order records.

Places and downloads

We look up the approximate place of an address (city, region and country) in a database on our own server — DB-IP's free database (IP Geolocation by DB-IP, db-ip.com) — to show where your account was signed in from, to note the country and region of a licence's activations and renewals, and to refuse Studio downloads from countries and regions under embargo. For this the address goes to no one.

Support

When you ask us something or report a problem — on our support page, in your account or, in Studio versions that have it, with Help > Report a problem — we keep what you send: the kind of request, your description, an e-mail address if you give one, the licence number if Studio is activated (never the activation code or your computer’s fingerprint), Studio’s version, edition and build, your system, language and screen, and a summary of Studio’s last 50 actions (time, action and result, without your programs, with user names in paths removed). A screenshot and a diagnostic bundle come only when you tick them. Studio sends a report only when you press Send; while one of your reports is open, it asks every 30 minutes, with the ticket’s number and key only, whether we have answered (you can turn this off in its settings). Our team hears of a new ticket in a chat message with its number and first line. We keep the conversation for 2 years after its last message and attachments until 90 days after the ticket is solved, at most a year; the ticket’s key only as a hash; your IP address only to limit abuse, never with the ticket. Only our staff, in our staff console, and you, in Studio and in your account, can see a ticket; attachments are never opened on our website. The legal basis is our contract with you and the support that comes with it (GDPR Art. 6(1)(b)); for the free Learning edition, our legitimate interest in helping you (GDPR Art. 6(1)(f)).