Privacy policy
What Two.run collects, why, where it is stored and how to reach us about it.
Effective 10 October 2026
Who we are
Two.run is operated by NZWE, Inc., a Delaware corporation ("we", "us"). This policy explains what personal information the two.run website and the Two.run app collect, why, and the choices you have.
Two.run is in early release. This policy describes what the service does today. When we add features that change how we handle data, we will update this page first.
What we collect
We collect only what we need to run the service:
- Account details: your name, work email and workspace name when you sign up.
- Brand sources you add: guidelines, logos, fonts, token files and written descriptions of your brand.
- What we generate for you: tokens, themes, components, documentation, brand books and validation reports.
- Billing details, once paid plans are available: your plan, billing email and the card brand, last four digits and expiry. Card numbers are handled by Stripe and never reach our servers.
- Technical data: server logs kept by our hosting provider (IP address, browser, pages requested, time) for security and troubleshooting.
- One functional cookie, "theme", that remembers light or dark mode. Sign-in session cookies are added when accounts open. We use no advertising, analytics or cross-site tracking cookies.
How we use it
We use your information to provide and secure Two.run: generating your design system from your sources, running your account and billing, answering support requests, preventing abuse, and meeting legal obligations. We do not sell personal information, and we do not use it for advertising.
AI processing
To propose tokens, themes and components, we send your brand sources and instructions to our AI provider, OpenAI, through its API. These requests are processed in the United States under a project configured not to share data with OpenAI for model training.
We do not use your files to train models unless you opt in. Human review before delivery is on by default, and AI proposals are always shown as proposals until you apply them.
Where your data is stored
Customer data is stored and processed in the United States. If you use Two.run from outside the United States, your information is transferred to and processed in the United States.
How long we keep it
We keep account information and workspace content while your account is active. If you cancel, your workspace stays readable for 30 days so you can export it; after that we delete workspace content within a further 30 days. We keep billing records for as long as tax and accounting law requires.
Your choices and rights
You can ask us to access, correct, export or delete your personal information by emailing privacy@two.run. We respond within 30 days. Depending on where you live, for example in the European Union, the United Kingdom or California, you may have additional rights under local law; we honour these requests wherever you are.
Security
Traffic to Two.run is encrypted in transit, workspaces are isolated from each other, access to production systems is limited, and secrets are kept in a dedicated secrets manager. No system is perfectly secure; if we learn of a breach that affects your information, we will tell you without undue delay.
Children
Two.run is a business tool and is not directed to anyone under 16. We do not knowingly collect information from children.
Changes to this policy
When we change this policy we update the date below. For material changes we will also notify account holders by email before the change takes effect.
Contact
Questions or requests: privacy@two.run. NZWE, Inc. (Delaware, United States).