Privacy policy
Last updated 18 October 2026
This explains what personal data Two-Way collects, why, and what you can do about it. We keep it short because we collect very little.
Who we are
Two-Way (twowaymarket.com) is run by Harmaan Singh Gill, 2 Woodhall Park Grove, LS28 7HB, Leeds, UK. We're the "controller" of your personal data under UK data protection law (the UK GDPR and the Data Protection Act 2018). You can reach us at hello@twowaymarket.com.
What we collect
| What | Why | Lawful basis |
|---|---|---|
| Your email, first name and a scrambled (hashed) version of your password | To run your account and let you sign in | Contract |
| Details you choose to add: country, city, university, interests | To pick interview questions you'll have a feel for | Contract |
| Your interview results and scores | To show your history and progress | Contract |
| How many interviews you start each day | To apply the free plan's daily limit | Contract / legitimate interests |
| Your subscription status and a Stripe customer reference | To give you Pro and handle billing. We never see your card details. | Contract |
| The name you type into a group game, and your trades in it | To run the game. Games are deleted automatically 14 days after they were created. | Legitimate interests |
| Basic technical logs (IP address, browser, errors) | To keep the site secure and working | Legitimate interests |
We don't sell your data, we don't use advertising trackers, and we don't build marketing profiles.
Cookies
We only use cookies that are strictly necessary for the site to work: one that keeps you signed in, and one that remembers an anonymous visitor so the free daily limit works without an account. Your device also stores a few preferences (like sound on or off) in local storage. Because these are all essential, we don't need to ask for consent, and there are no analytics or advertising cookies.
Who we share it with
Only the companies that help us run the service, and only what they need:
- Stripe, for payments. Stripe processes your card details directly.
- Our hosting provider, which runs the servers and stores the database.
- Our email provider, to send password resets and account emails.
Some of these companies are based in, or use servers in, the United States. Where that happens, the transfer is protected by the UK's approved safeguards, such as the International Data Transfer Addendum or the UK-US data bridge.
How long we keep it
We keep your account and results for as long as you have an account. If you delete your account, we delete your data straight away, except for anything we have to keep by law (for example payment records, which Stripe keeps for tax purposes). Group games and their player names are deleted automatically 14 days after the game was created.
Your rights
You can ask to see, correct, download or delete your data, or object to how we use it. You can download everything and delete your account yourself from your account page, or email us. We'll reply within a month.
If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk. We'd appreciate the chance to sort it out first.
Age
Two-Way is meant for students aged 16 and over.
Changes
If we change this policy in a way that matters, we'll update the date at the top and, for significant changes, email account holders.