Private travel beta

Privacy

This notice describes the Twokulu beta. Updated 27 October 2026.

Your shared sign-in

Your invited email address determines which trips you can open. Twokulu and the original Cape Town 7 and South Africa 12 websites use the same Google Firebase sign-in account.

You can create an account with your invited email and a password, verify your email, and request a password reset. Twokulu sends the credentials you enter securely to Firebase for verification. Passwords are not saved in the app’s device storage. Firebase sends verification, reset and existing email sign-in messages.

The service uses secure, HttpOnly cookies for your session, sign-in protection and selected trip. A separate account is provided for beta review.

Trip documents

Where enabled, Documents stores JPEG, PNG and PDF tickets or confirmations in private Google Cloud storage. You choose whole-trip sharing (the default) or specific travellers with verified accounts on that trip. Access is checked against the current trip membership and account identity; sharing is not transferred to a newly created account with the same email.

Only the uploader can delete a document. Deletion removes application access immediately. Google Cloud may retain a recoverable soft-deleted copy for seven days; no public document link is created. Minimal upload and deletion markers prevent duplicate or delayed uploads from recreating deleted files.

Account deletion blocks new uploads, removes access to files shared specifically with that account and removes its uploaded documents from the app. If storage cleanup cannot be confirmed, account deletion stops and can be retried. Shared documents uploaded by other members remain with those members.

What stays on your device

Trip progress, packing choices, parent PIN protection and draft game state are stored on your device, separated by signed-in account and trip. They do not automatically transfer to another device. Clearing the app’s stored website data removes this local information.

Shared trip records

Google Cloud hosts this beta and the saved, shared Cape Town 7 game records. The hosting and sign-in services also process the technical information needed to operate and protect the service.

Shared expenses

When you use shared expenses, Google Cloud stores the people or household labels, bills, splits, repayment records and corrections entered for that trip. Invited members can see and add to these shared records. Labels are entered by members and are not verified identities. The service retains the submitting account’s Firebase identifier and time for the audit history; other members see a stable member label rather than your email or account identifier. Avoid entering bank details or other sensitive information.

Repayment records do not transfer money. Currencies remain separate. Reversing an error retains the original record and its correction. Shared expense history remains when a sign-in account is deleted; contact the organiser to request removal of personal information in group records.

You can also start a ledger that is not tied to a trip and ask other Twokulu members to contribute by the email address they sign in with. The service stores a one-way hash of each address and a short hint such as “a…@example.com”, so that account can open the ledger and the person who added it can recognise a mistake; the address itself is not stored. Everyone in a ledger sees its people, bills, repayments and corrections. The person who started a ledger can delete it for everyone; anyone else can leave it. Deleting your account removes you from your ledgers, and a ledger with nobody left in it is deleted.

Deleting your account

While signed in with a verified, invited account, open Your account to delete it. The action requires your current password and an explicit confirmation. It deletes the shared sign-in used by Twokulu and both original websites, ending access through that account on all devices.

Deletion removes this account’s saved Twokulu progress on the device used to complete it. It does not remotely erase copies on other devices or data stored separately by the original websites.

Shared trip plans and game histories remain. Your organiser’s invitation email also remains on the trip access list, so you can explicitly sign up again later while that invitation is active. Account deletion does not automatically remove personal information within group records; contact the organiser to request its removal or to remove your invitation.

This beta’s self-service deletion requires a verified email and current trip access. If you cannot verify your email, have lost access or cannot sign in, contact your trip organiser using the contact details you already have. They will need to verify your identity and confirm the shared-account scope before arranging deletion.

Maps and location

Opening a map can load map tiles from OpenStreetMap. Directions and venue links can open external apps or websites, whose own privacy terms apply. Location is requested when you choose to use your location; Twokulu does not request background location.

Optional voice and chat

The optional adult guides use ElevenLabs to process voice and messages. Please leave personal details out of conversations. The family guide retains its adult consent step, and Kids Explorer has no voice or chat guide. The family parent PIN guard remains separate from account sign-in.

Access and questions

Contact the trip organiser using the contact details you already have for access changes, removal of saved server information or help with this beta. Never send them your password, sign-in link or verification code.

Beta support · Back to sign-in