TwoDrum privacy policy

Last updated: 11 October 2026

TwoDrum is an iPhone app and a plug-in board that connects a twin-drum washing machine to your home Wi-Fi. This policy covers the TwoDrum app, the TwoDrum board and the TwoDrum notification relay. TwoDrum is made by Peter Samuel Harding ("we"). Contact: twodrum@icloud.com.

The short version. TwoDrum has no accounts, no advertising, no analytics and no tracking. We don't collect your personal data. Your wash information stays on the TwoDrum board in your home and on your iPhone. The one service we run, the notification relay, passes notifications on to Apple and keeps nothing.

What stays in your home

• On the TwoDrum board: the machine's state and settings, wash history and events, the board's logs, a backup of the machine's original controller software and memory, your Wi-Fi network name and password, and the list of phones allowed to use the machine (the name you give each phone, when it was added, whether it is the owner or a member, and a scrambled copy of its access key). We cannot reach your board, and nothing on it is sent to us.
• On your iPhone: your machines and their access keys (in the iOS Keychain), the app's settings, copies of the board's backups (in the app's Documents folder, which you can see in the Files app), and the latest wash estimate so the app can show it while it can't reach the board.
• Your iPhone talks to the board directly, over your home network (encrypted with TLS 1.3 and locked to your own board) or over Bluetooth during setup (encrypted).

Notifications. If you allow notifications, your iPhone gets a push token from Apple. The app sends this token, with the public keys of your boards, to the TwoDrum notification relay. The relay is a small service run on Cloudflare. It proves the request comes from the genuine TwoDrum app using Apple's App Attest. It then gives back a sealed "grant" that only the relay can open, and the app hands that grant to your board. When something happens (for example, a wash finishes), the board sends the grant and a notification to the relay, and the relay passes the notification to Apple, which delivers it to your iPhone.

• The notification text is end-to-end encrypted from your board to your iPhone. The relay and Apple see only a general category (such as "wash complete"), the time, and an encrypted message they can't read.
• The relay stores nothing. It has no database and its request logs are switched off. It uses your push token, your board's public key and your IP address only while handling each request, and it keeps nothing afterwards.
• Grants expire after 30 days at most and are renewed by the app. When the owner removes a phone from the machine (Phones with access), the board deletes that phone's grant.
• The board never sees your push token. Without notifications, the app never contacts the relay.

Things you choose to send

• Send diagnostics (machine page > Advanced): the app fetches a diagnostics file from your board (the board's details, its recent log, crash and install records, and recent events; no passwords, keys or access codes). It then opens the iOS share sheet. You choose whether to send it, and to whom. Nothing is sent automatically.
• Invites: an invite link you share (by message, email or any app you choose) lets someone in your household join your machine. It works once and expires.
• Logging to your own server (optional, owner only): you can tell the board to send its events, wash records and status updates (including the machine's display text and the board's network details) to a server you run. This goes from your board to your server. We never receive it.

Other services involved

• Apple delivers notifications (Apple Push Notification service) and checks that the app is genuine (App Attest). Apple's privacy policy applies to those services. If you have chosen in iOS to share analytics with app developers, Apple may also share crash reports for this app with us. You control this in iOS Settings > Privacy & Security > Analytics & Improvements.
• Cloudflare runs the notification relay and, like any network provider, sees connection details (such as IP addresses) while carrying the requests.
• Time servers: the board sets its clock from public internet time servers (time.cloudflare.com and pool.ntp.org).

We don't sell or share personal data, and we don't use it for advertising. Any provider that handles data for TwoDrum (Apple and Cloudflare, above) protects it at least as well as this policy describes.

Permissions the app asks for

• Bluetooth: to set up a new board and connect it to your Wi-Fi.
• Local Network: to find and talk to your board on your home Wi-Fi.
• Camera: only to scan the QR code on the board's label. No photos are taken or kept.
• Notifications: to tell you when a wash finishes or needs attention.

Each one is optional. You can change it at any time in iOS Settings > TwoDrum. Without it, only the matching feature stops working.

Keeping and deleting your data

• On your iPhone: to remove a machine and its keys, go to Settings > Machines > the machine > Remove from this phone. Deleting the app removes everything else it stored.
• On the board: a factory reset (from the app, or from the machine's own menu) erases the board's settings, phones, history and logs.
• At the relay: there is nothing to delete, because nothing is kept. To stop notifications, turn them off in the app or in iOS Settings, or remove the phone from the machine.

Since we hold no personal data about you, there is nothing for us to export or erase. You can still write to us at twodrum@icloud.com with any question or request.

Children. TwoDrum is not directed at children and collects no data from anyone.

Changes. If TwoDrum ever starts to collect data, we will update this page and the App Store privacy details before the change ships. The date at the top shows the latest version.