Your twin, and the only place it gets written.
Passwords are hashed with PBKDF2-SHA256. Sessions last 30 days. Run this behind TLS — the session token is a credential.
How long should I keep what you tell me? Right now: 2 years. If you want a twin that can still tell you about your third birthday decades from now, choose lifelong. Revocable either way.