Privacy policy

Twelvefold is a planning app. What you write in it (your vision, goals, plans and reflections) is personal, so this page explains plainly what is stored, why, where, and what you can do about it.

Who is responsible

Twelvefold is run by Mohit Vaghela, the “controller” of your personal data under UK data protection law (the UK GDPR and the Data Protection Act 2018). For any question or request about your data, email mohitoneplus@gmail.com.

What we store

• Your account: your email address and your password. The password is stored only as a one-way hash, so nobody can read it.
• Your profile: an optional display name and your time zone (used to work out what “today” is for you).
• What you write and plan: visions, cycles, goals and lag measures, tactics, week plans and sessions, what you ticked off, weekly reviews and daily reflections.
• Technical data: the cookies that keep you signed in, and the IP address and browser details that every web request carries. Our providers keep these in short-lived logs, for security and to keep the service running.

We don't ask for sensitive information such as health details. If you choose to write about it in a reflection, it's stored and protected like everything else you write.

Why we use it

• To provide the service you signed up for (the lawful basis is our contract with you): storing your plans, showing them back to you, working out your scores, and sending account emails.
• To keep it secure and working (our legitimate interests): stopping bots and abuse, fixing errors, and counting page views in aggregate to see which parts of the app are used.
• When the law requires it (legal obligation), for example a valid request from a court.

We don't sell your data, show ads, or use it to profile you. We don't use what you write to train AI models.

Where it's stored and who helps run the service

Your account and everything you write are stored in a database in London. These companies process data on our behalf, under contracts that only allow them to use it to provide their service to us:

• Supabase

  Database and sign-in: stores your account and everything you write

  Where: London, UK

• Vercel

  Hosting, and cookieless page-view statistics

  Where: Servers in London; pages delivered from a global network

• Resend

  Sends account emails (confirming your address, resetting your password)

  Where: European Union

• Sentry

  Error reports, so bugs get fixed. What you write in reflections is removed first

  Where: Frankfurt, Germany

• Cloudflare

  Bot protection on sign-up and sign-in, and storage of encrypted backups

  Where: European Union; bot checks run on a global network

Some of these companies are based in the United States, and parts of their networks are outside the UK. Where your data leaves the UK, it's protected by UK adequacy regulations or by the UK's International Data Transfer Agreement or Addendum.

How your data is protected

• All traffic is encrypted in transit (HTTPS), and the database is encrypted at rest.
• Every account is kept apart by the database itself (row-level security). Even if the app had a bug, the database would refuse to hand one person's rows to another.
• Your data is not end-to-end encrypted. That means it could, technically, be read by someone with administrator access to the database. We don't browse user content. There is no admin screen for it, and database access is limited to fixing problems or answering a legal requirement, through accounts protected by multi-factor authentication.

Cookies and analytics

Twelvefold only uses cookies that are strictly necessary: they keep you signed in. Page-view statistics are cookieless and counted in aggregate. They don't identify you or follow you to other sites, which is why there is no cookie banner.

How long we keep it

• For as long as you have an account.
• When you delete your account, everything in it is removed from the live database straight away. Encrypted backups are kept for up to 30 days and then overwritten, so your data disappears from those too.
• Providers' security and error logs are kept for a short time, normally no more than 30 days.

Your rights

You have the right to access your data, correct it, take it with you, have it deleted, restrict or object to how it's used, and to complain. Most of these you can do yourself, straight away:

• Export: in Settings, under “Your data”, download everything as JSON or as CSV files in a zip.
• Correct: edit anything in the app, and your name, email and time zone in Settings.
• Delete: in Settings, under “Delete account”, type DELETE to confirm. Your account and everything in it are deleted immediately. If you haven't entered an invite code yet, you can do the same from the invite page.

For anything else, email mohitoneplus@gmail.com and we'll reply within one month. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.

Age

Twelvefold is for people aged 16 or over.

Changes to this policy

If we change how we use your data in a way that matters, we'll email you before the change takes effect. The date at the top of this page shows when it last changed.