Privacy
Policy

Draft for review. Before this page goes public, replace the highlighted owner and contact fields, confirm the analytics retention period and consent flow, and check the live AI-provider list against the submitted build.

twelf is a small personal collection of interests and notes. This policy describes the current iOS app and this static demo website. It is based on the app’s current source and configuration.

Who is responsible

twelf is operated by [developer’s legal name or company]. For privacy questions, contact [support email].

Data in the app

Your cards and notes. Card names, topics, saved notes, source links and app settings are stored in app storage on your iPhone. The current app does not sync this collection to your other devices or to a twelf account server. The widget reads a separate, account-scoped cache on the same device.

Apple sign-in. The app uses Sign in with Apple to identify the local collection on this iPhone. It stores an opaque Apple user identifier in the device’s protected Keychain. twelf does not need your Apple email or name for this local account. Apple handles the sign-in itself under Apple’s privacy policy.

AI requests. A prompt must leave the device to generate a new note. With your own provider connection, the app sends the request directly to the provider you chose, such as OpenAI, OpenRouter, Anthropic or Google Gemini. Your provider key is stored in the iPhone’s Keychain and is sent to that provider with the request. twelf does not send your personal provider key to its backend. The provider’s terms and privacy policy also apply.

If you use the optional managed twelf AI connection, the request goes to the configured twelf service and its AI/search providers. It includes the topic and the authorization needed to process that request. Those providers process the request to return a note. Their own privacy and retention terms apply.

Saved notes and sources remain on your iPhone. A provider may handle request data under its own policies. Check the provider’s current terms before sending sensitive information.

Optional city suggestions

If you choose “Use my city” for a local idea, the app asks iOS for location access and converts a coarse location into a city and country. It does not save precise coordinates. The selected city may be saved as part of that card’s topic and included in an AI request. You can deny location access and choose a city manually.

Product analytics

When analytics is configured in an app build, twelf queues pseudonymous product events and sends them to Supabase. Events can include a random installation ID, session ID, opaque account ID, app and iOS versions, event time, onboarding progress, selections from built-in recommendations, card counts, provider mode, language, widget counts and notification settings.

Analytics events are filtered to an allowlist. They do not include free-form card prompts, saved note text, your Apple ID, email address, provider key, device token or precise location. Analytics is used to understand app use and improve twelf. It is not used for advertising or cross-app tracking.

Current limitation: the current app configuration can send these events automatically, and the app does not yet offer an analytics opt-out or in-app analytics deletion control. The server-side retention period also needs a final, published limit. This policy must be updated when those controls and limits are set.

Website

This demo website has no account, form, advertising pixel, cookie banner or analytics script. A hosting provider may process technical request logs, such as an IP address, to deliver and secure the site. Its own privacy policy applies to those logs.

Storage and deletion

Your cards, notes and provider key stay on this iPhone until you delete them in twelf or remove the app. Deleting your local account removes its card files, local sign-in and saved provider key from this device. It does not remove records already sent to an AI provider or analytics service.

Analytics records may include an opaque account ID and currently have no published fixed deletion period. Add the service’s retention and deletion process here before publishing this policy.

Children

twelf is not designed to collect personal information from children. If you believe a child sent personal data through the app, contact the operator using the address above.

Changes

If the app’s data practices change, this page will be updated with a new date. Check it when the app changes how it stores or sends information.

Contact

For privacy questions or requests: [support email]