Privacy Policy

i12 (“the Service”) takes your personal information seriously and complies with the Republic of Korea’s Personal Information Protection Act (PIPA) and other applicable law. This policy explains what the Service collects, why, and when it is deleted.

1. What we collect

When you sign up

If social sign-in (Apple, Google, Kakao) is added later, we will receive only your email address and display name from that provider. We will not request your friend list or anything beyond that.

What accumulates while you use the Service

• The groups you belong to, your role in each (owner or member), and when you joined
• Your presses — which signal, when, your position in that round, and when you cancelled if you did
• Round records — when a round opened, expired or succeeded, its outcome, and who ended it early
• Your availability (present or away)
• Your per-group notification preference and any mute expiry
• Invite codes you created or redeemed, and when

These records are the raw material the Service runs on. Without knowing who pressed in which order, it cannot show you the queue; without round timestamps, it cannot end a round.

When you turn notifications on

• A device push token, the device type (iOS, Android or web), and the time it was last seen

Turning notifications off deletes that device’s token.

When you report or block someone

• The account identifier of the person you blocked
• The target of a report and the reason you wrote

Generated automatically when you connect

• IP address, connection time, and app or browser information, recorded in our hosting provider’s server logs

2. Why we process it

We do not use any of it for advertising, we do not profile you or make automated decisions about you, and we do not sell it.

3. How long we keep it

Where law requires a particular record to be retained, we keep it for the period that law specifies and destroy it afterwards.

4. Disclosure to third parties

We do not disclose your personal information to third parties, except:

• where you have explicitly consented; or
• where required by law, or where an investigative authority requests it through the procedure the law prescribes.

Other members of your group seeing your display name, profile image, and whether and when you pressed is not disclosure to a third party — it is the function of the Service. Leave the group and you no longer appear on that group’s screen.

5. Processors

We entrust processing to the following companies, to the extent needed to run the Service.

If a processor changes, we will update this policy to say so.

6. Transfers outside Korea

Sending a notification transfers the information below out of Korea. Your database records themselves are stored in the Seoul region and are not moved abroad.

You may refuse these transfers. Turning notifications off in the app stops the push-related transfers entirely, and every other feature keeps working. If you want to refuse outright, write to [email protected] and we will handle it as an account deletion.

7. Destruction

When the retention period ends or the purpose disappears, we destroy the information without delay. Records in the database are deleted in a manner that cannot be reversed, and anything remaining in a backup falls away as that backup ages out of its retention window.

You can delete your account from inside the app. The procedure, and exactly what goes, is set out on the account deletion page.

8. Your rights

You may at any time ask us to:

• show you the personal information we hold about you;
• correct anything that is wrong;
• delete it, and close your account;
• stop processing it.

Display name, handle, profile image and notification settings can be changed in the app directly, and so can account deletion. For anything else, write to [email protected]; we will verify who you are and respond within 10 days.

A legal representative or an authorised agent may make the same requests the same way.

9. Security measures

• Row-level access control. Every table in the database has row-level security enabled, so no request from any user can reach data outside the groups that user belongs to.
• Writes only through server functions. The app has no permission to write round or press records directly. Every change goes through a function that checks your standing on the server.
• Encryption in transit. All traffic between the app or website and the server is TLS-protected.
• Passwords are stored in an unrecoverable form; the original is never kept.
• Least privilege. Only the minimum number of people needed to operate the Service have access.

10. Cookies and automatic collection

The i12.net website sets no cookies. There is no analytics tool and no advertising tag on it.

The app stores an authentication token in the device’s own storage so you stay signed in. That token never leaves your device and is erased when you sign out.

11. Children under 14

The Service does not accept sign-ups from children under 14 and does not knowingly collect their personal information. If we learn that we hold information about a child under 14, we delete it immediately. If you know of such a case, please tell us at [email protected].

12. Privacy officer

Questions, complaints and remedy requests about the handling of personal information go here, and are answered properly.

Personal Information Protection Officer — i12 operator
[email protected]

13. How to raise a complaint

You can apply to the bodies below for dispute resolution or advice, if our answer has not satisfied you or you would like independent help.

14. Changes to this policy

When this policy changes, we post the change on this page seven days before it takes effect. If a change is to your disadvantage, we give 30 days’ notice and tell you inside the app as well.

Effective 2026-08-27 · first version