Privacy Policy

i12 (“the Service”) takes your personal information seriously and complies with the Republic of Korea’s Personal Information Protection Act (PIPA) and other applicable law. This policy explains what the Service collects, why, and when it is deleted.

1. What we collect

When you sign up

If social sign-in (Apple, Google, Kakao) is added later, we will receive only your email address and display name from that provider. We will not request your friend list or anything beyond that.

What accumulates while you use the Service

• The groups you belong to, your role in each (owner or member), and when you joined
• Your presses — which signal, when, your position in that round, and when you cancelled if you did
• Round records — when a round opened, expired or succeeded, its outcome, and who ended it early
• Your availability (present or away)
• Your per-group notification preference and any mute expiry
• Invite codes you created or redeemed, and when

These records are the raw material the Service runs on. Without knowing who pressed in which order, it cannot show you the queue; without round timestamps, it cannot end a round.

When you turn notifications on

• A device push token, the device type (iOS, Android or web), and the time it was last seen

Turning notifications off deletes that device’s token.

When you report or mute someone

• The account identifier of the person you muted
• The target of a report and the reason you wrote

Generated automatically when you connect

• IP address, connection time, and app or browser information, recorded in our hosting provider’s server logs

2. Why we process it

We do not use any of it for advertising, we do not profile you or make automated decisions about you, and we do not sell it.

3. How long we keep it

Where law requires a particular record to be retained, we keep it for the period that law specifies and destroy it afterwards.

Reports outlive the account

A report filed about someone is not deleted when that person deletes their account. It is destroyed automatically 12 months after the day that account goes.

Without this, deleting your account would delete the reports about you. Both app stores require account deletion to be one tap away inside the app — so a reported user could erase every complaint against them by closing their account, which hands harassment a reset button.

During those 12 months, this is everything that is kept:

• The reason — what the person reporting wrote, in their own words
• The time it was filed
• What was complained about — the name or signal label as it read at the time
• An account identifier (UUID), which is not linked to any name or email, because the profile carrying those has already been deleted

No profile, email address or display name is retained. Those are deleted with the profile, and what remains does not identify anyone on its own.

The 12-month clock starts only when the reported account is deleted. A reporter closing their own account does not start it: the record is about the person complained about, and while they are still using the service it is still a live record.

Mutes are different. A mute is your own setting about your own notifications, not a record of anything, so it is deleted when either party leaves.

This retention is what Google Play permits explicitly under the “security” exception to its account-deletion requirement, and what Apple’s App Review guideline 1.2 effectively requires — a report mechanism the reported user can erase does not work. Both attach the same condition: that the privacy policy says so. This paragraph is that.

4. Disclosure to third parties

We do not disclose your personal information to third parties, except:

• where you have explicitly consented; or
• where required by law, or where an investigative authority requests it through the procedure the law prescribes.

Other members of your group seeing your display name and whether and when you pressed is not disclosure to a third party — it is the function of the Service. Leave the group and you no longer appear on that group’s screen.

5. Processors

We entrust processing to the following companies, to the extent needed to run the Service.

If a processor changes, we will update this policy to say so.

6. Transfers outside Korea

Sending a notification transfers the information below out of Korea. Your database records themselves are stored in the Seoul region and are not moved abroad.

You may refuse these transfers. Turning notifications off in the app stops the push-related transfers entirely, and every other feature keeps working. If you want to refuse outright, write to [email protected] and we will handle it as an account deletion.

7. Destruction

When the retention period ends or the purpose disappears, we destroy the information without delay. Records in the database are deleted in a manner that cannot be reversed, and anything remaining in a backup falls away as that backup ages out of its retention window.

You can delete your account from inside the app. The procedure, and exactly what goes, is set out on the account deletion page.

8. Your rights

You may at any time ask us to:

• show you the personal information we hold about you;
• correct anything that is wrong;
• delete it, and close your account;
• stop processing it.

Display name and notification settings can be changed in the app directly, and so can account deletion. For anything else, write to [email protected]; we will verify who you are and respond within 10 days.

A legal representative or an authorised agent may make the same requests the same way.

9. Security measures

• Row-level access control. Every table in the database has row-level security enabled, so no request from any user can reach data outside the groups that user belongs to.
• Writes only through server functions. The app has no permission to write round or press records directly. Every change goes through a function that checks your standing on the server.
• Encryption in transit. All traffic between the app or website and the server is TLS-protected.
• Passwords are stored in an unrecoverable form; the original is never kept.
• Least privilege. Only the minimum number of people needed to operate the Service have access.

10. Cookies and automatic collection

The i12.net website sets no cookies. There is no analytics tool and no advertising tag on it.

The app stores an authentication token in the device’s own storage so you stay signed in. That token never leaves your device and is erased when you sign out.

11. Children under 14

The Service does not accept sign-ups from children under 14 and does not knowingly collect their personal information. If we learn that we hold information about a child under 14, we delete it immediately. If you know of such a case, please tell us at [email protected].

12. Privacy officer

Questions, complaints and remedy requests about the handling of personal information go here, and are answered properly.

Personal Information Protection Officer — i12 operator
[email protected]

13. How to raise a complaint

You can apply to the bodies below for dispute resolution or advice, if our answer has not satisfied you or you would like independent help.

14. Changes to this policy

When this policy changes, we post the change on this page seven days before it takes effect. If a change is to your disadvantage, we give 30 days’ notice and tell you inside the app as well.

Effective 2026-09-28

Previously 2026-09-03. Changed: the optional sign-up items — a handle (@name), a profile image, and whether you may be found by handle search — were removed from Section 1, and a handle and a profile image were struck from the rest of the policy with them: from the purpose table in Section 2, from Section 4’s note on what other members of your group see, and from Section 8’s list of what you can change in the app. The app has never had a screen, a control or an upload for any of them, and nothing has ever been collected under those headings. They were described here because the database reserved columns for them, which is not the same thing as collecting them. Nothing was deleted, because there was nothing to delete.

Previously 2026-08-27. Changed: “block” became “mute” throughout. The data is the same — the account identifier of one person, deleted with your account — but the feature it belongs to no longer restricts anything. Muting stops that person’s taps notifying you and does nothing else.