Privacy Policy
Effective date:
12x is an iPhone and iPad year planner developed by Andrew Arrow. This policy explains how the app and this website handle information, and how to contact us about privacy.
Planning as a guest
You can use 12x without an account. Guest plans are stored on your device and can be edited offline. They are not sent to our server unless you sign in or create an account. Your selected year and preferred destination state are also saved as device preferences.
Accounts and synced plans
If you choose Login / Create Account, we receive your email address and password to create an account or authenticate an existing one. We store your email address, an account identifier, a profile label, the account creation time, and a salted password hash. We do not store your password in plain text.
Signing in or creating an account automatically imports guest plans from all supported years into that account. Account events are stored on our server and linked to your account identifier. Each event includes its year, month, event size, name, and destination identifier, if present. The server also keeps import identifiers so retrying an interrupted import does not recreate events you later remove.
The app retrieves account plans when you sign in, open the app with a saved session, or return to the foreground. Creating, editing, and removing account events sends those changes to the server and requires an internet connection. Guest events awaiting import may remain on your device, associated with the intended account, until the import succeeds.
We use account and event information to authenticate you, save and synchronize your plans, and operate the service. The app does not include advertising, third-party analytics, or advertising trackers. We do not sell your personal information or use your plans to target advertising.
Login sessions and security
After sign-in, the app stores a session token and basic account information in Apple’s Keychain on that device. The server stores a hash of the token with your account identifier and session creation time. Sessions do not have an automatic expiry and remain valid until you log out or the session is revoked.
Log Out requires a connection so the server can revoke that device’s session before the app removes its saved credentials. Logging out on one device does not revoke sessions on other devices or delete your account or server-stored plans.
The released app uses HTTPS to communicate with our API. To limit abusive login attempts, the server stores hashed email and IP-address identifiers, attempt counts, and time windows. These security records are periodically cleaned up as login requests are processed.
Hosting and service providers
We use Cloudflare Workers to operate the account API and Cloudflare D1 to store account records, password and session hashes, account events, import identifiers, and login-abuse records. Cloudflare processes this information to provide hosting and database services. Network requests may also involve technical information such as your IP address, request time, and error information for service delivery, security, and troubleshooting. See Cloudflare’s Privacy Policy.
We may also disclose information when required by law or when reasonably necessary to address fraud, security incidents, or threats to people’s rights or safety.
Optional approximate location
When you browse destinations, 12x may ask for permission to use your approximate location while you use the app. This helps select your current U.S. state when it is supported by the destination catalog. You can decline permission and choose a state manually.
The app uses Apple’s location and geocoding services to turn a location into a state. Apple may process location information to provide those services under its own policies. 12x does not send your coordinates to the developer, save a location history, or continuously track your location. The selected state is saved on your device.
You can change permission in your device’s Settings under Privacy & Security → Location Services → 12x. For information about Apple’s processing, see Location Services & Privacy.
Destination websites and Apple services
Destination names, website links, and available logos are bundled with the app. Opening a destination’s website takes you to your default browser. The destination website may collect information, use cookies, or process bookings under its own privacy policy; 12x does not control that website.
Apple may process App Store information, device backups, or diagnostics according to your settings and its own policies. See Apple’s Privacy Policy. We do not receive your payment card details from Apple.
Keeping and deleting your information
Guest plans remain locally until you change or remove them, import them into an account, or delete the app. Guest plans awaiting import are kept locally until the upload succeeds. Device preferences remain until changed, removed, or deleted with the app’s local data. Offloading the app may keep its local data. Depending on your settings, local data may also be included in device backups, which you manage through your backup provider. We cannot retrieve guest plans that have never been uploaded.
To remove an individual experience, open its month and choose Remove event. When signed in, a successful removal deletes that event from the active server plan, and the change appears on other signed-in devices when they next refresh.
Account records and synced events are retained to provide your account until removed or your account is deleted. Deleting the app or logging out does not delete server-stored information. Deleting the app also does not revoke its server-side session. Use Log Out before removing the app if you want to revoke that session.
The current app does not have an in-app account-deletion control. To request access to, correction of, or deletion of your account and associated information, email 12x@andrewarrow.dev. We may need to verify that you control the account before acting. We may retain limited information where necessary for legal obligations or security; deleted information may also remain in service-provider backups until those copies are replaced or expire.
This website
This website does not set advertising or analytics cookies and does not include third-party analytics scripts. Its images and stylesheet are served from this site.
The hosting provider may process standard request information, such as your IP address, browser information, requested page, and request time, to deliver and secure the website. Handling and retention of hosting logs depend on the hosting provider’s configuration and policies.
Support messages
If you email us, we receive your email address and the information you choose to include, such as a message or screenshot. We use it to answer your request and keep it as needed to provide support, maintain correspondence, or meet legal obligations. Our email provider processes the correspondence to deliver and store it.
To ask about or request deletion of information you have sent us, email 12x@andrewarrow.dev. Please include only the information needed to explain your question.
Children’s privacy
The app does not ask for a date of birth. Account creation collects an email address and password as described above. If you believe a child has provided personal information to us without appropriate permission, contact 12x@andrewarrow.dev so we can investigate and delete it as appropriate.
Changes to this policy
We will update this page and its effective date if the app or our privacy practices change. Material changes will be communicated where required.
Contact
For privacy questions or requests, contact Andrew Arrow at 12x@andrewarrow.dev.