Privacy Policy

1. Who we are

Twelvetable is operated by Tianhe Match Inc., a corporation incorporated under the laws of Canada with its registered office in Ontario (“we”, “us”). We are responsible for the personal information described in this policy under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA). Our Privacy Officer is accountable for our compliance with this policy and can be reached at [email protected].

This policy explains what we collect when you use the Twelvetable iOS app, our website and shared pages at twelvetable.com, and our API (together, the “Service”), and what we do with it. Our Terms of Service also apply.

2. Information we collect

Account and sign-in

• Sign in with Apple: a stable Apple user identifier for our app and, if you choose to share it, an email address (which may be an Apple private-relay address). Apple’s account-deletion rules require that we can revoke our access when you delete your account. For that reason only, we keep an encrypted Apple refresh token.
• Email code sign-in: your email address, used to send you one-time codes. Your email address is held by our authentication provider (Supabase). Our own app database does not store it.
• The account identifier we assign, and the date your account was created.
• Anti-abuse code: a one-way keyed hash derived from your Apple identifier or, for email accounts, from a normalized form of your email address. It lets us apply free-table limits and bans per person without storing the identifier itself.

Profile and settings

• Your display name and avatar (an emoji with a seat color, or your initial). Other people see them at tables you join, in Recaps and on share pages.
• Age confirmation: the date and time you confirmed you are 18 or older.
• Content preferences: whether you opted in to Mature and Dark tables.
• Your app language, which your device sends with requests so that we can answer in it, and the language of each table.

What you create and do at tables

• Tables you create: topic, format, seats and personas, settings (visibility, time limit, pace, cost cap), timing and status.
• Saved personas: names, titles, avatars, persona prompts, stances and preferences.
• Messages you post, questions you ask as a listener, reactions, votes and game actions (for example a clue or a vote in Who’s the Spy).
• Private notes you give to an AI seat. A private note goes only to that seat’s model and to anyone who later takes over that seat. Other participants do not see it.
• Participation records: which tables you joined, in what role (owner, seated or listener), when you joined and left, raised hands and seat take-overs.
• Recaps and rolling summaries, your edits to a Recap, and whether you shared it.
• Usage and cost records: free tables used per month, how often you used Auto-cast and Sharpen, and, for each message, the model used, token counts and estimated cost.

Safety

• Reports you file (what you reported, the reason and any note you add), and reports others file about you or your content.
• The blocks you set.
• Moderation outcomes and enforcement records, for example a hidden table or a ban.

Technical information

• Server logs: our servers record technical events such as errors, warnings and service events, which can include your account identifier and table identifiers. Our logs are designed to leave out message text, email addresses and keys, and they automatically redact anything that looks like an API key.
• IP address: processed when your device connects, for example to apply rate limits and to protect the Service. Our hosting and sign-in providers may also record it in their logs.
• On your device: the app keeps your sign-in session securely in the iOS Keychain.

Information from others

Other people may mention you in their messages, invite you to a seat or report you. If you sign in with Apple, Apple gives us your identifier and the email address you chose to share.

3. What we do not collect

• We do not collect contacts, photos, location, microphone or camera data, health information or payment information.
• We do not collect an advertising identifier. The app contains no third-party advertising or analytics code, and we do not track you across other companies’ apps or websites.
• We do not use passwords. You sign in with Apple or with a one-time email code.
• Our share pages on twelvetable.com run no scripts and set no tracking cookies.
• We do not store your AI provider key. If you connect your own provider key (when available), it stays in your iPhone’s Keychain. It is sent to our server over an encrypted connection only when a table you own starts, held only in server memory for that table, and dropped when the table ends. It is never written to our database or logs, and other users never receive it.

We do not sell your personal information, and we do not share it for advertising.

4. How we use information

• To run the Service. This covers signing you in and running live tables. It includes letting AI seats and the AI Host respond and scheduling speakers. It includes generating Auto-cast suggestions, topic rewrites, rolling summaries and Recaps. It also includes showing tables to the people who can access them, delivering invites and keeping your settings.
• To control cost and abuse. We enforce free-table limits, per-table cost caps, rate limits and the rule of one account per person, including after an account is deleted and re-created.
• To keep people safe. We check topics, personas and display names before saving them, review reports, and hide, end or remove content and tables. We also ban accounts and comply with legal obligations.
• To maintain the Service. We fix errors and measure reliability, cost and which features are used.
• To communicate with you. We send sign-in codes, important notices about your account or these policies, and replies to your requests. These are transactional messages. We do not send marketing email. If we ever do, we will first ask for your consent and include an unsubscribe link, as Canada’s Anti-Spam Legislation (CASL) requires.

We do not use table content to train AI models.

Consent. We collect, use and disclose personal information only for the purposes above, with your consent. By creating an account, you consent to the processing this policy describes, including the transfers in Section 10. Some choices, such as opting in to Mature or Dark tables, ask for your consent separately. You can withdraw consent by changing those settings or deleting your account, subject to legal or contractual limits. Some features will then stop working.

Automated moderation can refuse a topic, persona or display name, or hold a reported table for review. A person on our team reviews held tables and decides on bans.

5. AI providers

Twelvetable sends table content to AI model providers so that their models can write what the AI seats and the AI Host say. Each model call carries only what that seat or task needs:

• the table’s topic and format rules;
• the seat’s persona and any private note for that seat;
• the recent conversation and a rolling summary, which include the display names and messages of the people at the table;
• for game tables, that seat’s game role.

We do not send your email address, Apple identifier or account identifier as part of the conversation. The providers process this content under their API terms to answer our requests. We do not use it to train AI models.

About DeepSeek: DeepSeek is a Chinese company. If a seat or task runs on a DeepSeek model, the table content for that call is sent to DeepSeek and processed in the People’s Republic of China, where it is subject to Chinese law. When that happens, the seat shows the DeepSeek model name, and a system line appears if a seat switches to a fallback model.

We will update this list before a new AI provider receives your information. If you connect your own provider key (when available), the seats on your key send table content to the provider you chose, under your agreement with that provider.

6. Who else sees or receives information

Other people

• At a table: the owner, seated participants and listeners see your display name, avatar, messages, questions, reactions and seat. The owner also sees raised hands and can remove you.
• Public tables: they are listed in the Hallway while live. After they end, anyone on the web can read the Recap and the full transcript at twelvetable.com/r/… without signing in. These pages may appear in search engines, except for Dark tables, and we may feature them.
• Link-only tables: anyone who has the table link can open the table in the app. If the owner shares the Recap, anyone with the link can read the Recap (not the transcript), including on the web. These pages ask search engines not to index them.
• Blocks: a person you block does not see your tables in the Hallway and cannot join your tables. They are not told that you blocked them.

Service providers

We use the companies below to run the Service. They process information for us under contract and may not use it for their own purposes.

Legal and safety reasons

We may disclose information when we believe in good faith that the law or legal process requires it. We may also disclose it to protect the safety of any person, to address fraud, security or abuse, or to enforce our Terms. We report child sexual abuse material to the authorities as the law requires.

Business transfers

If we are involved in a merger, acquisition or sale of assets, information may transfer to the new owner, who must continue to protect it as this policy describes.

7. How long we keep information

8. Deleting your account

You can delete your account in the app at Me → Delete account. Deletion takes effect at once and the account can no longer be used. If a step fails, our servers finish it automatically.

What is removed

• Your account record, display name, avatar, age confirmation, content preferences and encrypted Apple token.
• Your sign-in account at Supabase, including the email address it holds.
• Your saved personas, draft tables, blocks (the ones you set and the ones others set on you), table participation records and usage records.
• Our Sign in with Apple access, which we revoke with Apple. If Apple cannot be reached, we keep retrying for up to 7 days with an encrypted token that has no link to you.

What is kept, and why

• Tables that have ended, including ones you owned. They stay readable to the people who could read them before, and public ones stay on the web, for up to 24 months after each table ends. Your messages stay in the transcript, but your name is removed from them, from your seats and from system lines, and you appear as “Deleted user”. If a table you owned was still running, it is ended. The words you wrote are not deleted. Other people’s messages, AI messages and Recap text may still mention the name you used. To ask us to remove specific content, write to [email protected].
• Reports you filed are kept as safety evidence, with the link to you removed. Any note you wrote stays with the report, so please leave personal details out of report notes. Reports about you or your content are also kept.
• An anti-abuse code, if your account was banned or you used free tables in the current month. This is the one-way code from Section 2, kept together with the ban date and that month’s free-table count, so that deleting your account and signing up again cannot lift a ban or reset the monthly limit. It does not contain your Apple identifier or email address.
• Records we must keep by law, and backups until they roll over.

9. Children

Twelvetable is for adults 18 and over and is not directed at children. The app asks every user to confirm that they are 18 or older before they create or join tables. We do not knowingly collect personal information from anyone under 18. If you believe a minor is using Twelvetable, tell us at [email protected]. We will close the account and delete its information, except what we must keep for safety or legal reasons.

10. Where information is stored and processed

We are a Canadian company, but your personal information is stored and processed outside Canada, mainly in the United States, by our service providers:

• our servers run on Fly.io in San Jose, California;
• our database and sign-in service run on Supabase in Oregon;
• sign-in emails are sent by Resend;
• table content goes to the AI providers in Section 5: Anthropic and OpenAI in the United States, and DeepSeek in China when a DeepSeek model is used.

While your information is in another country, it is subject to that country’s laws. It may be accessible to the courts, law-enforcement and national-security authorities of that country, including the United States. Our service providers are bound by contracts and other measures to protect your information and to use it only to provide services to us. To ask about our service providers outside Canada, contact our Privacy Officer (Section 14).

The Service is not offered in mainland China.

11. Your choices and rights

In the app

• See and correct: view and edit your display name, avatar and content preferences, and see your tables, Recaps, blocks and report history.
• Delete: delete your account (Section 8), or delete individual drafts and personas.
• Control visibility: choose Link only instead of Public for tables you own, and decide whether to share a Recap.
• Block and report: on every message, seat, table and person.

Canada

Under PIPEDA, you can ask for access to the personal information we hold about you and ask how it has been used and to whom it has been disclosed. You can also ask us to correct it if it is inaccurate or incomplete, or ask for a copy of your data. Write to our Privacy Officer at [email protected]. We may need to confirm the request comes from you, usually by asking you to write from the email linked to your account or to confirm in the app. We will answer within 30 days, or tell you if we need more time. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).

If you are in Quebec

For any question or request about your personal information, contact our Privacy Officer at [email protected]. We will provide information about our privacy practices in French on request.

US residents

Depending on the state where you live, you may have the right to know what personal information we collect, use and disclose, and to access, correct or delete it, or get a portable copy. You may also have the right to opt out of the sale of personal information, its sharing for targeted advertising, or certain profiling. We do not sell or share personal information for advertising and do not profile you in that way. To make a request, write to [email protected]. If we deny your request, you can appeal by replying to our answer. We will not treat you differently for exercising your rights.

12. Security

• All traffic between the app and our servers is encrypted in transit (HTTPS and secure WebSockets).
• Our database is closed to the public. Only our server can read it.
• Apple refresh tokens are encrypted with AES-256-GCM.
• We hold no passwords, because sign-in uses Apple or one-time codes.
• Your sign-in session on your device is kept in the iOS Keychain.
• Our logs are designed to leave out message text and to redact anything that looks like an API key.
• Access to production systems is limited to the people who need it.

No system is perfectly secure. A breach of our security safeguards could create a real risk of significant harm to you. If that happens, we will notify you and the Office of the Privacy Commissioner of Canada, as PIPEDA requires, and keep a record of the breach.

13. Changes to this policy

We will update this policy when our practices change, including before a new AI provider receives your information, and we will change the effective date when we do. For material changes, we will tell you through the app or by email at least 30 days before they take effect.

14. Contact and Privacy Officer

For privacy questions and requests, write to our Privacy Officer at [email protected]. The same address handles everything else: support, safety reports and legal questions.