Who we are

12steps is operated by Community Tech Ltd (company number 16760348), registered at 80 Greenham Road, Newbury, England, RG14 7HX. Community Tech Ltd is the data controller for the personal data described in this policy. For data protection enquiries, contact info@12steps.life.

Your journal, step work, inventories, amends and other private entries are encrypted on your device before they are ever sent to our servers. How far that protection goes depends on the account mode you chose at sign-up. Private accounts are zero-knowledge: the key exists only on your devices, we store ciphertext we have no way to decrypt, and we could not read your work even if asked. Standard accounts (the default) use the same on-device encryption, but a protected server-side key lets us restore your access when you reset your password by email — which means our systems could technically decrypt that content. We never use that key to read your work; it exists solely for account recovery. Peer support is different in both modes: posts and replies in that shared queue are visible to peer responders and moderators.

Information we collect

Email address: used to sign you in and to send reminders you opt into. It is encrypted at rest on our servers and indexed only so you can log in.
Password: never stored. We keep only a one-way hash used to verify sign-in. On a Private account your password also derives the key that encrypts your data, and that key never leaves your device.
Your private recovery content: journal entries, step work, inventories, prayers, meetings and similar private entries are encrypted on your device. On a Private account the key is held only by you and we store ciphertext we cannot read; on a Standard account a protected server-side key exists so that email password recovery can restore your access.
Peer support messages: if you post or reply in peer support, the alias, topic and message text are visible to peer responders and moderators so they can answer and keep the queue safe. We also record the language your app was set to when you posted, so responders can see which language to reply in.
Notification token: if you enable reminders, your device's push token is stored so we can deliver them. Reminders contain only generic prompts, never your content.
Reminder time zone: if you set up reminders, we store the time zone your device reports (for example Europe/London) with your reminder settings and schedules, so each reminder arrives at the right local time. For a saved meeting with a known time zone, we store that meeting’s zone with its reminder schedule. This can tell us roughly where the meeting is; its name, notes and your recovery content remain encrypted.
Language: if you choose a language other than English, or sign up while the app is in one (never a language we guessed from your location), we store that preference with your account so we can write your emails and reminders in it. It is account information, not part of your encrypted backup.
Choosing your language: if your device is set to a language the app does not offer and you have not picked one, the app asks our server which country your internet address belongs to, so it can start in Spanish or Portuguese where that fits. Our server looks this up in a country list kept on the server itself, so your address is not sent to anyone else. The app does not keep your address or the result, and the guess is never saved to your account. Like every request to our site, the address appears in our standard request logs (see Basic technical logs). You can change the language at any time.
Language count: once per browser or app install, the app sends the short code for your device's language (for example "es") so we can see which languages people need. It is added to a running total with no account, address or device identifier attached. Your browser or app keeps a note that it has been counted, so it is not normally sent again.
Sign-up and return counts: the app counts anonymous steps such as "sign-up screen shown", "account created" and "opened again a week later". Each count carries only where you first came from (for example a meeting page or an Apple ad) and whether it was the website, iPhone or Android app, with no account, address or device identifier attached. Your browser or app keeps a small note so each step is counted once. On iPhone the app asks Apple once whether it was installed from one of our Apple ads and keeps only the yes or no, which is not an advertising identifier.
Meeting location: if you choose a town or postcode, the selected place and its approximate coordinates are saved on your device. When signed in, places you keep are also stored in your encrypted profile. Place search text passes through our server to Postcodes.io for UK postcodes, or Photon, provided by komoot using OpenStreetMap data, for other places. We cache search results briefly without your account details and do not log search text. The provider receives the query and our server's address, not your account or device address. If you choose Use my location, your precise position stays in memory. The finder rounds the search area before sending it to our server to retrieve meetings and identify the country. A search for a meeting name sends those words to our server to filter the directory. We do not save or log those words, include them in request URLs, or send them to place providers. Opening the map requests tiles from the OpenStreetMap Foundation, which receives normal technical request information, including your IP address, and can infer the approximate map area. It does not receive your account or recovery work.
Basic technical logs: standard request logs, including your IP address, needed to operate and secure the service.
Website usage: 12steps.life uses our self-hosted, cookie-free Umami service to count page views and show us which parts of the website are used. It never receives your email address or private recovery content, and it is not loaded in the iOS or Android app.
Spam check: the public Android waitlist and closed-test forms on 12steps.life use Cloudflare Turnstile so we can tell people from bots. Cloudflare receives the challenge result and normal technical request information, such as your IP address. It does not receive your 12steps password or private recovery work, and Turnstile is not loaded in the iOS or Android app.

What we never do

We do not use advertising, cross-site trackers, session replay, or an advertising identifier.
We do not track you across apps or websites.
We do not continuously track your location or keep a location history.
We do not sell or rent your information.
We never read your private recovery content — not for ads, training, or any other purpose. On a Private account we could not read it even if we wanted to.

How your data is protected

Your private recovery content is encrypted with AES-256-GCM before it leaves your device. On a Standard account, a protected server-side key allows us to restore your access after an email password reset. On a Private account, the key is derived from your password (Argon2id) and held only in your device's memory, with a 12-word recovery phrase as the offline backup. Because of that design, on a Private account, if you lose both your password and your recovery phrase, your encrypted private recovery data cannot be recovered by anyone, including us.

Data retention and deletion

You can delete your account at any time from Settings → Delete Account, which permanently removes your account and all associated data. See the account deletion help page for details.

Children

12steps is intended for adults (18+) and is not directed to children.

Your rights

You can export your data at any time from within the app and delete your account on demand. For other requests regarding your personal data, contact us using the details below.

Changes

We will update this policy as the app evolves and post the new effective date here.

Contact

Questions about privacy? Email info@12steps.life.

Privacy Policy