What we mean when we say private
Most apps mean 'we don't show it in the interface.' Here is what 12Gradus means instead, and how you can tell the difference.
By 12Gradus
Every app says it takes your privacy seriously. The sentence has been worn so smooth it means nothing. So instead of saying it, here is the specific thing we do, in enough detail that you could check.
Two kinds of private
When software says a piece of your data is private, it usually means one of two things.
The weak kind: the server holds everything, and the app is written not to show it to the wrong person. The data is one query away from anyone who can talk to the server directly. A bug in a screen, a forgotten filter in a new feature, a curious engineer, or a determined person with the browser's network tab — any of these can reach it. Nothing was ever actually blocked; it was just not displayed.
The strong kind: the database itself refuses. The rule lives below the app, so it holds no matter what code asks. A new feature written badly can't leak it, because the leak isn't the app's decision to make.
12Gradus does the strong kind for private recovery content. It's called row-level security, and it means the database evaluates who is asking on every single read and write, per table, per row, per column, per operation.
What is actually private
Concretely:
- Journal entries a sponsee marks private. Their sponsor cannot read them. Not in the app, not through the API, not by accident. The row is not returned to that person, full stop.
- Private reflections inside step work. When a sponsor builds a form, they can mark a question a private reflection. The sponsee's answer goes into a separate table the sponsor has no read access to. The sponsor sees a tick that it was answered — nothing more. That tick is the point: it tells the sponsor the work was done without telling them what was in it.
- Mailing addresses. A sponsee's address is readable only by that sponsee. When auto-gift sends a milestone magnet, the address goes to the print house on a parcel label. The sponsor never sees it.
- Sponsor coaching notes. These run the other way — notes a sponsor keeps about a sponsee are on the sponsor's side and are not shown to the sponsee.
How you can tell we mean it
Anyone can write the paragraph above. Here's the part that's harder to fake.
We wrote an adversarial test suite: a program that signs in as three real accounts — a sponsor, their sponsee, and a stranger with no relationship to either — and then tries, twenty-six different ways, to read and write things it shouldn't. Read the private journal. Mark your own step work complete. Change who owns a relationship. Edit somebody else's message. Insert a message pretending to be from the other person.
The first time we ran it against our own rules, ten of the twenty-six attacks succeeded. That was uncomfortable and it was the entire value of running it. We rewrote the policies until all twenty-six failed to get through, which is where they stand now, and the suite runs against changes so a future feature can't quietly reopen one.
That number — ten — is the reason to trust the rest of this page more than a marketing promise. We're telling you we got it wrong, because how a company behaves when it finds its own hole is the only real signal available to you.
Anonymity, separately
Privacy and anonymity aren't the same thing, and recovery communities need both.
12Gradus shows first name and last initial, everywhere a name appears, the way the rooms do. There are no public profiles, no directory, no search-for-a-person, no follower counts, no way to be discovered by someone who shouldn't know you're here. The only way two accounts become connected is one person giving another an invite code, in person or however they already talk.
What we don't do
- We don't sell data. There is no advertising business here and no plan to build one.
- We don't train AI models on recovery content — not journals, not step work, not chat. Not anonymised, not aggregated, not later. Where AI is used is written out on the AI page.
- We don't email your sponsee about your account, or your sponsor about your journal.
- We don't keep a relationship alive after you end it. Ending a pairing deletes the shared chat and leaves the sponsee's own journal, reflections and step history intact — theirs, not ours, and not their former sponsor's.
Where we're honest about limits
Some things we do not claim, because they aren't true:
- Messages are not end-to-end encrypted. They're encrypted in transit and at rest and access-controlled per row, but our servers can technically read them. We used to have vaguer language on this and we removed it. If you need genuine end-to-end secrecy, use a tool built for that.
- We can be compelled by law. Every company can. Anonymity in the app is real protection against the ordinary risks — a curious acquaintance, a leak, a data broker — and it isn't a shield against a court.
- Your device is your device. If someone else can unlock your phone, they can read what's on it. That's outside anything we can fix from here.
If any of the above stops being true, we'll change this page and say what changed. Should you catch us before we do: <a href="mailto:support@12gradus.com">support@12gradus.com</a>.