1. Who we are and what this covers
Controller — Twelfth, a software studio in Tashkent, Uzbekistan, contact: info@twelfth.uz. This policy applies to the following sites and services:
- twelfth.uz — the studio website and its contact form.
- EduStatus (edustatus.uz and connected organisation domains such as miitt.uz) — a management platform for educational organisations.
- Mulk (mulk.edustatus.uz) — a real-estate listings service.
- Frozen City (game.twelfth.uz) — a browser game.
- Graduss (graduss.uz) — a professional social network, under development.
- SmartPedi — a children’s health mobile app for parents (Android and iOS).
- Cauldron — an internal work tool for organisation staff (not a public service).
- Mail (mail.twelfth.uz) — the studio’s own e-mail server.
In several services we process data on behalf of an organisation (for example, student records in EduStatus belong to the school). In those cases the organisation is the data owner and we act as its technical processor on its instructions. The distinction is spelled out in sections 4 and 9.
2. Core principles
- Minimal collection. We do not ask for data a service does not need in order to work.
- Our own server, in Uzbekistan. Our web services run in Tashkent on a server the studio operates itself; databases are not placed in foreign clouds. The one exception is the SmartPedi mobile app, which runs on Google Firebase; section 4.5 says so explicitly.
- No tracking, no ads. Our sites use no Google Analytics, Yandex Metrica, ad networks or social-media pixels.
- Never sold. Personal data is not sold, rented or exchanged for marketing purposes.
- Law. We comply with the Law of the Republic of Uzbekistan “On Personal Data” (ZRU-547).
3. The twelfth.uz website
The site is static: there are no accounts, no cookies and no tracking scripts. Fonts are served from the site itself, so your browser never contacts Google servers.
Contact form
The form asks for a name, a contact (phone or e-mail) and a message. Nothing is written to a database on the server: the message is forwarded via Telegram to the team’s work chat and used only to reply to you. To limit abuse, the time of the request is kept for a short period.
4. Service by service
4.1. EduStatus
The platform is used by educational organisations. The organisation enters data about its staff, students and clients; we store and process it for that organisation.
| Data | Purpose |
|---|---|
| Full name, phone, e-mail | Account, sign-in, notifications |
| PINFL (personal ID number), date of birth | Unambiguous identification of students and staff, documents (as required by the organisation) |
| Contracts and payment records | Tuition accounting and reports |
| Bank statements | If the organisation has connected its own bank account: automatic matching of incoming payments. The statement belongs to the organisation’s own account and is visible only to it |
| Face descriptor | Camera-based attendance. Recorded only with the user’s consent; the server stores not a photo but a 128-number mathematical descriptor from which an image cannot be reconstructed |
| Telegram chat identifier | Sign-in codes and notifications |
Each organisation’s data is isolated in the database: one organisation cannot see another’s records, and this is enforced at the database level (row-level security). Sign-in is passwordless: a one-time code sent to the phone number via a Telegram bot plus a personal PIN.
4.2. Mulk
- Account: phone number, first and last name, year of birth. Sign-in by one-time code via a Telegram bot.
- Listings: the text, price, address, map point and photos you enter. Photos are re-encoded on the server, which strips embedded technical data (EXIF, geotags).
- Phone masking: your number appears partially hidden in the listing. Revealing the full number is a separate request, rate-limited per IP address per hour.
- View counter: to tell repeat views apart, the IP address is kept in memory as a marker for 6 hours, then discarded.
- Location: browser geolocation is requested only when you press “detect address”, and only for that listing.
- Browser storage: theme (dark/light), favourites and an unfinished listing draft stay in your browser and are not sent to the server.
4.3. Frozen City
Accounts are created via Telegram: the Telegram ID and username, first and last name, date of birth and game login are stored. Your game state (city, resources, progress) is stored as well, otherwise the game could not be resumed. The game server sees only the in-game connection; no other information about your device is collected.
4.4. Graduss
The service is under development. On registration we store an e-mail, username and password (hash only); the profile (name, field, bio, location, links), posts, channels, private messages and crowdfunding pledges are stored as you enter them. No payment system is connected yet; when one is, this section will be updated and card details will not be stored on our server.
4.5. SmartPedi
SmartPedi is a children’s health mobile app for parents. It does not run on our server but on Google Firebase, which is why its storage location is called out separately here.
- Account: sign-in credentials via Firebase Authentication (phone number or e-mail) and an in-app profile.
- Child profile: the name, date of birth and sex entered by the parent; one account may hold several children. Only the account owner can see this data.
- Health records: symptoms, illnesses and observations you log, plus any photos or videos you upload. This is sensitive data: it is used only to display it back to you and for reminders, and it does not replace a medical diagnosis.
- Reference content: articles about illnesses and multimedia are published by the app’s administrators; this is not personal data.
- Notifications: push messages are delivered through Firebase Cloud Messaging, for which a device token is stored. You can switch them off in your phone settings.
- Storage location: data is stored on Google Firebase servers (Firestore and Storage) located outside Uzbekistan. Google acts as a processor under its own terms; Firebase may collect technical information (device identifier, app version, crash reports).
- Deletion: if you delete the account in the app or via info@twelfth.uz, the child profiles and health records are deleted as well.
4.6. Cauldron
This is not a public service but a work tool that organisations install for their staff. There are two categories of data.
- About the employee: login, device identifier, program version, work status, counters, the program log and a snapshot of the work browser. This is shown to the organisation’s manager to supervise the workflow. Employees are informed of this when the program is installed; citizens’ PINFL numbers in snapshots are truncated before sending.
- About citizens: PINFL, address and similar records entered by the employee are processed for entry into a state system within the organisation’s lawful duties. The organisation owns this data; we store it only for that purpose, on the organisation’s instructions, and use it for nothing else.
4.7. Mail
The studio runs its own mail server. Messages and attachments stay in the owner’s mailbox until the owner deletes them. The server logs spam and credential-guessing attempts and temporarily blocks an IP address after repeated failed logins. Message content is not analysed automatically and is not used for advertising.
5. Technical data and logs
Like any web server, ours keeps a request log: IP address, time, requested page, browser type and response code. The logs are needed to find errors, detect attacks and keep the service stable. They are kept for 14 days and deleted automatically. Services use a session cookie (readable only by the server, protected by HTTPS) to remember that you are signed in, not to identify or track you.
6. Third parties
| Who | Why | What is shared |
|---|---|---|
| Telegram | Sign-in codes, notifications, contact-form messages | Phone number or chat identifier and the message text. Telegram has its own privacy policy |
| Google Firebase | SmartPedi: sign-in, database, files, push notifications | Account, child profile and health records are stored on Google servers under Google’s privacy policy |
| OpenStreetMap | The map in the Mulk service | Map tiles are loaded from OpenStreetMap servers, which see your browser’s IP address. We send them nothing |
| Banks | Connecting an organisation’s account in EduStatus | Only if the organisation connected the account itself, only for that account, over a protected channel |
| Let’s Encrypt | HTTPS certificates | Domain name only, no personal data |
No personal data is passed to any other external service. Requests from state authorities are fulfilled only in the manner prescribed by law and on an official basis.
7. Retention periods
- Server logs (IP and requests) — 14 days.
- Sign-in sessions — until you sign out or they expire.
- One-time codes — a few minutes, then deleted.
- Your account and the data you entered — while the account is active or until you ask for deletion. In SmartPedi, child profiles and records are deleted together with the account.
- Organisation data (EduStatus, Cauldron) — for the term of the contract with the organisation and for the record-keeping periods required by law.
- Backups — encrypted, for a limited period, after which they are deleted automatically. Deleted data disappears from backups within the same period.
8. Security
- All connections use HTTPS (TLS 1.2 and 1.3) with HSTS enabled.
- Passwords are stored only as hashes, and many services have no password at all (one-time code and PIN).
- Administrative access to the server is possible only over a private network and with a key; each service runs in its own isolated environment.
- Organisations’ data is isolated from one another at the database level.
- Backups are encrypted; the system is monitored continuously, and signs of failure or attack are reported to the team immediately.
If an incident affecting the security of your data occurs, we will notify the affected users and organisations without delay: what happened, which data is involved and what is being done.
9. Your rights
At any time you may ask us:
- which of your data we hold;
- to correct inaccurate or outdated data;
- to delete your account and data (except accounting records the law requires us to keep);
- to withdraw consent given earlier (for example, to delete a face descriptor);
- to object to the processing of your data.
Write to info@twelfth.uz. To make sure data is not handed to the wrong person, we first verify you through your account. If your data is processed on behalf of an organisation (such as a student record in EduStatus or an entry in Cauldron), we forward the request to that organisation and provide technical help in fulfilling it.
10. Children
Our services are not meant to be used by children themselves. In SmartPedi, information about a child is entered only by a parent or legal guardian in their own account; the child is not a user of the app. In EduStatus, data about minor students is entered only by the educational organisation on the basis of parental or guardian consent. If we learn that data about children has been collected in any other service, we delete it.
11. Changes and contact
When a new service is added or the way we handle data changes, this page is updated and the date above changes. We announce significant changes separately inside the service. Questions and requests: info@twelfth.uz or @TwelfthChannel. The document is published in three languages; in case of discrepancy the Uzbek text prevails.