Privacy Policy

Last updated October 4, 2026

This policy explains what TG11 Accounts (accounts.tg11.org), run by TG11 LLC, collects about you, why, who can see it, and what control you have. TG11 Accounts is an identity service: connected apps keep their own data about you under their own privacy policies.

1. Information we collect

What you give us

• Account details: email address, username and display name.
• Password: stored only as a salted, one-way hash, never in readable form.
• Optional profile details: bio, website, avatar and header images.
• Optional phone number: if you add one, we store it, and whether you have verified it.

Security information

• Two-step verification: your authenticator secret (stored encrypted) and recovery codes (stored as hashes).
• Sessions: for each sign-in, the time, the IP address and the browser or device description, so you can see and revoke your sessions.

Activity and connections

• Which apps you have signed in to and what you approved, plus the sign-in tokens issued to them (stored as hashes).
• The date you created your account and when you last signed in.

Optional features

• AI key vault: API keys you add for AI providers, stored encrypted, along with a label and a short hint so you can recognize them. Keys are never shown back to you in full.
• Payments: where available, references from the payment provider (customer and method IDs, and a label such as a card brand and last four digits), and records of payment holds requested by apps you approved. We do not store full card numbers.
• Benefits and usage: supporter benefits, usage allowances and a credit ledger.

Technical data

• Our web server records the IP address, time, requested page and browser description for each request. We keep these logs for about 14 days for security and troubleshooting.

2. How we use it

• To create your account, sign you in, and keep your account secure.
• To tell connected apps who you are, limited to what you or the app's setup allows.
• To send emails you need, such as verification and password reset messages.
• To prevent abuse, investigate problems, and meet legal obligations.
• To answer your support requests.

TG11 Accounts does not show ads and does not sell your personal information.

3. What connected apps receive

An app only receives the categories you approve or that it is set up to request, which can include your account ID, username, display name, email, phone number, profile details, account status, your stored AI keys (if you authorize that), or the ability to request payments (if you authorize that). You can see and revoke app access on your connections page.

4. Cookies

This site uses only the cookies it needs to work. They are strictly necessary, so there is no consent banner for them:

These cookies are marked HttpOnly and Secure, and are not used for advertising. Our network provider, Cloudflare, may set its own security cookies.

We also use Cloudflare Web Analytics to see aggregate traffic, such as page views and performance. It is privacy-focused: it does not use cookies or local storage, does not fingerprint visitors and does not track you across sites.

5. Who we share information with

We do not sell your information. We use these kinds of service providers to run TG11 Accounts, and they receive only what they need:

• Hosting and network: our servers, and Cloudflare for traffic delivery, security and aggregate analytics.
• Email: sent through TG11's own mail server.
• SMS: if phone verification is enabled and you use it, your phone number and the verification code go to our SMS provider (Twilio) so the message can be delivered.
• Payments: if you add a payment method, the provider (such as Stripe or PayPal) handles your payment details under its own privacy policy.
• AI providers: we do not send anything to them. When an app you authorize uses a key from your vault, that app sends its requests to your chosen provider.

We may also disclose information when the law requires it, or to protect people and the service from serious harm.

6. How long we keep it

• Account and profile data: while your account exists.
• Sessions: up to 30 days, or until you sign out or revoke them.
• Sign-in tokens: short-lived. Authorization codes last about 10 minutes, access tokens about one hour, and refresh tokens up to 30 days.
• Web server logs: about 14 days.
• Deleted accounts: after you ask us to delete your account, we delete or anonymize your data within 30 days, except what we must keep for legal or security reasons. Copies in backups may remain for a limited time until they are overwritten.

7. Your choices and rights

• Edit your profile and change your password from your account page.
• Turn two-step verification on or off, and revoke any session or connected app.
• Remove stored AI keys and payment methods from your account pages, where available.
• To get a copy of your data, correct it, or have your account deleted, email [email protected] from your account's email address. We may ask you to confirm it is you.

Depending on where you live (for example the EU, the UK or California), you may have further rights, such as access, correction, deletion, portability and objection. Email us to use them. Each connected app keeps its own data, so ask that app's support about data it holds.

8. Security

We use HTTPS, hash passwords, and encrypt stored secrets such as AI keys and authenticator secrets. No system is perfectly secure, so please use a strong, unique password and turn on two-step verification. If you find a security problem, please email [email protected] with "Security" in the subject.

9. Children

TG11 Accounts is not meant for children under 13, or under the minimum age in your country if that is higher. If we learn that we have an account from someone below that age, we will delete it.

10. Where your information is processed

TG11 LLC is a US company. Your information may be processed in the United States and in other countries where our service providers operate.

11. Changes

We may update this policy. The date at the top shows the latest version, and for significant changes we will try to tell account holders by email or on this site.

12. Contact

Privacy questions or requests: [email protected].