Twelve Two Labs

Accessibility and standards

Every product page lists the standards that product is built and checked against. This page says what each one means in plain words, and which products meet it.

Two honest notes. These are our own checks, run before each release with automated tests and a hand-run pass; none is a certificate from a third party. And a standard listed on a product that has not shipped yet describes what its release is held to, not an audit of a public build.

WCAG 2.1 AA

The international accessibility checklist for the web, at the level most laws point to: readable contrast, keyboard operation, labels a screen reader can read, and no meaning carried by color alone.

The Web Content Accessibility Guidelines are published by the W3C, the body that sets web standards. Level AA is the one most accessibility laws and procurement rules refer to. Meeting it means text is readable against its background, everything can be done from a keyboard, every control has a name assistive technology can announce, pages have a sensible heading structure, and nothing depends on seeing a color or a picture. Our web products are checked against it with automated tests and a hand-run pass before each release.

Read the standard

Met by: Headwaters, SameMoment (coming soon), Hatch Chart, Kept (coming soon), Community Fly Fishing Events

WCAG AA color contrast

Text is at least 4.5 times brighter or darker than what is behind it, so it stays readable in sunlight, on a dim screen, or with low vision.

Contrast is the one accessibility rule everyone meets eventually: on a phone outdoors or with tired eyes, faint text disappears. The WCAG AA threshold is a 4.5 to 1 ratio for ordinary text and 3 to 1 for large text. Our apps measure this in automated screen walks in light and dark mode, and a few colors have been darkened specifically to pass.

Read the standard

Met by: Rough Day Kit (coming soon), Outside Today (coming soon), Ebb, Ten Frames, Worry Loop

Dynamic Type and large text

Text follows the size you set in iOS Settings, up to the largest accessibility sizes, and screens rearrange themselves instead of cutting words off.

Dynamic Type is the iOS setting that makes text bigger or smaller across every app that supports it. Supporting it properly means more than scaling a font: side-by-side controls have to stack, titles have to wrap instead of truncating, and nothing important can be folded away. Our iPhone apps are walked at the two largest accessibility sizes in English and German before each release.

Read the standard

Met by: Rough Day Kit (coming soon), VeraFlow (coming soon), Outside Today (coming soon), Ebb, Ten Frames, Worry Loop

VoiceOver

Apple’s screen reader can use the whole app: every control has a spoken name, screens read in a sensible order, and nothing is image-only.

VoiceOver reads the screen aloud for people who cannot see it. An app supports it when every button, switch and list row has a label that says what it does, when the reading order matches the visual order, when images that carry meaning have descriptions, and when long text is never hidden from the reader even if it is folded on screen. Our iPhone apps are built to these rules and checked with VoiceOver on a real phone before release.

Read the standard

Met by: Rough Day Kit (coming soon), VeraFlow (coming soon), Outside Today (coming soon), Ebb, FoldPass (coming soon), Ten Frames, Worry Loop

Reduce Motion

When you turn on Reduce Motion in iOS, animation is toned down or removed. Nothing in the app depends on seeing something move.

Motion makes some people dizzy or sick. iOS has a Reduce Motion setting, and an app honors it by replacing animated transitions with simple fades and by letting anything that moves, such as a breathing pacer, be followed another way. Our apps read this setting and change their behavior accordingly.

Met by: Rough Day Kit (coming soon), Outside Today (coming soon), Ebb, Ten Frames, Worry Loop

Keyboard navigation and ARIA

Everything works without a mouse, with visible focus so you can see where you are, and controls carry the roles assistive technology needs to understand them.

Many people operate the web with a keyboard, a switch or a screen reader rather than a mouse. Supporting them means every control is reachable with Tab and arrow keys, the focused element is clearly outlined, and tabs, menus and toggles use the WAI-ARIA roles and states (such as which tab is selected or whether a filter is pressed) that let assistive technology describe them. Interactive parts of our web products follow the WAI-ARIA authoring practices.

Read the standard

Met by: Hatch Chart

Works offline

Every main task works in airplane mode after the first install. Nothing waits on a server to let you do your work.

Offline is a feature and a promise. For a volunteer in a parking lot, an angler at a boat ramp or anyone on a plane, an app that needs a connection is an app that does not work. Our products do their work on the device, queue anything that genuinely needs the network until it is back, and are tested in airplane mode before release.

Met by: Headwaters, Rough Day Kit (coming soon), VeraFlow (coming soon), Don't Waste Coffee (coming soon), Outside Today (coming soon), Ebb, SameMoment (coming soon), FoldPass (coming soon), Kept (coming soon), Ten Frames, Home Inventory (coming soon), Worry Loop, Tight Loop (coming soon), Cook Cards (coming soon)

No data collection

The app gathers nothing about you: no analytics, no advertising identifiers, no tracking, and no server of ours. Its App Store privacy label is Data Not Collected.

Every app in the App Store carries a privacy label. "Data Not Collected" is the strictest one, and an app may only claim it when neither the developer nor any code inside the app collects anything. Our apps qualify because they have no accounts, no analytics or crash-reporting kits, no advertising, and no servers of ours that your data could reach. What you put in stays on your device unless you export it.

Read the standard

Met by: Rough Day Kit (coming soon), VeraFlow (coming soon), Don't Waste Coffee (coming soon), Outside Today (coming soon), Ebb, MotherHen: Family Locator (coming soon), FoldPass (coming soon), Kept (coming soon), Ten Frames, Home Inventory (coming soon), Worry Loop, Tight Loop (coming soon), Cook Cards (coming soon)

Apple privacy manifest

A file Apple requires inside every app that states what data it collects and why it uses certain system features. Ours declare no tracking and no collection.

Since 2024 Apple requires a privacy manifest in every app: a machine-readable declaration of the data it collects, whether it tracks you, and the reasons it uses sensitive system interfaces. Apple checks it against the privacy label and the code. Our manifests declare no tracking and no data collection, and are reviewed before each release.

Read the standard

Met by: Rough Day Kit (coming soon), Don't Waste Coffee (coming soon), Outside Today (coming soon), Ebb, FoldPass (coming soon), Kept (coming soon), Ten Frames, Home Inventory (coming soon), Worry Loop

Encrypted backups

Backup files are encrypted on your device with a passphrase only you know, using the same family of encryption that banks use. We cannot open them, and cannot recover a lost passphrase.

A backup you keep in a cloud drive or send to yourself should be unreadable to anyone but you. Our apps encrypt backups with AES, the standard used across banking and government, with a key derived from your passphrase on your device. The passphrase never leaves the phone and is never stored in the file, so the file is useless without it, including to us.

Met by: Rough Day Kit (coming soon), Outside Today (coming soon), Ebb, Kept (coming soon), Ten Frames, Home Inventory (coming soon), Worry Loop

Multiple languages

The interface is translated, and dates, plurals and layouts adapt to the language. Each product page lists its languages.

Translating an app is more than swapping words: dates and numbers are formatted the local way, plural forms are handled per language, and layouts are checked so longer German or Portuguese text still fits at large sizes. Our translations are machine-made and clearly marked as awaiting native review; the languages each product ships in are listed on its page.

Met by: Rough Day Kit (coming soon), Outside Today (coming soon), Ebb, SameMoment (coming soon), Kept (coming soon), Ten Frames, Home Inventory (coming soon), Worry Loop, Tight Loop (coming soon)

Strict Content Security Policy

The web pages tell the browser to run no outside scripts. That blocks a whole class of attacks and keeps third-party trackers out by construction.

A Content Security Policy is a header a website sends that tells the browser where scripts, styles and images may come from. A strict one, allowing only the site itself, means an injected script cannot run and no advertising or analytics network can load, even by accident. Our web products ship with a strict policy and are built so they need no inline scripts.

Read the standard

Met by: That River, SameMoment (coming soon), Kept (coming soon), Community Fly Fishing Events

OWASP security review

Checked against the OWASP list of the most common web application weaknesses, such as injection, broken access control and insecure defaults, before each release.

OWASP, the Open Worldwide Application Security Project, publishes the list security reviewers start from. Our server-side products are reviewed against it: every write checks who is asking, every input is validated and escaped, secrets never ship in the code, and automated harnesses exercise every endpoint as a visitor, a member and an administrator to confirm nobody can reach what they should not.

Read the standard

Met by: Headwaters

WordPress Coding Standards

The code is checked with the WordPress project’s own rules for security and compatibility: escaping output, verifying requests, and using WordPress functions rather than raw ones.

The WordPress Coding Standards are a published rule set, enforced by a tool called PHP CodeSniffer, that catches the mistakes behind most plugin vulnerabilities: unescaped output, database queries without preparation, actions without nonce checks, and functions that break on other hosts. Our plugins carry the configuration and run the check as part of the release.

Read the standard

Met by: Headwaters

WordPress privacy tools

Plugs into WordPress’s built-in personal data export and erasure requests, the tools a site uses to answer a GDPR or CCPA request.

WordPress has a standard way for a site owner to export or erase everything it holds about one person. A plugin participates by registering its own data with those tools. Ours do, so a request to "send me my data" or "delete me" covers volunteer records, hours and consents without anyone hand-editing the database. They also supply a privacy policy section the site can publish.

Read the standard

Met by: Headwaters

iCalendar feeds

Standard calendar subscriptions (the iCalendar format, RFC 5545) that work with Apple Calendar, Google Calendar and Outlook.

iCalendar is the thirty-year-old standard behind every calendar app. A product that publishes an iCalendar feed can be subscribed to once, after which new events appear on a phone or computer by themselves, with no app to install. Ours publish feeds for the whole calendar and, where it makes sense, for one organization, one space or one team.

Read the standard

Met by: Headwaters, Commons, Community Fly Fishing Events

Your data in open formats

Exports come out as CSV, JSON, Markdown, PDF or RSS: files any spreadsheet, text editor or reader can open, with no need for our software.

Data you cannot take with you is not really yours. Our products export to open, documented formats: CSV for spreadsheets, JSON for other programs, Markdown and PDF for reading, iCalendar and RSS for subscriptions. A backup can always be restored, and a readable copy can always be kept somewhere else.

Met by: Headwaters, That River, Commons, Don't Waste Coffee (coming soon), Outside Today (coming soon), Hatch Chart, Kept (coming soon), Ten Frames, Community Fly Fishing Events, Home Inventory (coming soon), Worry Loop

Photo metadata removed

Photos you share or store lose the hidden details a camera embeds, such as GPS location, date and camera model, so a picture never gives away where you were.

Every photo from a phone carries EXIF metadata: the exact place it was taken, when, and on what. Sharing the file shares all of that. Our apps copy photos in with the location stripped, redraw shared photos from their pixels so no metadata survives, and test that the result carries nothing identifying.

Met by: Rough Day Kit (coming soon), That River, Outside Today (coming soon), Ten Frames

This website

twelvetwolabs.com is built to the same rules. Every page is plain HTML and CSS with no JavaScript, one heading structure, visible focus, WCAG AA contrast in light and dark mode, a skip link, and alt text on every image. It sets no cookies, loads nothing from third parties, and is served with a strict Content Security Policy. A build fails if any page breaks those rules.

Questions about any of this: hello@twelvetwolabs.com.