Privacy Policy

Who we are

This policy is from Free and Sober Inc., a Delaware corporation, which makes the Free and Sober app and runs the freeandsober.com website. In this policy, "Free and Sober," "we," "us" and "our" mean Free and Sober Inc. "Free and Sober" is also the name of our app and service.

The app is for adults 18 and older in the United States. It is in English.

This policy covers the app, our website, the emails we send, and the web page we show to the people in your corner. It works together with these pages:

• Consumer Health Data Privacy Policy, for the health data rights that Washington, Nevada and Connecticut law give you
• Terms of Use
• The mentor and your safety and our crisis protocol
• Our subprocessors, the companies that help us run the app
• Billing and subscriptions

If you have a question, write to support@freeandsober.com.

Our promises

• No ads, ever. There are no third-party advertising or analytics tools in the app, and no tracking pixels on our website.
• Never sold. We do not sell your information, rent it, or trade it.
• Never used for advertising. We do not use health information, or anything else about you, to target ads.
• Not used to train AI. We do not collect, use or sell your personal data to train large language models or any other AI model, and our AI providers may not use it to train theirs.
• Your vault is locked with your key (at launch). Your Time Capsules, your journal and the other things listed under "End-to-end encryption" below are locked before they are stored, so they are stored only in a form your key opens. We can't see or use your key, so we can't read what we store in your vault. When you use the mentor, your phone unlocks what it needs, such as your reasons, the mentor's memory and any journal entry you let it read, and sends it with your request, and our server and the AI provider read that to answer you. Some details, such as dates, counts and sizes, stay readable to us, and your mentor conversations are not in your vault. If you lose your key and your recovery key, nobody can open your vault, including us.
• Organizations see only what you agree to. If you join through an organization, it sees engagement counts for all its members together, and only after you agree. It sees anything about you alone, or sends anything addressed to you alone, only if you sign its separate privacy disclosure. Once you join, it can send messages to all of its members, or to a group of them, if you agree to receive them. Your words, your recordings, your Time Capsules and your journal are not shared with your program, except what you say and show in a video meeting with its staff that you choose to join.
• One standard for everyone. Everyone's data gets the same protection under this policy, whether or not an organization is involved. HIPAA, the federal law for health information held by doctors, hospitals and health plans, doesn't cover what you give Free and Sober yourself, because we are not your health care provider or your health plan. This policy, our Terms and the privacy and health data laws that apply where you live cover it. If a health care organization covered by HIPAA gives you your seat, HIPAA may also apply to what we handle for that organization, under a separate agreement with it. There is no official HIPAA certification, and we do not claim one.

What we collect and why

We collect only what a feature needs. Some features are only in some plans, and some only collect data if you choose to use them.

Your consent to health data

Because almost everything in Free and Sober is health data, sign-up includes a separate screen that asks your consent to collect it for the features you use, apart from these terms. We keep a record of your consent (the screen's version and the time). You can withdraw it by deleting your account; see our Consumer Health Data Privacy Policy.

Your account

• Your email address. You sign in with a six-digit code we email to you. There is no password. We also use your email to send the messages the app needs to send, like sign-in codes.
• The first name you give us, so the app can speak to you by name.
• Your time zone, read from your phone, so your day count, your reminders and your Time Capsule all use your own calendar.
• Your age check: the age range your app store shares, where it shares one, or, where it does not, your own answer that you are 18 or older, only to confirm you can use Free and Sober. We keep only that you passed, and how. We don't ask for your date of birth.
• Your state, which the app asks when you sign up, so we can follow the laws of the state where you live, such as its privacy, health data and breach notice laws. We use it for nothing else. If Free and Sober isn't available in your state yet (at launch, Utah), the app offers a waitlist there: we keep your email address and state only to tell you when it is, and delete them if you ask or when we write to you.

Your sobriety details

• Your start date and your counts. If a count restarts, we keep the earlier count too, so your total days and every milestone you earned stay yours.
• The path you are on, such as AA or NA, SMART Recovery, Recovery Dharma, Celebrate Recovery, secular, or no program. It sets the words the app and the mentor use. It is never shown to an organization or to your corner.
• Your reasons, in your own words. They are shown back to you on milestone days, and the mentor uses them.
• Your check-ins, daily notes, and progress through the 30-day program, if you use them. This includes the meetings and calls you log, and the milestones and "Firsts" you earn.
• Your safety plan and your trusted contact, if you set them up. For a trusted contact, that means their name and phone number.

Your Time Capsule

• Your Time Capsules. This is the video, voice or written message you make for your future self, and your answer to it after it opens. Recordings are up to 90 seconds. The first capsule of each count opens 30 days after you seal it. Later ones open on a day you pick, up to ten years out. Essentials holds 1 sealed capsule at a time, and Plus and Premium hold up to 3.
• Details about each capsule: that it exists, which count it belongs to, what kind it is (such as that count's first capsule or your answer to it), the size of its file, which version of your key locks it, when you sealed it, the time zone you sealed it in, the day it opens, and when you first played it.

Your capsules are kept in private storage under your account. A database rule keeps a sealed capsule closed until its day. No screen, link or support request can open it early. Your recordings are never sent to any AI provider, and the recordings themselves are never analyzed.

At launch, each capsule is encrypted on your phone with your key before it is uploaded. We store only the locked file, and only your key can open it, so we can't see or hear what you said, unless you send us a copy yourself. The details listed above stay readable to us, because we need them to keep the seal, to open each capsule on its day, and to tell you when a phone doesn't have the key a capsule needs. A recording's file size shows roughly whether it is video or voice and how long it is. Every written capsule is the same size.

A capsule can open years from now, and phones change before then. To play it on a new phone, you need your key, so keep your recovery key safe. If you lose every phone that holds your key, your key's backup and your recovery key, your capsules still open on their day, but nobody can play them, including us. See "End-to-end encryption" below.

If you turn on Email me before a capsule opens, we use each capsule's opening day and your email address to email you about two weeks before it opens and on its morning. The email says only something like "Something you sealed opens on March 3," never what is in it.

Your mentor

If an organization's program gives you your seat, you can have the mentor by message and by voice while your seat lasts, never on video, once you consent. What you type in messages, and the words of a voice conversation, go to OpenAI, which writes the mentor's replies, under our signed HIPAA business associate agreement with OpenAI, with OpenAI's storage turned off. In a voice conversation, Amazon Web Services also hears and speaks: Amazon Transcribe hears you, Amazon Bedrock Guardrails checks each message and reply, and an Amazon Polly voice speaks. Each also receives what the mentor needs to answer you, as "AI providers and your consent" below says, and we have a HIPAA business associate agreement with each. Nothing of yours goes to any other AI provider, and your conversations are not shared with your program. The crisis help in the app stays on for you. If you leave the program or your seat ends, you can use the mentor on a plan of your own.

• What you type or say to the mentor, and its replies.
• Your voice, when you talk by voice. Your speech streams live so it can be turned into text, and the mentor's reply streams back as speech. We do not record the audio.
• The mentor's memory. These are short notes the mentor keeps so it remembers what matters to you. You can read and edit them.
• Safety information. Our crisis detection sets a risk level during a conversation. We hold it on our server and on your phone for that session only, so crisis help stays on screen even if the connection drops.
• Usage counts, such as messages used toward your plan's daily limit and voice minutes used, which are kept with your account. Separate counts of how often crisis help was shown and how often a mentor declined to give medical advice hold no name, no account ID and no words. If someone abuses the mentor, we keep, with the account, the number of warnings in the last 24 hours, any pause and the number of pauses in the last 30 days, and whether talking with the mentor has ended on the account, so the steps in The mentor and your safety can apply; nothing of what was said.
• Video calls with the mentor: for each call, your account, which mentor, when it started and ended, and the minutes it used. Never a word or a recording.
• Your mentor's first line at a check-in. When you open a check-in reminder, the app asks your mentor for a first line. We keep, for 3 days, only that a check-in was opened that day (which of up to three), never its time and never any words, so each check-in gets one line; it is deleted with your account.

We keep conversations only for the session, unless you agree to a short, stated retention window. No one at Free and Sober reads them.

Mentor conversations are not end-to-end encrypted. The mentor has to read what you send to answer you, so our server handles each message in readable form, checks it for signs of danger and passes it to the AI provider you agreed to. At launch, the mentor's memory, and any conversation history you choose to keep, are stored encrypted with your key. The mentor writes its memory notes while it answers you, and your phone locks them before they are stored. Your phone sends them with a request when the mentor needs them, so our server and the AI provider can read them to answer you.

Conversations with the mentor are not protected the way conversations with a doctor or a lawyer are. A court could order us to hand over what we hold. That is one more reason we keep as little as we can.

Your calendar

• Appointments you add: the name, kind, day, time, time zone, place, notes, how it repeats, the reminder you picked, and the days you marked "I went."

No organization, corner member or mentor reads your calendar. At launch, each appointment's name, kind, place and notes are encrypted on your phone with your key, so we can't read them. Its day, times, time zone, repeats, reminder settings and the days you marked "I went" stay readable to us, so the service can keep your calendar and send the reminders you ask for. The mentor can see what is coming up only if you turn that on, and even then it never sees appointments or program dates an organization sent you; those never go to an AI provider. Reminders are set on your phone as local notifications, so no push service sees them, and the lock screen never says what the appointment is. If you turn on email reminders, we keep each reminder's time and your email address, never the appointment's name or kind, and the email says only something like "Something on your calendar at 2:30 p.m."

Your journal

• At launch, entries you write: the kind of entry, the day, your words, and any day you asked to be reminded of it.

Your journal is for you. At launch, entries will be encrypted on your phone with your key before they are stored or synced to your other phones, so we will hold them in a form we cannot read. We can see only that an entry exists, when it was saved and roughly how long it is, never its day, its kind or your words. The mentor reads an entry only if you turn on "Let my mentor read this" for that entry. Your phone then unlocks that entry and sends it with your request, and it goes to our AI providers the way a mentor message does, only to answer you or help you write. You can turn it off again at any time. No organization or corner member ever sees your journal, and it is never used to train AI.

After you save an entry, the app checks it on your phone for words that can mean you are in danger, and if it finds any, it shows crisis lines. The words are not sent to us for this, and nobody is told.

Meetings

• The place you type to find meetings, such as a ZIP code or a city. If you type a street address, only its ZIP code or city is used.
• The meetings you log with "I went." At launch, a meeting's name is encrypted with your key. The day and the fellowship stay readable to us, so the app can mark your Firsts.

We do not ask for your phone's location. The place you type is turned into a point on a map on our own server, using public lists of ZIP codes and places that we keep ourselves, and is used only for that search. We do not keep it, and no outside service receives it. Meeting listings come from the fellowships' own public meeting lists, which we copy to our server, so your search never reaches them. We do not use geofencing. Your meeting searches never go to organizations or advertisers.

Your Corner

• The first name and email address of each person you add to your corner.
• What you chose to share with each person, and whether they accepted.
• Notes they send you, and on Plus and Premium, the corner capsules they record for you. A corner capsule is a sealed voice message. It opens on one of your milestones, the one they pick.
• Voice and video messages and video capsules (Plus and Premium). On Plus and Premium, if you allow it, the people in your corner can also send you voice or video messages, up to 90 seconds, that open right away, and video capsules that open on one of your milestones. You choose what each person may send: notes only, notes and voice, or notes, voice and video. You can mute, remove or block anyone at any time. They don't see whether you opened a message. If you move to Essentials, what you already received stays yours, and they can send only notes from then on.

At launch, the notes, corner capsules and voice and video messages people in your corner send you are encrypted in their browser, by our corner web page, before they are sent, so only your key can open them. We can't read, hear or watch them, except as "What it doesn't cover" below explains. We can see who sent each one and when, whether it is voice or video, whether it opens right away or on a milestone and which one, which version of your key it is locked for, when you opened it, its size, and whether you read or muted a note. The first names and email addresses of the people in your corner, and what you chose to share with each, stay readable to us, because we send their emails.

• Muting. A mute you set while voice and video from your corner are on for your plan keeps what that person sends, notes, voice and video messages and capsules alike, out of sight. It shows only if you unmute them within 30 days; otherwise it is deleted. Capsules they sealed for you before you muted them wait until you unmute, then open on their day. Such a mute keeps working this way even if you later move to Essentials or the feature is turned off. A mute you set before, or from an older version of the app, drops the notes they send and leaves their voice capsules to open on their day, as it always did, while their voice and video messages and video capsules are kept out of sight the same way: shown only if you unmute them within 30 days, otherwise deleted, and a video capsule they sealed for you before you muted them waits until you unmute, then opens on its day, and is never deleted by the mute. To have their notes kept too, unmute and mute them again. From the version of the app that shows voice and video, the app says, for each person you muted, which of the two their mute does.
• Blocking and removing (while voice and video from your corner are on for your plan). If you block someone, what they send from then on is deleted without being shown, and anything of theirs that hasn't opened yet is deleted; unblocking doesn't bring it back. A block lasts until you unblock them, even if you later move to Essentials or the feature is turned off: while it lasts, the notes they send are deleted without being shown and their voice capsules that haven't opened are deleted, and the app shows that they are blocked, with Unblock. If you remove someone, their link shows only "This link is no longer active," and anything of theirs that hasn't opened yet is deleted. If someone leaves your corner on their own, nothing more comes from them, and what they already sent stays yours. They are never told that you muted, blocked or removed them.
• Reports. If you report someone in your corner, we receive their first name, email address and the time. We see the message itself only if you choose to share it with the report: your phone then sends us that note's words, or that recording as you opened it, and it leaves your vault so we can review it. We delete what you shared once we close the report, and the report itself within 90 days.
• A limit. Each person can send you up to five notes and messages a day, so we keep when each one sent something, for two days.

Purchases

Subscriptions and packs of voice minutes are bought through the App Store or Google Play. We never see your card number. Apple or Google tells us, through a service called RevenueCat, which plan you have, whether it is active, and which packs of voice minutes you bought. RevenueCat knows you only by a random ID, not your name or email: an ID made for RevenueCat alone, not your account's. The app first connects to RevenueCat when you open the plans, plan or minutes screen, buy, restore purchases or manage your plan. After that, until the app is closed, it checks with RevenueCat again each time you come back to the app, even after you sign out or start a program, and for anyone who signs in on the phone before the app is restarted. Each connection carries technical details, such as your IP address, the app's version, your phone's platform, and the identifiers and settings the store gives the app for your device. RevenueCat learns that random ID, what your store says you bought, and those technical details. It learns nothing else about what you do in the app. We keep your voice minutes ourselves: the ones you buy, your trial's and your plan's, and what each session used. While an organization's program pays for your plan, the app doesn't set RevenueCat up for you and we don't ask it about you, though the checks above go on until the app is closed if one of those screens was opened since it started.

If we offer plans and packs on our website (we don't yet; see Billing and subscriptions), Stripe takes the payment on its own page. You give Stripe your email, card and billing address there, and Stripe keeps them under its own privacy policy. We give Stripe only the random ID RevenueCat knows you by, and we never see your card number. RevenueCat then learns from Stripe, under the same random ID, which plan or pack you bought, as it does for the App Store and Google Play.

Organization membership

If you join through an organization's code, we keep which organization you joined, when, and whether it pays for your plan. If you sign the organization's separate privacy disclosure, we also keep the organization's own reference for you, and any appointments or program dates it sends you, attached to your link with the organization, not to your personal record. They go on your calendar only if you accept them. At launch, our server checks each one as it arrives and then locks it so only your key can open it, so we store it only in a form we can't read. Its times, and whether it was delivered, stay readable to us. If your organization offers capsules from your care team and you sign, we also keep the discharge date its staff set for you, until you withdraw, leave or your seat ends, and the details "What stays readable to us" lists for those capsules. Before you sign, the organization can send us nothing about you.

A referral code

If someone shared Free and Sober with you, you can add their referral code in the app (the You tab, then Referral code) within 7 days of joining. It's optional, and it never changes your price. If you add one, we keep the code, the version of the line you agreed to, and when you added it.

In your first 7 days, and after that only if you've added a referral code, we keep your app store's subscription events: which store and plan, trial or paid, when it started, renewed, was cancelled, expired, was refunded or had a refund reversed, whether it can count for a referral (it can't if it came through Family Sharing or was a test purchase), and the store's transaction number. Without a referral code, we keep each one for about 8 days after it reaches us, so that a code added in your first 7 days can count, and then delete it. After your first 7 days, we don't keep them at all unless you've added one. If you have, we keep them until you delete your account, only to count totals for the person who shared the code and to pay them. Our records of what we paid them stay, without anything that identifies you. The person who shared it sees only totals, such as how many people joined with their code, never who you are. You type the referral code yourself: no link or QR code carries a referral code, nothing counts how often one is shared, and the app never reads a referral code from a link or from the app store.

Your vault's keys (at launch)

• Your public key. Your phone makes it from your key. It lets others lock things for you, such as a corner capsule, but it can't open anything.
• Details about your key: which version of it is current, when it was made, and when an older one was replaced.
• A locked copy of your key, if you make a recovery key, and the date you made it. Only your recovery key's 24 words can open that copy. We never see them.
• A key you move to a new phone. When you move your key by scanning a code your old phone shows, it passes through our server locked in a way we can't open. We delete it when your new phone confirms it, or after 10 minutes.

"End-to-end encryption" below explains how your key and your recovery key work.

Your device and diagnostics

• Crash and error reports, such as your device model, operating system, app version, and what went wrong. Reports are set up to leave out who you are: your name, your email and what you have written are stripped on your phone before a report is sent.
• Security and server logs, such as when you signed in, and when your app or browser connected to our servers and what it asked for. Logs record who did what and when, never the content of what you wrote or said. Our servers use the IP address your phone or browser connects from to answer it and to limit abuse; our own logs and database don't record it, except as follows. When your phone uploads or downloads a recording, our storage provider's security log records the IP address it came from; we keep that log up to six years, locked for the first year. The access log of an organization's members records the address of the staff member, the organization's system or our support team member who looked (see "How long we keep your information"). If you join a video meeting with your program, our meetings server's logs can record the address your phone connected from, for 30 days. If you make a video call with the mentor, Anam sees your phone's address, as any service the app connects to does.
• A notification token, if you allow notifications, so we can deliver the notices you turned on.
• Permissions. The app asks for the camera and microphone only when you record, talk or join a video meeting with your program, and for notifications only when you first choose something that needs them, such as a reminder. It does not ask for your location.

Messages you send us

If you email support or use a form on our website, we keep what you send so we can help. You never need to include health details to get help.

How we use your information

We use it to:

• Run the app and the features you ask for
• Keep you safe, by watching mentor conversations for signs of crisis and putting crisis help in front of you
• Speak your language, using your name, your path and your reasons
• Send the messages you expect, such as sign-in codes, the corner emails and reminders you turned on, notices that a security setting changed, and the notifications you chose
• Send you an email confirming that you joined our launch waitlist (with links to our Instagram and Facebook pages, with no tracking) and one email when the app launches, which includes the waitlist code FIRST30 for 30 days of the Essentials plan free, if you joined it on our website, and, only if you ticked the separate box for it, occasional news about Free and Sober until you unsubscribe
• Know which plan you have and manage your voice minutes
• Keep accounts secure, prevent abuse, and fix problems
• Meet our legal duties, such as the yearly counts of crisis referrals that California and other states require, which hold no user identifiers
• Check that the mentor stays out of medical advice, by counting how often it declines, with no words and no identifiers

We do not use your information to target ads. We do not sell it. We do not collect, use or sell it to train large language models or any other AI model. We send marketing email only to people who ask for it. If you join our launch waitlist on our website, we send you an email confirming that you joined, which links to our Instagram and Facebook pages with no tracking, and the one email when the app launches that you asked for, which includes the waitlist code FIRST30 for 30 days of the Essentials plan free, for people on the waitlist. If you also tick the separate, optional box for news, we then send you occasional news about Free and Sober, such as new features and tips, until you unsubscribe. Every one of these emails says how to unsubscribe. We don't track whether you open these emails or click their links.

AI providers and your consent

The mentor uses outside AI providers to understand you and to answer:

• OpenAI for the mentor's messages and for part of our crisis detection
• Amazon Web Services to hear you and speak when you talk with the mentor out loud: Amazon Transcribe turns your speech into text, Amazon Bedrock Guardrails does part of our crisis detection, and an Amazon Polly voice speaks the replies. OpenAI writes the replies.
• Anam for your mentor's face on video: it receives only the finished sound of the mentor's replies and moves the mentor's face and lips with them

For members of an organization's program, the mentor uses OpenAI and Amazon Web Services alone, never Anam (see "Your mentor" above).

We ask first. Before any of your information goes to one of these providers, the app shows a consent screen that names the provider, says what it receives and why, and asks you to agree. We keep a record of your answer (the screen's version and the time). You can change your answer any time in You, then Privacy, then AI providers. If you say no, you can still use the parts of the app that do not need that provider, including your count, your Time Capsule, your calendar, and the crisis tools.

What each provider receives. Each provider's consent screen in the app uses the same words as this section.

• OpenAI
  • What OpenAI receives. What you write to the mentor and its replies, and what it needs to answer you well: your first name, the path you're on, your reasons, the mentor's memory notes, any conversation history you choose to keep, and any journal entry you choose to let the mentor read.
  • What it never receives. Your Time Capsules, corner capsules, or anything an organization sent you. Your calendar only if you turn that on.
  • What OpenAI may do with it. Only answer you, and run a safety check that helps our code spot danger. It may not use it to train its models. We send it with storage turned off (store: false), and OpenAI keeps it only as Modified Retention in our signed agreement allows. We don't claim zero data retention.
• Amazon Web Services (when you talk out loud, or if we move you to it)
  • What AWS receives. What you write or say to the mentor and its replies, and what it needs to answer you well: your first name, the path you're on, your reasons, the mentor's memory notes, any conversation history you choose to keep, and any journal entry you choose to let the mentor read.
  • What it never receives. Your Time Capsules, corner capsules, or anything an organization sent you. Your calendar only if you turn that on.
  • What AWS may do with it. Only answer you, and run the safety checks that help our code spot danger. It may not use it to train its models, and we've turned off its logging of what is sent.
  • Not recorded. We don't record the audio.
• Anam (in video calls with the mentor)
  • What Anam receives. Only the finished sound of your mentor's replies during a video call, so it can move the mentor's face and lips with them. The mentor's replies can include what you said. Like any service the app connects to, it also sees your phone's network address and how well the video connection is working, and its software in the app tells it which version it is.
  • What it never receives. Your voice, your name, your account, your words or anything you type. Your camera stays off, and your microphone never sends anything to Anam.
  • Not recorded. We turn off Anam's session recording for every call.
  • Crisis help never waits. Crisis lines come from the app itself, never through Anam, and the video closes so the crisis lines can show.

How we set them up.

• We call OpenAI with storage turned off. We have a HIPAA business associate agreement with OpenAI. OpenAI keeps what it receives only as Modified Retention, set in that agreement, allows. We don't claim zero data retention. OpenAI does not use data sent through its API to train its models.
• At Amazon Web Services, we turn off Amazon Bedrock's logging of what is sent, and we don't record the audio. We have a HIPAA business associate agreement with Amazon Web Services. We move the mentor to Amazon Web Services for anyone only once AWS has confirmed in writing that this agreement covers the mentor's model, and once we have turned off any use of what its AI services receive to improve or train them.
• Anam is our live avatar host, for video only. At Anam, we turn off session recording in every call, so Anam keeps no recordings or transcripts of calls. Any text it receives may sit in its operational logs for up to 30 days.
• Every voice session starts with a short spoken and written notice: "This conversation is processed by Amazon Web Services, to hear and speak, and it isn't recorded." Some fixed safety messages are recorded ahead of time in your mentor's voice, from our own fixed words, never yours. Before a video call, the app shows: "On video, Anam shows your mentor's face, moved by the sound of your mentor's replies alone: never your voice, your words or your name. Your camera stays off."
• OpenAI doesn't promise a United States location for what it receives, and may process some of it outside the United States. Amazon Web Services handles the mentor's requests, and your voice, in the United States (Northern Virginia) only. Anam says it runs live calls in the United States (US East), though it doesn't promise that all of its storage stays there, as listed on our subprocessors page.
• Crisis detection runs in our own code, which combines our own checks with providers' checks: OpenAI's moderation check and Amazon Bedrock Guardrails. The mentor's AI model never decides what counts as a safety risk.
• Members of an organization's program can have the mentor by message and by voice, never on video, whether or not their organization is covered by HIPAA. What they type in messages, and a voice conversation's words when they carry on by message or ask for help writing a journal entry, go to OpenAI; what they say in a voice conversation, and anything they type during it, goes to Amazon Web Services. We have a HIPAA business associate agreement with each, and nothing of theirs goes to any other AI provider.

How we store and protect your information

• In the United States. Our database, file storage and servers are in the United States. OpenAI doesn't promise a United States location for what it receives; Amazon Web Services handles the mentor in the United States only; and Anam says it runs live calls in the United States (US East).
• Encrypted. Data is encrypted in transit and at rest, including backups. At launch, what's in your vault is also stored locked with your key, as the next section explains.
• Walled off. Database rules let each person read only their own data. Organizations can read only counts, and, if you sign an organization's privacy disclosure, only what you chose to share with it. No organization can reach capsules, mentor conversations or the capsule storage at all.
• Private capsules. Time Capsules are kept in private storage. At launch, they are stored only as locked files. A link to fetch one works for an hour, including when the app makes your copy of your data, and it fetches only the locked file, which your key opens on your phone.
• Kept on your phone securely. Your sign-in session is kept in your phone's secure storage. At launch, so is your key.
• Limited staff access. Only the people who need it for their work can reach production data. Before launch, each of them will use two-factor sign-in, sign a confidentiality agreement and complete privacy training, and their access will be logged and reviewed.
• No health details where they do not belong. We keep health details out of notifications, email subject lines, error reports, logs, web addresses and invoices.
• Checked. Starting at launch, we review our risks every year, scan for weaknesses every 6 months, and test our security every year.

No system is perfect. We can't promise that our systems, or our providers' systems, will never be breached or fail. If you find a security problem, please tell us at support@freeandsober.com.

End-to-end encryption (at launch)

At launch, the things listed below are encrypted so only your key can open them. In this policy, we call them "your vault." Most are end-to-end encrypted: your phone locks what you make with your key before it is stored, and corner capsules, notes and voice and video messages, and capsules and messages from your care team, are locked for your key in the sender's browser. Two kinds are stored locked but are not end-to-end encrypted. Our server reads appointments an organization sends you as they arrive, then locks them for your key. The mentor's memory and any conversation history you keep come from your mentor conversations, and our server and the AI provider read them whenever your phone sends them with a mentor request. We store only the locked versions, and only your key can unlock them.

We can't read the locked versions we store. Neither can our hosting provider, or anyone who steals a copy of what we store or gets one from us through legal process. When your phone unlocks something and sends it with a mentor request, our server and the AI provider can read that copy, as "What it doesn't cover" explains. Your mentor conversations are not in your vault.

What is in your vault

• Your Time Capsules and your answers to them, whether video, voice or writing
• The corner capsules, notes, and voice and video messages that people in your corner send you
• Capsules and messages from your care team
• Your journal
• Your safety plan, and your trusted contact's name and number
• Your reasons, your check-in answers and notes, and any note you add to a count
• The name, kind, place and notes of each appointment on your calendar, including ones an organization sends you
• The names of the meetings you log with "I went"
• The mentor's memory, and any conversation history you choose to keep

Messages your organization sends to all its members or to a group are not in your vault: they are the same for everyone who gets them, and are stored encrypted but readable to our systems.

What stays readable to us

The service needs some details to work: to sign you in, keep your count, send the emails you turned on, keep each capsule sealed, open it on its day, and send your reminders. These details are not in your vault. We can read them, and so could our hosting provider or anyone who gets a copy of what we store, including through legal process.

• Your account: your email address, first name, time zone, state, that you passed the age check, your path, your plan, your consents, and any organization you joined
• Your sobriety details: your start dates, counts and restarts, milestones and Firsts, and the days you logged a meeting, with its fellowship
• Your Time Capsules: that each one exists, which count it belongs to and what kind it is, the size of its file, which version of your key locks it, when you sealed it, the time zone, the day it opens, and when you first played it. A recording's file size shows roughly whether it is video or voice and how long it is. Every written capsule is the same size.
• Corner capsules, notes, and voice and video messages: who sent each one and when, whether it is voice or video and opens right away or on a milestone, the milestone and the time it opens, which version of your key it is locked for, when you opened it, its size, and whether you read or muted a note; what each person may send, your mutes and blocks and when you set and ended them, and when each person sent something, for two days
• Capsules from your care team: which organization sent each one, which staff member recorded each part and the order of the parts, when each part was sealed and when the capsule opens, the time zone used, which version of your key locks it, whether it is video or voice and its size, when you first played it, the one reply you sent and when, each "Can we talk?" and whether its email went, your mutes and when you set and ended them, and, while you are signed, the discharge date your organization set. If you delete a capsule, or one isn't delivered, we keep only that it was sent, by whom and when, and which of the two, so the one-per-person limit holds
• Messages from your care team: which organization sent each one and which staff member recorded it, whether it is video, voice or writing and its size (every written message is the same size), which version of your key locks it, when it was sealed, the time it was due (now, or a check-in's day after your discharge date) and when it reached you, when you first opened it, the one reply you sent and when, each "Can we talk?", whether its email went and whether your care team marked it handled; the check-ins your care team scheduled, their days and their time zone; and, for 8 days, when each message reached you, so the limit of 10 in any 7 days holds. A message that is deleted, cancelled or never delivered leaves nothing behind but that place in the limit, for 8 days, and any "Can we talk?" you sent about it
• Messages from your organization to its members: each message itself (its words, or its recording), which organization sent it and which staff member, who it went to (all members or a group) and when, how many members were in the group it went to, and, for each member who received it, when it reached them and whether and when they opened it, sent a heart or reported it; whether you agreed to receive them, which notice and when, and whether you muted them; and which of the groups your organization named it put you in, and since when
• Your journal and the other things you write: that each one exists, when it was saved or changed, roughly how long it is, and, for up to 90 days, when it was deleted
• Your calendar: each appointment's day, times, time zone, repeats, the days you removed from a repeat or marked "I went," and your reminder settings
• Your corner: the first names and email addresses of the people in your corner, what you chose to share with each, whether they accepted, and what they see, such as your milestones, your day count and the day a capsule opens
• Your keys: your public key, which version of your key is current, when it was made, when an older key was replaced, when you made your recovery key, and the locked copy of your key
• Emails you turned on: whether you asked for emails before a capsule opens or for email reminders, when each one is due, and when we sent it
• Logs and devices: your device and app version, and when your app or browser connected to our servers and what it asked for
• Everything else this policy lists that is not in your vault, such as your mentor conversations while we hold them

We can't see or hear what you said in a capsule, unless you send us a copy yourself. We see a journal entry only if you let the mentor read it, and the names of your appointments only if you let the mentor see what's coming up, and then only when your phone sends them with your request.

What it doesn't cover

• Your mentor conversations. The mentor has to read what you send to answer you. Our server handles each message in readable form, checks it for signs of danger and passes it to the AI provider you agreed to, as "AI providers and your consent" explains. Something from your vault, such as your reasons, the mentor's memory or a journal entry you let the mentor read, reaches our server and an AI provider in readable form only when your phone unlocks it and sends it with a request, for a feature you turned on and agreed to.
• What you take out of your vault. A copy you export, a copy of a capsule you save once it opens, an entry you let the mentor read, a card you share, a message you send from your own phone, or a recording you choose to send us with a report is outside your vault's protection.
• Appointments an organization sends you. Our server reads each one as it arrives, to check it, and then locks it so only your key can open it. The organization keeps its own records under the laws that apply to it.
• Your phone and the app. Anyone who can unlock your phone and open the app can see what you can see there, unless you turn on the app lock. Harmful software on your phone, or a changed copy of the app, could read it too, so get the app only from the App Store or Google Play. Like any encryption built into an app, it also depends on the app we publish working as it was designed.
• The corner web page. Corner capsules, notes and voice and video messages are locked in the sender's browser by our web page, which comes from our server. That keeps them locked from us and from anyone who gets a copy of what we store. It depends on the page our server sends being the one we built. The name shown on a corner capsule, note or message comes from our records, not from the encryption.
• The seal. The rule that keeps a capsule closed until its day is a rule on our server, not part of the encryption. The encryption is what keeps us from playing it, on any day.
• Loss. Encryption keeps what's in your vault private. It doesn't keep it from being lost. We can't open a locked file, so we can't check or repair it. We work to keep what you store safe, but we don't promise that the service will always be available, that stored files can never be lost or damaged, or that every recording will play on every phone or browser.

Your key

• At launch, the app makes your key on your phone. It never leaves your phone in a form we can use.
• Your phone keeps it in its own secure storage.
• On iPhone, if you use iCloud Keychain, your key is saved there too, and a new iPhone signed in to the same Apple Account can find it.
• On Android, your key is saved in your Google account's backup, through Google's Block Store, only when Google reports that backup as end-to-end encrypted. That needs Android 9 or later, a screen lock and Google Play services. Your key comes back when you set up a new Android phone from that backup.
• Apple and Google hold those copies under their own terms and security, not ours. We can't see or control them. We also can't tell whether iCloud Keychain is on, so we never promise that your key is backed up.
• These backups don't cross between iPhone and Android. To move between them, use Move my key to a new phone on your old phone and scan the code it shows with your new phone, or enter your recovery key.
• Signing in doesn't open your vault. Your key does. Someone who gets into your account without your key can't open your vault, though they could see the details that stay readable to us, and could change or delete your account. When a new vault is started or a recovery key is made or replaced on your account, we email you.
• Signing out keeps your key on that phone, so your vault opens again when you sign back in. While you're signed out, the app can't open your vault. Deleting the app or erasing your phone can remove the copy on that phone, so keep your key somewhere else too: in iCloud Keychain or your Google backup, on another phone, or in your recovery key.
• At launch, your vault opens only in the Free and Sober app on a phone, not in a web browser.

Your recovery key

• The app asks you to make a recovery key: 24 words you write down or print. They open your vault on any phone, iPhone or Android.
• We never see the words, and we can't show them to you again. Keeping them safe is up to you.
• When you make one, the app stores a copy of your key on our server, locked with your recovery key. We can't open that copy. Only your 24 words can.
• Anyone who has your 24 words and can sign in to your account can open your vault, so keep them private. We will never ask you for them. If you send them to us, we delete your message and ask you to make a new recovery key.
• Making a new recovery key replaces the old one for everything the new one opens. The old words stop working for those once the new copy is saved, though the old locked copy can stay in our backups for up to 30 days. If you started a new vault, your old words may still be the only way to open what was locked before. The app tells you when they are, so keep them.
• A photo of your words, or a file of them saved to a cloud drive, is held by that service under its own terms.

If you lose your key

If you lose every phone that holds your key, your key's backup in iCloud Keychain or your Google account, and your recovery key, nobody can open what's in your vault, including us. It is lost for good. We can't reset, recover or rebuild your key, and we can't unlock anything for you, even if you ask or a court orders us to.

• Your capsules still open on their day, but without your key, nobody can play them.
• You can start a new vault for what you add from then on. What was locked with your old key stays locked. We keep it until you delete it or your account, in case you find your key or your recovery key.

On your phone

• The app keeps what's in your vault locked on your phone too, and unlocks it only while a screen needs it.
• A few things are readable on your phone: a take you haven't sealed yet, a capsule while it plays, your trusted contact's name and number, so the crisis panel works without a connection, and any copy you export or save. The app deletes a take once its capsule is sealed.
• Depending on your phone, recording a video may also leave a copy in your phone's camera or photos app, which that app, and any photo backup you use, keeps under its own terms.
• Your phone's own backups, such as iCloud Backup or Google's backup for Android, are run by Apple and Google under their own terms, and may include what the app keeps on your phone.

Who we share your information with

Service providers

We use companies that help us run Free and Sober. They may use your information only to provide their service to us, under our instructions.

• Amazon Web Services: our servers, database, sign-in and file storage, in the United States (Northern Virginia). At launch, it holds what's in your vault only in locked form. Our servers, which run on Amazon Web Services, also handle in readable form what your phone sends with a mentor request, and appointments an organization sends as they arrive. If your program uses video meetings, our own video server for them also runs on Amazon Web Services, and carries the meetings' sound and video only in a form it can't decrypt.
• OpenAI, Amazon Web Services and Anam (your mentor's face on video): the mentor, as described above, only after you consent
• Amazon Web Services (Amazon SES): sending email, such as sign-in codes, Your Corner emails, reminders you turned on, notices that a security setting changed, notes about your plan, and the confirmation, launch and optional news emails to people on our launch waitlist, covered by our HIPAA business associate agreement with Amazon Web Services. Our emails are delivered only over an encrypted connection (TLS), and we don't track whether you open them or click their links. An address that bounced or was marked as spam stays on our account's do-not-send list, so nothing more is sent to it
• Cloudflare: passes your email address on from our website host when you join our launch waitlist, so that Amazon Web Services can send the email confirming that you joined. It receives your email address only for that
• RevenueCat: subscription status and the purchases you make, under a random ID made for it alone, and the technical details each connection carries (such as IP address, app version, platform, and the store's identifiers and settings for your device), from when a store screen is first opened until the app is closed; never your name, your email, or anything else you do in the app
• Amazon Web Services (Amazon SNS): delivering push notifications, which never contain health details, sent through Apple's and Google's push services
• Sentry: crash and error reports, with personal details removed
• Stripe: invoices for organizations, which hold counts only, never names; and, if we offer plans on our website, the payment for a plan or pack bought there, with the random ID RevenueCat knows you by
• Email (Google Workspace), covered by our HIPAA business associate agreement with Google Workspace: our support inbox, support@freeandsober.com, which replies as "FS Support"
• Webflow, our website host: our website and what you type into its forms

Apple and Google handle your purchases under their own privacy policies. If your phone backs up your key, Apple or Google also holds a copy of it, as "Your key" above explains. Our current list of service providers, with what each receives and where, is on our subprocessors page.

People you choose

• Your Corner. People you add get one invite email from us, or, if you choose, a link you send them yourself, in your own words. We send them nothing else until they accept. After that, they see only what you chose for them, such as milestones or your day count. They never see your recordings, mentor conversations, check-ins, notes, cravings or slips. If your count restarts, milestone emails simply pause. You can remove anyone at any time, and sharing stops the same day. Corner members are never contacted in a crisis.
• Your trusted contact. We never contact them ourselves. When you tap the button, the app opens your own phone's dialer or messages, and you see any message before you send it.
• The share card. When your Time Capsule opens, you can share a card that marks the moment. It never includes the recording, and you choose where it goes.

Organizations you join

If you join through an organization's code, the app first shows you one screen listing what the organization will see and what is not shared with your program. Nothing is shared unless you agree.

• The organization sees engagement counts for all its members together. It can't tell who from them. It sees exactly how many members it has and how many joined and left each month; activity counts from 1 to 10 are shown only as "fewer than 11." It is billed for each member, so its monthly invoice shows the exact number of members on each plan, and its admin page lists each seat by number with the plan it is on. Until you sign its separate privacy disclosure, that is all it sees of your seat: not when you joined, whether you are still there, or anything you did. Once you sign, and until you withdraw, it also sees when you joined and whether your seat is active, and, if you signed its disclosure as it reads from October 10, 2026, its staff see your first name and the first letter of your last name, as you entered your name in the app, beside your seat.
• Each time the organization's staff, its systems or our support team look at or change anything about your seat, we keep a record of it: who did it, what, and when, with the IP address they used and the name and version of their browser. It never holds anything you wrote or said. A record can't be changed once written; each night the new records are copied to storage locked so that no one, not even us, can change or delete them, and they are kept there six years, so the organization's access to your information can be checked.
• If the organization connects its own systems to Free and Sober, nothing about you goes to it, and nothing addressed to you alone comes from it to your app, until you sign a separate privacy disclosure in the app. Messages it sends to all its members or a group are described under "Messages from your organization" below. The disclosure lists what the organization could send you (appointments and program dates, which you accept or decline one by one) and what it could see. Once you sign, it can see what you chose. You can withdraw at any time. It stops that day, both ways, and the organization learns only that sharing ended, not why; appointments already on your calendar stay yours to keep or delete.
• The organization's name, logo and general resources page are the same for every member, and are not about you.
• Your Time Capsules, corner capsules and journal are never shared with an organization, signed or not. At launch, they will be encrypted so that only you, with your key, can open them, and neither the organization, its systems nor we can.
• Your words, recordings, mentor conversations, notes, calendar and Your Corner, and any crisis or safety event, are not shared with your program, even if you sign, except a quick reply you choose to send your care team, such as "I'm OK" or a request for a call, and what you say and show in a video meeting with its staff that you choose to join (see "Video meetings with your program" below).
• While its program gives you your seat, you can have the mentor by message and by voice, never on video, and your conversations are not shared with your program (see "Your mentor" above).
• You can leave the organization from the You tab at any time, and sharing stops that day.
• The organization cannot delete, export or keep your data when you leave. Your account is always yours.

Capsules from your care team. If your organization offers them and you sign its privacy disclosure in the app, your counselor, or your care team together, can send you a sealed capsule addressed to you alone, a video or voice recording that opens a set number of days after it is sealed (30, 60, 90 or 365). It is locked in the sender's browser so only your key can open it, and it opens on a date, never on your count. You can sign after you leave the program's care, while your seat lasts. Once you sign, the organization sees whether you've set up the app (your vault key), so it knows whether a capsule can reach you, and its counselors see whether you opened each capsule, any quick reply you choose to send ("Thank you" or "Can we talk?"), and whether you muted its messages, never why. Nothing you open or send while you are not signed is shown to them, even if you sign again later. If you delete a capsule, your care team sees that you removed it, even if you delete it while you're not signed up for messages; if one isn't delivered (a mute or a closed window left nothing in it), they see only that. Either way they see nothing more. We keep only that it was sent, by whom and when, so the one-per-person limit holds. A "Can we talk?" you sent stays with them as your request. You can mute your counselor or the whole organization at any time, in You, then Your program, which stops new capsules addressed to you; capsules already sealed still open on their day, except that parts of a team capsule from a counselor you have muted are left out. Something recorded for you while you had that counselor muted is held, and shown only if you unmute within 14 days; otherwise it is deleted. Capsules already sealed for you stay yours, even if you leave, and once you withdraw or leave, the organization learns nothing more about whether you open them, only that you removed one, or that one wasn't delivered. A "Can we talk?" sends the staff member who recorded it and the organization's named contact an email that says only that a member asked for a call; it carries no detail about you, and they see who in their portal. It isn't monitored around the clock: if you need help now, call or text 988, or use the crisis help in the app.

Messages from your care team. If your organization offers them and you sign the version of its privacy disclosure that covers them, your counselor or care team can also send you messages addressed to you alone: a video, a voice recording or a short note of up to 500 characters. Each is locked in the sender's browser so only your key can open it, lands in Messages, under "From your care team", and opens right away. Some come on check-in days your care team sets, so many days after your discharge date; others are sent when written. At most 10 reach you in any 7 days from your whole organization, and capsules don't count toward that. Whether a message may reach you is checked when it is due: if you've withdrawn, left or muted its sender by then, it doesn't. You can send one quick reply to each, "Thank you", "I'm OK" or "Can we talk?"; a "Can we talk?" goes to the staff member who sent it and the organization's named contact, by an email that says only that a member asked for a call, and shows in the organization's portal with who asked. Nobody watches for replies around the clock: if you need help now, call or text 988, or use the crisis help in the app. Once you sign, the organization's counselors see, for each message, whether it reached you, whether you opened it, any quick reply you sent, and whether you muted its messages, never why; and, while you are signed, the organization sees whether you've set up the app. A message sent while you had muted its sender, or your whole organization, waits, and reaches you only if you unmute within 14 days of its day; otherwise it is deleted. If the staff member who recorded it leaves the organization, it still reaches you, from "your care team", unless you had muted them, and then it is deleted. When you withdraw, leave, or your organization stops offering messages, those not yet delivered are cancelled and deleted; the ones you have stay yours, and the organization learns nothing more about them. If you delete a message, it is gone from what your care team sees, though a "Can we talk?" you sent about it stays with them as your request, and it still counts toward the limit for its 7 days.

Messages from your organization. If you join through an organization's code and it offers them, it can send voice, video or written messages to all of its members, or to a group of at least 11 members, such as everyone who finished its program in the same month, or everyone with a discharge date, or a group it names and chooses the members of, from members who signed the privacy disclosure. They are the same for everyone who receives them and are not about you. Before any reaches you, the app shows you a notice about them, and you receive them only if you agree; you don't need to sign the privacy disclosure. If you haven't signed it, you get only the ones sent to all members, because every group is made only from members who signed. These messages land in Messages under the organization's name. You can send a heart or report one to us; there are no replies. The organization doesn't learn whether you, personally, opened one, sent a heart or reported one. It sees only group totals: how many members were in the group a message went to (only members who agreed to receive messages and haven't muted them are counted), with any number under 11 shown as "fewer than 11" and larger numbers in bands of 10; and how many opened it and how many sent a heart, shown in bands of 10 only when at least 11 did and at least 11 in the group didn't. It can send up to 5 a day for its whole program, with no weekly limit, and can't send one to a group of fewer than 11 members, or to a group that differs from another of its groups, or from all its members, by fewer than 11 people. These messages are stored encrypted, but not in your vault, so our systems can read them, and we read one when a member reports it. You can mute them at any time in You, then Your program; you then leave the organization's counts, which never name you, and what is sent while you have them muted never reaches you. Leaving the organization stops them right away, and so does the organization leaving Free and Sober or stopping them; the ones you already have stay until you delete them.

Your capsules and messages stay until you delete them or your account, except that an organization can withdraw a message it sent to a group, which removes it from every member's messages, and we can remove content that breaks our Terms. Capsules and messages from your care team, and messages from your organization, are never sent to an AI provider, and the mentor never sees them. Each notification about one says only "You have a new message.", with no title and without our app's name. Your phone still shows the app's icon and home-screen name above every notification, as it does for every app, and that name is "F & S", so neither your home screen nor a notification says "Free and Sober". The same is true of voice and video messages from your corner: never sent to an AI provider, never seen by the mentor, never transcribed, and each notification says only "You have a new message."

Video meetings with your program. If your program uses meetings, its staff can hold video meetings with you in the app, a group or one-on-one. You can join only after you have signed the version of its privacy disclosure that covers meetings and agreed to a notice about them in the app. You join from a waiting room, and a host lets you in. Everyone in a meeting sees and hears you, with your first name only. Meetings go through Free and Sober's own video server at Amazon Web Services and are end-to-end encrypted with a key made from the meeting's code, so that server can't see or hear them; we keep the code only until the meeting ends. We never record or transcribe a meeting, and no AI provider receives it. We keep, for a day after a meeting, that you asked to join, whether you were let in and how long you were connected. After that we keep the meeting's own record: who it was for (for a one-on-one, your seat), when, how long it ran and, for a group, how many were in it at most and their time together. Our access log, which records everything staff do about your seat, also records, by your seat, each time a host saw you in the waiting room or in the meeting, let you in, muted you or removed you, and we keep it as long as that log (see "How long we keep your information"). So we keep a record that you came to a meeting, never what was said or shown in it. Your program sees who is in a meeting while it runs, as anyone in it does, and how many hours its meetings used; we give it no list of who joined. Someone in a meeting could still record it on their own device, which we can't stop. Meetings aren't for emergencies: if you need help now, call or text 988, or use the crisis help in the app.

If the organization is a health care provider covered by HIPAA, we act as its business associate for that program, and our agreement with it also applies. If it is a federally assisted addiction treatment program, the federal rules for those records (42 CFR Part 2) also apply.

In an emergency

No one at Free and Sober reads your conversations, your journal or your Time Capsules, so we do not watch for emergencies and we cannot send help. If you are in danger, the mentor brings up 988 and 911 and stays with you while you call. It never claims to have called anyone. If you set up a trusted contact, you can reach them with one tap: the app opens your own phone's dialer or messages. We don't send the alert ourselves. See The mentor and your safety and our crisis protocol.

When the law requires it

We may share information when the law requires it, such as a valid court order or subpoena. Our lawyer reviews every request, and we share only what the law requires. Records from a federally assisted addiction treatment program need a qualifying court order.

What we can hand over depends on what we can read. At launch, what's in your vault is stored only in a form we can't unlock. If the law requires us to hand it over, all we can give is the locked files and records, with the details that stay readable to us, such as their dates and sizes. We can't unlock them, and we have no key to give. Everything else we hold, such as your account details, your counts and dates, your calendar's times, our logs, and your mentor conversations while we hold them, we can read, and the law may require us to hand it over. A legal demand can also be sent to a company that holds data for us, such as Amazon Web Services, or to an AI provider for what it keeps, such as what OpenAI may keep for up to 30 days.

If our company changes

If Free and Sober Inc., or the Free and Sober business, is ever merged with or sold to another company, your information would move only under the promises in this policy. We would tell you before it moved, and you could delete your account first.

No sale, no targeted ads

We do not sell your personal information. We do not share it for targeted or cross-context advertising. We do not work with ad networks or data brokers. No other company collects information about your activity over time and across different websites or apps when you use our app or website. If your browser sends a Global Privacy Control or Do Not Track signal, we treat it as a request to opt out of sale, sharing and targeted advertising, none of which we do.

Our website

• No trackers. Our website has no analytics tools, no advertising pixels, and no tracking cookies.
• Forms. When you use a form on our site, such as the contact form, the account deletion request, a request for an organization join code, or our launch waitlist, our website host stores what you type and sends it to us. Please do not include health details. We do not need them to help you.
• Launch waitlist. Before the app launches, you can leave your email address on our website to hear when it does. Signing up shows that you asked about a sobriety app, so we treat it as health data and ask for your consent first, with a box you tick yourself. We use your address to send you a short email confirming that you joined, which links to our Instagram and Facebook pages with no tracking, and one email when the app launches. The launch email says Free and Sober isn't available in Utah yet, and includes the waitlist code FIRST30 for 30 days of the Essentials plan free, for people on the waitlist. A second box, which is optional and never ticked for you, asks whether you also want occasional news from us after that, such as new features and tips. If you tick it, we keep your address and send you news until you unsubscribe. If you don't, the launch email is the last one we send. Every email has an unsubscribe link, and we stop within 10 business days at the latest. We don't track whether you open these emails or click their links. Our website host (Webflow) and Amazon Web Services keep your address. Cloudflare passes your address on from our website host, and Amazon Web Services sends the email confirming that you joined, the launch email and any news (Amazon SES). If an email to your address bounces or is marked as spam, Amazon Web Services keeps the address on our account's do-not-send list, so nothing more is sent to it. We never sell your address, use it to target ads, add it to any mailing list you didn't choose, or give it to an advertising or social media company, even in scrambled (hashed) form. To take it off the list, use the unsubscribe link in any of our emails, or email support@freeandsober.com.
• Basic delivery. Like any website, our host processes technical information such as your IP address to deliver pages and keep the site secure.

If someone added you to their corner

Someone who uses Free and Sober gave us your first name and email address so you can follow their progress. Only the person whose corner it is can add people to it.

• We send you one invite email, unless they chose to send you the link themselves. Nothing else is sent unless you accept.
• Every email has a one-click way to stop.
• If you accept, we keep your name, email and acceptance, and any notes you send. At launch, a note is locked in your browser, by our web page, before it is sent, so only their key can open it and we can't read it. We keep who sent it and when.
• On Plus and Premium, if they turn it on for you, you can record a corner capsule on the corner web page. It is voice only, up to 90 seconds, and sealed until the milestone they picked. At launch, it is locked in your browser, by our web page, before it is sent, so only their key can open it. We can't hear it, and you can't play it again after you send it. Only they can play it, on its day. We keep who sent it, when it opens and its size. It never goes to an AI provider or an organization.
• On Plus and Premium, if they allow it, you can also record a voice or video message for them on the corner web page, up to 90 seconds, that opens right away, or a video capsule that opens on a milestone they reach. At launch, it is locked in your browser, by our web page, before it is sent, so only their key can open it. We can't hear or watch it. We keep who sent it, when, whether it is voice or video, when it opens and its size, and when you sent something, for two days, to hold each person to five a day. You don't see whether they opened it. It never goes to an AI provider or an organization.
• They can mute, block or remove you at any time, and you are not told. While voice and video are on for their plan: what you send while muted shows only if they unmute you within 30 days, what you send while blocked is deleted without being shown (a block lasts until they unblock you, even if voice and video are later turned off), and once they remove you your link says only "This link is no longer active." If you leave their corner yourself, what you already sent stays theirs.
• If they report you, we receive your first name, email address and the time, and the message itself only if they choose to share it with us. We use a report only to keep Free and Sober safe, and we delete it within 90 days.
• The corner web page comes from our server, so its lock depends on that page being the one we built. Like any website, our servers log your IP address when you use it.
• To have your details deleted, stop the emails and write to support@freeandsober.com.

If you run an organization's account

If you manage an organization, we keep your name, work email, sign-in codes and two-factor setting, and your organization's billing contact. Invoices go through Stripe and hold member counts only, never member names. Each time you sign in, or look at or change anything in your organization's admin page, we record your staff account, your role, what you did and when, and the IP address and browser you used, in our access log, which we keep for six years. The same goes for your organization's systems, by their key.

How long we keep your information

• Your account and what is in it: until you delete it, or until you delete your account. If your subscription ends, we keep your data so it is there when you come back. Export and delete are always open to you.
• When you delete your account: in the app, Delete my account signs you out on every phone, and your account is deleted 30 days later. Until then it stays as it was, but nothing in it is used and nothing is sent to you, no organization sees anything of yours, and the people in your corner see that you have paused sharing. Signing in before that day lets you keep your account, just as it was, or delete everything now. On the day, we delete it for good and send one email to your address to say it is done. Delete everything now in the app, and our account deletion request, delete it at once. Once your account is deleted, everything in the database goes at once, except the records listed below, and your recordings are deleted right after, sealed or not. At launch, this includes your locked vault and the locked copy of your key. When you delete your account in the app, the app also deletes your key from that phone and from your iCloud Keychain or Google backup: at once with Delete everything now, or, after the 30 days, the next time you open the app on that phone. If you delete it another way, a copy of your key may stay on a phone or in that backup, but what it opened is gone from our live systems. If you printed a recovery key, you can destroy it. What an AI provider already received may stay with it for up to 30 days, as described above, before it deletes it. We can't make it delete that copy sooner.
• After a deletion you asked for in the app: a scrambled receipt that only the phone you asked on can match, for 180 days after your account is deleted, so that phone can learn your account is gone and delete your key. It names no one and holds nothing about you.
• A Time Capsule you take back in its first hour is deleted. Its file can stay in our storage's deleted-file recovery for up to 30 days. At launch, it stays locked there, and we can't play it.
• A recording that was uploaded but never sealed: deleted after about a week, then kept for up to 30 days in our storage's deleted-file recovery. At launch, it is locked with your key there too.
• Things locked with a key you lost: if you start a new vault, what was locked with your old key stays locked, and we keep it until you delete it or your account, in case you find your key or recovery key.
• The locked copy of your key: until you make a new recovery key or delete your account.
• Mentor conversations: only for the session, unless you agree to a short, stated retention window. If you do, we keep your history for the period the app shows you when you turn it on, locked with your key at launch.
• The mentor's memory: until you edit it, delete it, or delete your account.
• Check-ins your mentor opened: that a check-in was opened that day, and which of up to three, for 3 days, never its time or any words; deleted with your account.
• Video calls with the mentor: the record of each call (which mentor, when, and the minutes it used), until you delete your account.
• Records an organization sent us: removed when you leave the organization, unless you choose to keep them.
• A referral code: the code, when you added it, the version of the line you agreed to, and your app store's subscription events, until you delete your account. Without a referral code, we keep only the subscription events from your first 7 days, and delete each one about 8 days after it reaches us. Our records of what we paid the person who shared it stay for our books, without anything that identifies you.
• Backups and deleted-file recovery: we keep encrypted backups only to recover from failures and mistakes. Our database keeps daily backups for 30 days, and our file storage keeps deleted files for 30 days. Deleted data can stay in them for that time, and never longer than six months. We never bring back anything you deleted, or anything removed when your account was deleted, so deleting is permanent for you. At launch, what's in your vault stays locked in them, and we can't open it. An old locked copy of your key can stay in them for the same 30 days.
• Security and server logs: logs of when you signed in or used the service are kept for up to six years. Our server's own logs are kept for a year. Our database's audit log is kept for a year in our live systems, and, once we switch that archive on, copied to an archive locked so that no one, not even us, can change or delete it, for six years. Our meetings server's logs, which can hold the address a phone connected from, are kept for 30 days. The access log of an organization's members (who looked at or changed what about a member's seat, and when, with the IP address and the browser's name and version of the staff member, system or support team member who did it) is kept for at least 400 days in our live systems, where a record can't be changed, and each night copied to an archive locked so that no one, not even us, can change or delete it for six years. When your phone uploads or downloads a recording, our storage provider's security log records the IP address it came from; we keep that log up to six years, locked for the first year. Records of our security program, such as incident reports and access reviews, are kept for six years. None of these holds the content of what you wrote or said.
• Consent records: a record of each consent screen you answered (which screen and version, a fingerprint of the screen's template text, the time and your choice; for an organization's screens, also which organization, and for its privacy disclosure the seat you signed from and what you chose to share) and of any organization privacy disclosure you signed, kept while your account exists and for six years after. Records of your agreement to a plan's automatic renewal are kept for three years, or one year after your plan ends, whichever is longer. After you delete your account, we keep these records in a form that no longer identifies you, except a signed organization privacy disclosure, which we keep for six years, even after your account is deleted, as our agreements with organizations provide and, for an organization covered by HIPAA, as HIPAA requires.
• Crisis referral counts: kept for the reports the law requires. They hold no user identifiers.
• Crash and error reports: kept by Sentry for up to 90 days. They are set up to leave out your name, your email and what you wrote.
• Notification tokens: while your account exists. A token stops working when you turn off notifications or delete the app, and it is deleted with your account.
• People in your corner: their first name, email address and acceptance, until you remove them or delete your account. What they sent you stays until you delete it or your account, except what a mute held past its 30 days, what a block or a removal withdrew before it opened, and content we remove because it breaks our Terms; each of those is deleted. If someone asks us to stop writing to them, we keep their email address only so we never write to them again.
• Messages from your care team: until you delete them or your account, except that one not delivered within 14 days of its day (held while you had muted its sender, or waiting for the limit), and any not yet delivered when you withdraw, leave, or your organization stops offering them, is deleted, its file too. When each message reached you is kept for 8 days, for the limit of 10 in any 7 days. A "Can we talk?" stays with your organization's portal as your request until you delete your account.
• Messages from your organization to its members: until you delete them or your account, unless the organization withdraws one or we remove it; then it goes from every member's messages, and its file is deleted. Your agreement to receive them and your mute are kept until your account is deleted. Your place in a group your organization named: until you withdraw, leave or delete your account, or it archives the group or leaves Free and Sober. One the organization withdraws or we remove leaves only the time it was sent, kept long enough to enforce the limit of up to 5 broadcasts a day for the whole program, with no weekly limit.
• Video meetings with your program: that you asked to join, whether you were let in and how long you were connected, until a day after the meeting ends. The meeting's own record (who it was for, for a one-on-one your seat; when; how long it ran; and, for a group, how many were in it at most and their time together) stays as a record of the service your organization used. The access log's record, by your seat, that a host saw you waiting or in the meeting, let you in, muted you or removed you, is kept as that log is (above). The meeting's code, only until the meeting ends.
• Reports of someone in your corner: the sender's first name and email address and the time, for 90 days from the report; anything you chose to share, until we close the report, and never longer than those 90 days.
• Website forms: what you type into a form on our site is kept by our website host until we have handled it, and then deleted there. If it becomes a support request, we keep it as a support message.
• Our launch waitlist: your email address and the record of your consent (which version of the form you agreed to, and when, for each box you ticked). If you didn't tick the box for news, we keep them until we send the email about the launch, and delete them within 30 days after we send it. If you ticked the box for news, we keep them until you unsubscribe, and delete them within 30 days after you do. Either way, we delete them from our website host and from anywhere we copied them to send the emails, and if you ask first, we delete them sooner. Whenever you unsubscribe or ask to leave, we keep only a do-not-email record: a scrambled (hashed) form of your address, so we don't send it waitlist or news email again unless you sign up again. If an email to your address bounced or was marked as spam, Amazon SES keeps the address itself on our account's do-not-send list. It isn't scrambled, and while it's there no email is sent to it, even if you sign up again, until we take it off at your request (write to support@freeandsober.com). If the app hasn't launched within six months of when you signed up, we delete them without writing to you, even if you ticked the box for news.
• Records of what an organization received: if you signed an organization's privacy disclosure, we keep a record of what its systems asked for or were sent about you, and when. It holds a masked reference to you, never content, and we keep it for six years, as our agreements with organizations provide.
• If you run an organization's account: your name, work email and sign-in settings while you run it and its agreement is in effect, and records of the service and invoices, which can name you, for six years.
• Support messages: as long as we need them to help you and to keep the records the law requires.
• Purchase records: Apple and Google keep these under their own policies. RevenueCat keeps your subscription and purchase history under a random ID while your account exists. When your account is deleted, we ask RevenueCat to delete it. If you bought on our website, Stripe keeps its records of the payment under its own policies; ask us, and we delete your customer record at Stripe.
• When the law requires more: if the law requires us to keep something longer, for example under a court order or during a legal claim, we keep it only as long as the law requires.

Your rights and choices

What everyone can do

We give these rights to everyone who uses Free and Sober in the United States, wherever you live.

• See and download your data. In the app, go to You, then Export your data. You get one file with your profile and reasons, every count, your calendar, your journal, your safety plan, and your Time Capsule details. At launch, your copy is made on your phone, where your key is, and it holds every capsule that has opened, ready to play or read. A sealed capsule stays sealed until its day, even in a copy. Anything locked with a key that isn't on that phone is listed as locked, with its dates. Your copy isn't locked, so keep it somewhere private: anyone who has the file can read it.
• Correct it. Change your name, start date and path from You, then Your start date and path. Change appointments in your calendar. Read and edit the mentor's memory. For anything else, write to us.
• Delete it. In the app, go to You, then Delete your account. Delete my account deletes it 30 days later, and signing in before then lets you keep it; Delete everything now deletes it at once. You can also use our account deletion request, or email support@freeandsober.com from the address on your account, and once we confirm the request is yours, we delete it at once. Deleting your account does not cancel a subscription from the App Store or Google Play: cancel that there. A plan bought on our website stops renewing when you ask to delete your account, and ends when the account is deleted. See Billing and subscriptions.
• Take back your consent. Remove someone from your corner, or leave an organization from the You tab. To stop an AI provider from receiving your information, turn it off in You, then Privacy, then AI providers, or write to us. To leave our launch waitlist or stop our news emails, use the unsubscribe link in any of our emails, or email support@freeandsober.com, and we delete your address, except that scrambled (hashed) form. If an email to your address bounced or was marked as spam, Amazon SES keeps the address itself on our account's do-not-send list. It isn't scrambled, and while it's there no email is sent to it, even if you sign up again, until we take it off at your request (write to support@freeandsober.com).
• Turn things off. Turn off notifications in the app or in your phone settings. Every corner email has a one-click stop.

How we handle requests. When you write to us, we confirm the request comes from you, usually by replying to the email address on your account. Someone you authorize can make a request for you, with proof that you authorized them. We answer within 45 days. If we need more time, we tell you why within those 45 days, and we take at most 45 more days.

Your vault and your requests. At launch, we hold what's in your vault only in locked form, so we can't read it, correct it or send it to you ourselves. When you ask us for your data, we send what we can read, and the app makes your copy of your vault on your phone.

No penalty. We will never charge you more or give you a worse service because you used your rights.

Appeals. If we turn down a request, you can appeal. Reply to our answer, or email support@freeandsober.com with "Appeal" in the subject line. We answer an appeal within 45 days. If you disagree with our answer, you can contact your state's attorney general.

California

If you live in California, we give you the rights that California law (the CCPA, as amended by the CPRA) describes, whether or not that law applies to us: the right to know what personal information we collect, use and disclose; to delete it; to correct it; to opt out of its sale or sharing; and to limit the use of sensitive personal information. You also have the right not to be treated differently for using these rights. We also treat the health information in Free and Sober as medical information under California's Confidentiality of Medical Information Act, and we do not disclose it without your permission except as that law allows.

• We do not sell or share your personal information, as California law defines those words, so there is nothing to opt out of.
• We use sensitive personal information, such as health information and your account sign-in, only to provide the service you asked for and for the other purposes California law allows.

In the past 12 months, we collected these categories of personal information:

• Identifiers, such as your email address, first name, IP address and a random subscription ID
• Commercial information, such as your plan and purchases of voice minutes
• Internet or other electronic activity, such as crash reports and security logs
• Audio and visual information, such as your Time Capsule recordings and the voice you use with the mentor
• Sensitive personal information, such as health information about your sobriety and your account sign-in
• Inferences, such as the notes in the mentor's memory
• Professional information, such as the name and work email of someone who runs an organization's account

We collect it from you, from your device, from people in your corner, from organizations you join, and from Apple and Google (and Stripe, for a purchase on our website). We use it for the purposes in "How we use your information." We keep it as described in "How long we keep your information."

In the past 12 months, we disclosed each category above for a business purpose to our service providers: our hosting, email, subscription, push, crash-report, billing, support-email and website providers, and, only with your consent, our AI providers, which received identifiers, audio, sensitive personal information and inferences. At your direction, we disclosed identifiers and the progress you chose to the people in your corner, and counts, or the view you signed for, to an organization you joined. "Who we share your information with" explains each one. We do not sell or share personal information, and we have no actual knowledge of selling or sharing the personal information of anyone under 16.

California's "Shine the Light" law lets you ask whether we share personal information with others for their direct marketing. We do not.

Washington, Nevada and Connecticut

These states have laws that protect consumer health data. Our Consumer Health Data Privacy Policy explains what health data we collect, why, who we share it with, and how to use your rights to access, delete and withdraw consent.

If you live in Connecticut, you also have rights under the Connecticut Data Privacy Act, as amended: to confirm whether we process your data and access it, including any inferences we made; to correct it; to delete it; to get a portable copy; to get a list of the third parties we sold your data to (we sell to none); to know whether your data is used for profiling that leads to decisions with legal or similarly significant effects, and to question the result; and to opt out of targeted advertising, sale and that kind of profiling. We do not sell your data, use it for targeted advertising, or use it for that kind of profiling. Our crisis detection sets a risk level only to show you crisis help during a conversation; it is not used to make any decision about you, and it is not kept after the session. We do not collect, use or sell personal data to train large language models.

In an emergency

Free and Sober is not an emergency service. If you are in danger, call 911. If you are thinking about suicide or are in emotional distress, call or text 988, the Suicide and Crisis Lifeline, any hour.

We don't watch conversations for emergencies. But if someone tells us directly, for example by email to support, that a person's life or safety is in serious and immediate danger, we may share the minimum information needed with emergency services or someone able to help. We can share only details we can read, never what's in your vault. Where federal health privacy rules apply, we follow their emergency rules and keep a record of what was shared, with whom, and why.

Children

Free and Sober is for adults 18 and older. When you sign up, we check your age using the age range your app store provides, where it provides one, or, where it does not, by asking you to confirm you are 18 or older. We do not knowingly collect information from anyone under 18. If we learn that someone under 18 is using the app, we first make sure they have crisis resources if they need them. Then we restrict the account at once, and delete it and the information we collected within 30 days, which gives an adult identified as under 18 by mistake time to confirm their age. If they are under 13, we delete it at once. If you think a child is using Free and Sober, write to support@freeandsober.com.

Our launch waitlist is for adults 18 and older too. If we learn that someone under 18 joined it, we delete their address and don't write to them.

If someone who used Free and Sober dies

We're sorry for your loss. A family member, or the person handling the estate, can ask us to delete the account. Write to support@freeandsober.com with proof of the death and of your role.

• We can't open or play what's in their vault, such as their Time Capsules or journal, for family or an estate, even with a court order. At launch, it is locked so only their key can open it, and we never have that key. If the law requires us to hand something over, all we can give is the locked files and the details we can read.
• We never open a sealed capsule early, for anyone.
• We share the details we can read, such as the account's email address and dates, only with someone the law entitles to them, such as the legal representative of the estate, and only as the law requires.

Security incidents and breach notification

We have a written plan for security incidents. If a breach exposes your health information, we will:

• Tell you without unreasonable delay, and no later than 60 days after we discover it (sooner where state law requires), by email to the address on your account, together with a notice in the app or a banner on our website
• Tell you what happened, when it happened and when we found it, who got the information if we know, what information was involved, what we are doing, what you can do, and how to reach us
• Tell the Federal Trade Commission, and the media where the FTC's Health Breach Notification Rule requires it
• Follow the breach laws of your state

At launch, what we store from your vault is locked, so someone who steals a copy of what we store gets it only in a form that can't be opened without your key. That doesn't protect what your phone sends with a mentor request while our servers handle it, appointments an organization sends while they arrive, or corner notes and capsules sent through a corner page an attacker had changed. The details that stay readable to us, such as your email address, dates and counts, could also be exposed. They are health information too, and this section covers them.

If the breach involves information we hold for a health care organization covered by HIPAA, or records from a federally assisted addiction treatment program, we tell that organization within the time our agreement sets, and no later than 60 days after we discover the breach, and the organization notifies you as the law requires. For the rest of your account, we tell you ourselves, as described above.

Changes to this policy

When we change this policy, we post the new version here with a new date. If a change is important, we tell you in the app or by email before it takes effect. We will never use your information in a new way without asking you first.

Contact us

Email support@freeandsober.com. It is our one address for privacy questions, data requests, security reports and billing. You can also use our contact form. We reply within 24 hours.

Free and Sober Inc., 89 Moody Road, Enfield, CT 06082

Our support inbox is not watched around the clock. If you are in crisis, call or text 988, or call 911.