In short
Last updated October 16, 2026. Free and Sober is operated by Free and Sober Inc., a Delaware corporation. We use the companies below to run the app and the website. Each may use the information it receives only to provide its service to us, under a written agreement. None may sell it, use it for advertising, or use it to train AI models. We store everything in the United States. Where a provider may process some data outside the United States, or where it handles data is still to be confirmed, the list says so. Some organizations that give their members Free and Sober are covered by HIPAA, and we act as their business associate. That is why we list each company's HIPAA business associate agreement. The providers that may handle a program's 42 CFR Part 2 records (Amazon Web Services, OpenAI and Google Workspace) are covered by signed agreements that bind them to HIPAA and to 42 CFR Part 2's limits on use and disclosure. When a person uses Free and Sober on their own, HIPAA doesn't cover their information, and these agreements don't change that. Our Privacy Policy explains what protects it, and gives everyone the same protection. Before launch. Free and Sober is not in the app stores yet. This list describes the companies we will use at launch. Where a company is marked "Before launch" or "At launch", its agreement and settings will be in place before it receives anyone's information. We keep this list current. Organizations that use Free and Sober are told about changes at least 30 days in advance, as their agreement with us provides.
Companies That Process Member Data
Amazon Web Services (ECS Fargate, RDS for PostgreSQL, Amazon S3, Amazon CloudFront, Amazon SES, Amazon SNS, Amazon Bedrock, Amazon Transcribe, Amazon Polly, Amazon EC2, Secrets Manager and KMS)
- What it does for us: runs our API, the server that connects the app to our database and the AI providers; holds our database, sign-in and file storage; sends our email (Amazon SES); sends our push notifications through Apple's and Google's push services (Amazon SNS); when someone talks with the mentor out loud, turns speech into text (Amazon Transcribe), checks each message and reply for part of our crisis detection (Amazon Bedrock Guardrails) and speaks the mentor's replies (Amazon Polly); and, for an organization that uses video meetings with its members, runs our own video server for them (Amazon EC2). The email: sign-in codes, Your Corner invitations and milestone emails, opt-in calendar reminders, notes about your plan, the email saying your account is deleted, and, at launch, opt-in Time Capsule reminders and notices that a security setting changed; the email confirming that someone joined our launch waitlist, the one launch email to people on it, and occasional news emails to people who ticked the optional box for them. These emails aren't tracked.
- What it receives: every account and its contents: day count, check-ins, calendar, the journal, mentor memory, organization links, and Time Capsules and corner capsules. At launch, what is in each person's vault is stored only as ciphertext that AWS can't read (see "What Is Locked, and Where It Is Stored" below). Everything else we hold is stored in a form AWS could read as our host, such as account details, email addresses, start dates and counts, each capsule's dates and file size, appointment times, corner members' names and emails, and logs. Everything that passes through the API, in transit and while processing, including mentor conversations and anything a person's phone sends from their vault with a request, which our server reads in memory. When the mentor runs there, what a person writes or says to the mentor and what the mentor needs to answer, the same as OpenAI below; Amazon Bedrock's logging of what is sent is off, and we don't record the audio. For video meetings, the meetings' sound and video, end-to-end encrypted so AWS can't see or hear them, and first names while a meeting runs; its logs, kept 30 days, can hold the network address a phone connected from. Launch waitlist sign-ups: email addresses, consent records and scrambled (hashed) do-not-email records. It also keeps our database backups for 30 days, and deleted files for 30 days in its storage's deleted-file recovery. Logs record who did what, when, and from which IP address, never content. For email, it receives each recipient's address and what the email says: corner members' first names, that a milestone happened, the time of an opt-in calendar reminder and the day of an opt-in Time Capsule reminder. Never anything from a person's vault, and subject lines never mention sobriety. Email is delivered only over an encrypted connection (TLS). An address that bounced or complained stays on our account's suppression list, so nothing more is sent to it. For push notifications, it also receives each phone's push token and the push text, which never contains health details.
- Where the data is: United States (us-east-1, Northern Virginia). The mentor runs there too, in that region only.
- HIPAA business associate agreement: the AWS Business Associate Addendum, accepted in AWS Artifact on September 26, 2026, before any member data is stored. The mentor runs on AWS for anyone only once AWS has confirmed in writing that this agreement covers the mentor's model.
- Status: before launch. The mentor on AWS: after the person consents. Video meetings: only for an organization that uses them.
OpenAI
- What it does for us: the mentors' text replies, and part of our crisis detection.
- What it receives: what a person says to a mentor during a session, and what the mentor needs to answer: first name, path, reasons, memory notes, any journal entry the person lets the mentor read, and what is coming up on their calendar if they turn that on. Anything from the person's vault arrives only when their phone unlocks it and sends it with a request the person started, and OpenAI reads it, because the mentor has to read it to answer. Never Time Capsules, whether video, voice or writing, or corner capsules, and never anything an organization sent.
- Where the data is: OpenAI's standard service, with no United States location promised. Calls are made with storage turned off (store: false), under Modified Retention set in our signed agreement; we don't claim zero data retention.
- HIPAA business associate agreement: signed.
- Status: at launch, after the person consents. For members of an organization's program too, after the member consents: what they type in messages and the words of a voice conversation, sent under our signed HIPAA business associate agreement with OpenAI.
Anam
- What it does for us: our live avatar host. In video calls with the mentor, it shows the mentor's face and moves its lips with the finished sound of the mentor's replies. Only for people who use Free and Sober on their own, not for members of an organization's program.
- What it receives: only the finished sound of the mentor's replies during a video call, and nothing else from us. The mentor's replies can include what a person said. Like any service the app connects to, it also sees the phone's network address and how well the video connection is working, and its software in the app tells it which version it is. Never the person's voice (the app's microphone sends nothing to it), a transcript, name, account, words or anything they type, and the camera stays off. We turn off its session recording in every call. Never Time Capsules or corner capsules.
- Where the data is: United States (US East) for live calls, by Anam's own account; Anam doesn't promise that all of its storage stays there. Anam keeps no recordings or transcripts of calls; any text it receives may sit in its operational logs for up to 30 days. Data processing agreement: signed. HIPAA business associate agreement: none.
- Members of an organization's program: don't use Anam, and never have video.
- Status: In video calls, after the person consents.
Sentry
- What it does for us: crash and error reports.
- What it receives: device model, app version, and what went wrong. No personal data: no user identifiers, names, emails, typed words or request data, nothing from a person's vault, and no session replay.
- Where the data is: United States.
- HIPAA business associate agreement: signed (a backstop; reports are built to carry no health data).
- Status: before launch.
Google Workspace (support email)
- What it does for us: our support inbox, support@freeandsober.com, and our replies from it, sent as "FS Support". The app's own emails are sent by Amazon Web Services (Amazon SES), above.
- What it receives: whatever a person chooses to write to support@freeandsober.com, including anything they choose to attach, such as a recording sent with a report, which is then outside their vault's protection.
- Where the data is: United States.
- HIPAA business associate agreement: signed.
- Status: in place before launch.
Webflow
- What it does for us: our website, and its contact, account deletion, join-code request and launch waitlist forms.
- What it receives: what a person types into a form. A deletion request, or a message through the contact form, shows that the person uses Free and Sober, and a launch waitlist sign-up shows that the person asked about it. We treat both as health data, and a person may choose to write more. The forms ask for no health details. Waitlist sign-ups are deleted within 30 days after the launch email is sent, or, for people who ticked the optional box for news, within 30 days after they unsubscribe.
- Where the data is: United States.
- HIPAA business associate agreement: not offered. We ask members whose seat comes from a health care organization covered by HIPAA to email support@freeandsober.com instead of using the forms.
- Status: in use.
Cloudflare
- What it does for us: runs a small program of ours (a Cloudflare Worker) that passes each new launch waitlist sign-up from Webflow on, so that Amazon Web Services (Amazon SES) can send the confirmation email.
- What it receives: what Webflow sends for a waitlist sign-up: the email address and which boxes were ticked. It uses them only to have the confirmation email sent through Amazon SES, and keeps no copy.
- Where the data is: not stored. Each sign-up passes through Cloudflare's network in memory only.
- HIPAA business associate agreement: not signed.
- Status: in use.
Companies That Receive No Health Data
These companies are listed so that the picture is complete.
- RevenueCat: tracks which plan an app user has, and what they buy in the stores. It receives a random ID made for it alone, store purchase events, and the technical details each connection from the app carries, such as IP address, app version, platform, and the store's identifiers and settings for the device. The app first connects when someone opens its plans, plan or minutes screen, and then checks again each time someone comes back to the app until it is closed, whoever is signed in by then. No name, email or health data, and nothing else about what anyone does in the app. United States.
- Apple (App Store) and Google (Google Play): sell subscriptions and voice minute packs, and deliver push notifications. They receive purchases, under their own privacy policies, and push text that never contains health details. United States and their own networks.
- Expo: builds the app. It receives the app's code, and nothing about the people who use it. United States.
- Stripe: invoices organizations. It receives the organization's billing contact and member counts by plan, never a member's name. If we offer plans on our website (not yet), it also takes the payment for a plan or pack bought there: it receives a random ID from us (the one RevenueCat knows you by), and your email, card and billing address from you, on its own page. No health data. United States.
- UptimeRobot: checks that our public endpoints are up. It receives nothing personal; it only calls public health-check addresses.
- GitHub: stores our code. Code only. No member data is ever placed in the code repository. United States.
- Let's Encrypt: issues the security certificates for our meetings server's two web addresses. It receives only those addresses.
- Apple (iCloud Keychain) and Google (Block Store backup): not our providers for this. At launch, if a person uses iCloud Keychain, or their Android phone has Google's end-to-end encrypted backup, their phone saves a copy of their key there, under Apple's and Google's own terms. We don't send it, and we can't see or control it. Apple's and Google's own networks.
What Is Locked, and Where It Is Stored
At launch, what's in each person's vault, as our Privacy Policy lists it (the items below), is end-to-end encrypted: what they record or write there is locked on their phone with their key before it is stored. Corner capsules and notes are locked in the sender's browser by our corner web page, which comes from our server, and appointments an organization sends are read by our server as they arrive and then locked. We store only the locked versions, and no provider on this list can read them. Mentor conversations, and details such as a person's first name and start date, are not in the vault.
- In Amazon S3, as ciphertext: Time Capsules, whether video, voice or writing, and the answers to them; and corner capsules.
- In Amazon RDS for PostgreSQL, as ciphertext: the journal; corner notes; the safety plan and trusted contact; reasons; check-in answers and notes; a note on a count; the names of meetings logged; the mentor's memory and any conversation history the person keeps; and each appointment's name, kind, place and notes, including appointments an organization sends.
- The person's key: made on their phone, and never on our servers in a form we can use. If the person makes a recovery key, our Amazon RDS database holds a copy of their key locked with it, which only their 24 words open.
- What stays readable: the details the service needs, such as account details, email addresses, start dates and counts, each capsule's dates and file size, appointment times, corner members' names and emails, and logs with IP addresses. Our Privacy Policy lists them.
- What our AI providers read: what they receive, because the mentor has to read it to answer. Mentor conversations are not end-to-end encrypted.
Where No One Else Is Involved
- The journal is stored on the person's phone and, at launch, as ciphertext in our Amazon RDS database that no provider can read. It reaches OpenAI, or the mentor on Amazon Web Services, only for an entry the person lets the mentor read, sent by their phone with a request they started.
- Time Capsules and corner capsules never go to an AI provider or an organization. At launch, the only provider that holds them is Amazon Web Services, as ciphertext it can't read. A copy the person saves or sends themselves, such as one they attach to a report to us, leaves that protection.
- Calendar reminders are set on the phone, and no push service sees them. Opt-in email reminders say only "Something on your calendar at 2:30 p.m." (with the reminder's time).
Contacting These Companies
To ask any company on this list about your information, use the privacy contact on its own website (OpenAI: openai.com; Anam: anam.ai; Amazon Web Services: aws.amazon.com; Google Workspace: workspace.google.com; Sentry: sentry.io; Webflow: webflow.com; Cloudflare: cloudflare.com; RevenueCat: revenuecat.com; Expo: expo.dev; Stripe: stripe.com), or write to us and we will pass your request on.
Questions
Write to support@freeandsober.com. See also our Privacy Policy and Consumer Health Data Privacy Policy.
Free and Sober Inc., 89 Moody Road, Enfield, CT 06082