Privacy Policy

Updated October 5, 2026. This notice covers the SmartSober iPhone app, website, waiting list and public tools for AI services. Feature and delivery availability depends on the version and service configuration you use.

Optional website analytics

With your permission, the public marketing pages use Google Analytics to measure page visits and successful waitlist form submissions. Analytics stays off until you choose Allow analytics. You can decline and still use the website and waiting list, or change your choice using Analytics choices at the bottom of a public marketing page.

When enabled, Google receives a cookie identifier, the public page path and generic page title, an external referring website’s origin if present, basic browser and device information, and network information needed to receive the request. We strip query strings and URL fragments from the page address sent to Analytics, and do not send your email, form contents, private removal link or recovery information. Automatic form, search and outbound-link measurement is disabled. Private My Person invitation pages, moderation, voice screens and API routes do not load this analytics component.

We do not enable Google Signals, advertising personalization or optional account data sharing. Analytics cookies are configured for 90 days. Turning analytics off clears the Google Analytics cookies this site can access and stops future measurement; it does not erase information already received by Google. See how Google uses information from sites that use its services. Analytics counts consented visits and successful form submissions, not all visitors or a guaranteed count of unique subscribers.

The website waitlist

We store your email address, signup time, the consent version you accepted and non-sensitive campaign labels. We use this information to organize interest and, with your permission, provide launch and testing updates. Joining does not create an app account, start a subscription or guarantee an invitation. This form does not send email automatically.

Save the private removal link shown after signup. It deletes that signup without posting your email publicly. If you sign up again, the original removal link remains valid. We keep signup records while the waitlist is active unless you request removal. Before sending updates, we will provide a way to unsubscribe.

To limit repeated signup attempts, we also store a hashed network reference, an attempt count and an expiry time. These counters are separate from signup records and contain no email address or form text. Expired counters are removed in small batches as signup traffic arrives.

Your private peer account

Peer features are for adults aged 18 or older. The app sets up installation access automatically; this does not verify your legal identity or age. There is no promise that another person is available. You choose a sobriety name, confirm you are an adult and accept the versioned peer agreement. We store that profile, the date and version of your agreement, your availability choice and hashed session credentials. Your sobriety name is a pseudonym, not a promise of complete anonymity.

You appear in the listener list when you turn availability on. If you choose to ask for a conversation, your sobriety name and request are also visible to available listeners for up to 15 minutes, unless you cancel or a listener joins first. Tapping Connect invites an available listener to join your waiting chat. A listener explicitly chooses Join chat; that opens the conversation for both of you. Direct invitations still require the invited person to accept. Messages are stored on our server and read by the two participants while the connection is active. You can separately agree to a clearly labeled owner support visit, described below. They are protected in transit by HTTPS, but this is not end-to-end encrypted chat.

Connection requests and optional alerts

When you choose to ask someone to talk, we store your member ID and the request time, expiration and cancellation or completion state. This does not share a journal entry, health reading or explanation of why you want to talk. Available listeners can see your sobriety name and choose Join chat. Your waiting request and their choice to join open the conversation together. You can cancel before a listener joins or leave afterward.

Connection alerts require a separate choice in the app and iPhone notification permission. Where this feature is configured, we store your Apple push device token, its development or production environment, its associated peer session, your alert preference and its update time. Available listeners who opt in may receive an alert even when the app is closed. Direct invitations may also alert a member who opted in, including someone who asked for a conversation. Apple receives the device token and a generic notification such as “Someone would like to talk.” Notifications contain no sobriety name, message text, journal content or health information.

You can turn alerts off in the app or in iPhone Settings. Turning off listener availability stops general requests; turning off alerts stops all connection alerts on that device. Logging out removes registrations for that session; deleting or suspending a peer account removes its registrations and open requests. Expired or revoked sessions are excluded from delivery. Delivery attempts retain only event and member IDs, time and provider acceptance or failure state. Requests and delivery records older than seven days are removed on later relevant server activity, so storage can continue longer if the service is inactive. Alerts can be delayed, missed or grouped by iOS. An alert is not a promise that someone is available or emergency monitoring. Automatic My Person alerts use a separate consented plan and delivery service.

Optional owner support

Joe can ask to join an active conversation as “Joe · SmartSober Support.” Both participants must agree. The invitation expires after 10 minutes. Joe can then read and send only messages from the point both people agreed, for up to one hour. Earlier messages stay outside the support visit. Either person can decline or end the visit. Pausing or closing the chat, blocking, account ineligibility or revoking a consenting session ends access. Support messages use the same automated screening as peer messages.

You can report a support message separately from reporting the other member. That ends the visit and records the selected message reference, reporter, conversation and time for the owner to review. This is not independent oversight. Reports are available for 30 days and removed on later support-server activity. Support invitations, consent status, time boundaries and administrative action records are retained for service operation. They do not include earlier private messages. Full account deletion removes support visits associated with that member’s conversations; limited administrative records remain.

Optional app announcements

App news and updates is a separate choice. Guided setup shows recommended alert choices, which you can change or skip. Nothing is enabled until you choose Enable my notifications and allow iPhone notifications. Outside that explicit setup choice, turning on connection alerts does not also turn on app news. If you opt in and Apple push delivery is configured, the owner can send app news through Apple to your registered device. You can turn this choice off in the app or disable notifications in iPhone Settings. The owner reviews the exact title, message and eligible audience before sending. Preview audience snapshots contain device tokens and session references; they are deleted after dispatch or on later announcement activity after expiration. Announcement text and delivery metadata are retained for up to 30 days of access and deleted on later announcement activity. Provider acceptance does not prove you received or read a notification.

Automated screening and reporting

Every new sobriety name and peer message is checked for contact sharing, harassment, harmful instructions and solicitation. Our server sends that text to OpenAI for automated screening. Talking honestly about recovery, cravings, setbacks, sex addiction or substance use is welcome. Do not share phone numbers, email addresses, street addresses, social handles or links, arrange drug transactions, solicit sexual activity, threaten or harass other people. Checks can make mistakes. If screening is unavailable, the message is not delivered. A detected violation pauses the conversation for both members before the message is delivered. Either person can ask for review, leave, report or block. An administrator may approve reconnection; both people must then choose Resume chat. Approval never overrides a block, suspension or someone leaving.

For messages expressing current personal self-harm or suicidal distress, automated screening can offer the sender support options while keeping the conversation available. A support-prompt flag is stored with that message for consistent retries and is not shown to the other member or moderator. This is not a diagnosis and detection can miss concerns or be mistaken. No My Person alert is sent automatically. Reaching My Person opens a separate message for you to review and send; peer-chat text is not copied into it.

A report sends your chosen reason, optional details, and either the selected message or up to 10 recent conversation messages to SmartSober’s owner moderator. The safety inbox also records automatic pauses with member identifiers, a screening category, time and review status. Rejected message text is not retained. A request to review a pause is separate from reporting the other person. Older pauses may not have a recorded reason or triggering member. Reporting creates a receipt in that queue, not an automatic email or emergency notification. Moderation is not available around the clock.

Reports expire from moderator access 30 days after submission. Expired evidence is physically removed on subsequent peer-server activity, so storage may continue beyond that date if the service is inactive. Account deletion does not immediately remove reported evidence needed to review abuse. This same access window and cleanup rule apply.

Named administrator sign-in requires a personal sign-in key and an authenticator code. Sessions expire after 30 minutes. Administrative decisions include a reason and an action record. Incident metadata, review requests and administrator action history support safety and service operation; they contain no rejected message text, journal entries or Health readings. These administrative records currently have no automatic deletion deadline. Account deletion removes that member’s review requests, while limited incident and administrator action records remain. Contact us about retained records.

Your choices and deletion

You can change your sobriety name, turn availability off, leave a connection, block someone, report a concern or delete your peer account. Blocking stops both people from reading or sending messages in that connection. Leaving ends delivery. Logging out revokes the current session. Deleting your account revokes all its sessions, removes the profile name and unreported conversation messages, and closes its connections. Minimal access and account-status records remain to prevent a deleted or suspended account from reopening with the same saved credentials. Report evidence follows the separate rule above.

Peer features never automatically upload your private journal, Apple Health readings, support contacts or sobriety dates. Your phone’s local profile and hosted services have separate storage. The peer-only deletion control removes the peer account; it does not erase the local profile or a My Person plan. For the broader deletion action, use Delete my account in Profile.

Delete your SmartSober account

In Profile, choose Delete my account and confirm. The app asks our server to delete your active My Person contact, rules, Health summaries, plan delivery records and account-linked SMS consent records; peer messages in your conversations, owner support visits, blocks and notification registrations; and companion usage and voice-access records. It closes conversations, revokes peer sessions and replaces the peer name with “Deleted member.” After the server confirms deletion, the app resets your local profile and journal, stops its Health reads and cancels its scheduled notifications. It does not delete records from Apple Health. You can review or revoke Health permissions in Apple’s Health app.

Limited records remain: a hashed credential and deleted-account reference prevent stale requests from recreating the account; revoked installation and peer status/session records enforce access controls; reported evidence follows the 30-day safety window above; and limited incident and administrative records remain. Hashed destination opt-outs and unlinked SMS help/stop records can remain to prevent unwanted messages. Stored Apple transaction records are separated from the active account and retained to prevent receipt reuse and reconcile membership history. These retained security and billing records currently have no automatic deletion deadline. Account deletion does not cancel an Apple subscription; manage or cancel it in your Apple subscription settings. Contact us if you cannot access the deletion control or need help with retained information. Deletion does not retract messages already delivered or erase another provider’s records.

Optional My Person check-ins

The updated My Person setup saves the recognizable name you choose to share, your person’s name and delivery address, your chosen rules, your time zone, permission and pause settings, and invitation and acceptance status on our server. Your person must accept an invitation before automatic alerts can begin. For texts, you share a private invitation link. Your person reviews the rules and texting disclosure, checks an agreement box, and sends a one-time confirmation from their own phone. We do not send an automated invitation text before they consent. Older preview acceptance switches do not count as consent. The app shows whether delivery is available; saving a plan alone does not make messages live.

With your permission, we record app-opening and journal check-in times, but not journal text. If you separately permit Health sharing, we store up to 30 daily sleep and resting-heart-rate summaries for the chosen rules. The app must sync these summaries; missing or delayed data can prevent a check-in. Alerts are generic and contain no readings, private journal entries or diagnosis. Rule changes require a new invitation. Either person can stop future messages; a message already submitted may still arrive. Delivery records distinguish submission from provider delivery confirmation, which does not prove someone read the message.

Configured delivery providers receive the destination and message needed to send an invitation or alert. SmartSober uses Google Workspace for configured email delivery and Twilio for configured SMS delivery. Automatic messages require an accepted, active plan and an available delivery channel. Google submission confirms acceptance for sending, not arrival in the recipient’s inbox. The Google sending connection does not read your mailbox. Active plans and delivery records remain until they are removed through the relevant controls or account deletion. For SMS, we also retain versioned consent evidence, the agreed plan, confirmation time and message identifier. Verification codes are stored only as hashes. We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. Reply STOP to stop texts or HELP for help. See our texting terms. Removing a plan clears its active contact, rule and Health records, but does not itself remove prior delivery records or SMS consent evidence. Full account deletion removes those account-linked records as described above. Limited hashed opt-outs and unlinked help/stop records remain to prevent unwanted repeated messages. We do not read your address book; the contact details and support relationship are the ones you choose to enter. Contact us for help removing information.

The AI companion

With separate consent, messages you send to the AI companion and an optional note you choose to share are transmitted through our server to OpenAI to generate a response. The companion service does not store a transcript in our database. It retains limited timing and tester-ID metadata to enforce usage limits. It has no ability to contact a support person or emergency service. It is AI, not a clinician or a person with lived experience.

Our API calls request no stored model response. OpenAI’s own API data-handling policies still apply, including applicable abuse-monitoring retention. That setting is not a promise of zero provider retention. See OpenAI’s API data controls.

AI voice and microphone access

Voice starts only after you choose it and allow microphone access. Your live audio goes to OpenAI for speech processing and spoken replies. The selected companion name and, only if you permit it, a limited saved note provide context. SmartSober’s server establishes the voice session, and the app uses a WebRTC connection for live audio. Your journal, Apple Health readings, contacts and separate text chats are not automatically added to the voice session.

SmartSober does not save a voice recording or companion transcript to your profile or database, and the voice service does not log audio, transcripts or session connection data. Limited account-linked session identifiers, timing, duration, allowance and shutdown metadata support access and usage limits. Closing voice or leaving the app stops the microphone. This does not contact My Person or an emergency service. OpenAI’s API data policies, including applicable safety retention, still apply; our request not to store a model response is not a guarantee of zero provider retention.

Operating-cost records contain model and service-tier names, token counts, duration, cost estimates and hashes used to avoid counting the same provider response twice. They contain no messages, audio or transcripts. Account deletion removes the link between a voice session and these records. Unlinked cost records and aggregate totals may remain for spending reconciliation; they cannot restore an account or its conversations.

Optional Apple account recovery

Where Apple account recovery is available, you can choose to link an Apple account to your existing SmartSober account. Apple verifies the sign-in. SmartSober stores a hash of the app-specific Apple identifier, its account association and an encrypted Apple refresh token needed for the recovery connection. We do not retain or expose an Apple name or email address for this link. New device access credentials are stored only as hashes on the server. Short-lived sign-in challenges include a hashed nonce and a daily network-address hash to limit repeated attempts.

This can restore access to the linked hosted account. It does not back up or restore the journal and recovery dates saved locally on an iPhone. Availability depends on the app and service configuration; a normal installation does not automatically create an Apple link. Account deletion removes the link and revokes its SmartSober access credentials. An encrypted token is retained in a separate queue until Apple revocation succeeds. If Apple is temporarily unavailable, the queue supports another attempt; the server account deletion is not undone while waiting. That queue has no automatic expiry deadline.

Apple membership records

Where an Apple subscription is offered, Apple handles the purchase and payment information. SmartSober receives a signed transaction to verify membership and stores transaction and original-transaction identifiers, the subscription environment, expiration and revocation times, signed time and a hash of the signed payload. A random app-account token associates the purchase with your installation account. We do not store the full signed transaction or receive your payment card details. Apple subscription notifications update membership state and include notification identifiers used to avoid duplicate processing.

Deleting your account removes its active membership association and replaces the account reference on retained transaction records with a random deleted-record reference. This prevents the same transaction from being reused for a different account and supports billing reconciliation. It does not cancel your Apple subscription. Review the offer shown by Apple and manage subscriptions in your Apple settings. No trial or charge begins merely by visiting this website or joining the waiting list.

Optional local activities

You can add a US ZIP code to find things to do nearby, or skip this feature. The ZIP is saved in your private profile on your phone and can be changed or removed in Explore. It is not included in your public sobriety profile, peer chats, AI companion messages or My Person plan.

When you request activities, SmartSober receives that ZIP and your phone’s time zone. Zippopotam.us receives the ZIP to look up its city. SerpApi receives a general city and state event search, without your name, recovery information or app credential. We also read public organizer calendars and event listings. Event photos may load directly from approved public image providers, which receive the network information needed to deliver an image, such as your IP address. SmartSober does not include your app credential or recovery information in image requests. Those providers have their own data policies. Our database caches ZIP-to-city lookups and public event results separately from member records. We keep a hashed installation reference with temporary request counts to limit misuse, not a member location history. Request counters are removed after expiration on later activity. Clearing your ZIP stops future lookups from the app; shared public lookup and event caches can remain.

Listings are refreshed when requested after their cache expires, with a maximum display age of 24 hours. Known ended events are removed. We filter alcohol-focused activities, but cannot guarantee an alcohol-free venue or that a listing has not changed. Check the linked organizer page before attending.

SmartSober in AI apps

The public SmartSober tools can find activity listings, link to official recovery resources, and explain app features. They do not connect to your iPhone profile, journal, Health records, peer conversations, or My Person plan. Signing into an AI service or connecting these tools does not link those private records.

For activity searches, the tool receives the ZIP code you choose and a time zone. The same public event providers described above may receive a ZIP or general city search. Keyword and category filters are processed by the tool, and are not sent to event providers. We do not store tool prompts or attach public event requests to member records. Shared public event caches remain separate from members; temporary global request counters expire and are cleaned up during later event requests. Our hosting providers process network information required to serve requests under their own policies. Your AI service separately handles the conversation under its policies. You can choose not to use location search, disconnect the tool in that service, or contact us about privacy. Do not send private recovery entries, contact details, Health records, or credentials to these public tools.

Hosting and access

SmartSober uses Cloudflare storage and hosting through OpenAI Sites. SmartSober’s operator and the providers needed to operate the service can process the relevant information. When the app first connects, it creates a random private credential and saves it in the iPhone Keychain. The server stores its hash, an installation identifier, creation and expiration times, and access status. Installation credentials expire and can be revoked. Retrying setup with the same credential does not renew it. Minimal access and deletion records remain after expiration or revocation to enforce access controls and prevent the same credential from reopening a deleted or suspended account. Automatic installation setup does not verify your identity or link an Apple account; the optional recovery link requires a separate choice. Member sessions expire and can be revoked. Temporary usage limits help control cost and abuse. Services may be interrupted or unavailable. They do not replace professional care, a recovery program or emergency help. For immediate danger, contact local emergency services or a trusted person nearby.

Any available subscription and eligible introductory offer are shown in the app and Apple purchase screen before confirmation. This privacy page does not enroll you in a paid plan or authorize a charge. See the SmartSober terms.

Contact

For privacy, access or account questions, email joe@smartsober.app. Do not post recovery details or contact information in public comments.