What is stored, who can read it, and how to take it back.

This is the same policy shown inside the workbook. It separates workbook fields, security records, aggregate usage counts, and external services because they do not have the same privacy boundary.

Where your data lives

Account records are stored on the Sobriety Helper server, and TLS protects network traffic. Selected workbook fields — including inventory answers, certain notes, and sponsor names, phone numbers, email addresses, and communication notes — use server-side Fernet encryption at rest. Account identity, many dates and scores, and the security records described below are ordinary database fields rather than field-encrypted values.

The running application can decrypt those fields, and so can an operator who has both database access and the deployment's encryption key. This is not end-to-end or zero-knowledge encryption, and we do not describe it as such.

What leaves the server

We do not sell account data or share it with advertisers. The app does not automatically send workbook fields to third parties.

One optional transfer is the Recovery companion. If you use it, the exact message you type is sent to OpenRouter and then only to OpenAI for GPT-4o mini; provider fallback is disabled. Keep inventory text and identifying details out of that message unless you accept that transfer. OpenRouter and OpenAI may retain submitted messages under their own policies. Review OpenRouter's terms before sending, along with OpenAI's privacy policy.

If you choose Google sign-in, your browser communicates with Google; the Google sign-in code is loaded only after you press that option. This app requests the openid email profile scopes. Google returns a stable Google account identifier, email address, first and last name, and profile image when available. Read Google's privacy policy.

Account verification and password-reset email sends the recipient address, transactional message, and one-time link through the deployment's configured SMTP mail provider. Delivery records held by that provider follow its own terms and retention settings.

What we count

Sobriety Helper keeps a small first-party operational ledger so the maintainer can see how many accounts exist, how many account holders signed in today, and which screens and controls are actually used. Those route and control metrics never include recovery text, sponsor details, emails, raw user ids, IP addresses, user agents, or query strings. Signed-out visitor hashes rotate daily, so they cannot follow a person across days. While you are signed in, the day's counts are linked to your account by a keyed hash: the operator can connect them to the account, which is how they are included in your export and removed when you delete the account. Metric rows are deleted after 90 days. Nothing is counted when your browser sends Global Privacy Control or Do Not Track.

Public pages do not load a third-party analytics script. Google Search Console can report aggregate search queries, impressions, and clicks under Google's own service terms; Sobriety Helper does not receive the searcher's identity from those reports.

Security and account-activity records

These records are separate from the aggregate metrics above. Login-attempt records can contain the submitted email address, IP address, user agent, login method, timestamp, result, and failure reason. Security-event records can contain a user id or email when available, event type and severity, IP address, user agent, timestamp, description, and structured metadata. Data-access records can also contain an accessor id and email, data type and record id, action, endpoint, HTTP method, owning user id, timestamp, success result, and error text.

The running application and authorized operators or administrators can use these records for authentication, abuse detection, access review, and incident investigation. They are stored as ordinary database fields and are not protected by the narrative-field Fernet layer. They are deleted after 90 days.

Records attributable to an account are included in that account's export and live-database deletion. Login attempts that do not match an account, anonymous security events, and infrastructure or mail-provider logs cannot be reached by that self-service action. Application logs can include account email addresses and account IDs, for example when a person signs in or a verification email is sent. Those logs stay on the server, are capped at five 10 MB files per container, and are overwritten as they rotate. Web-server, reverse-proxy, hosting, and mail-provider logs can contain request hosts, IP addresses, timestamps, and provider diagnostics, and follow the operator's or provider's retention settings.

Export and delete

From the Data & privacy screen, after a fresh sign-in, you can export the account records held in the live database as a plain JSON file, including attributable security and account-activity rows. The download is not password-protected; store it accordingly. From the same screen you can delete the account and its linked live-database rows in one transaction.

The server takes a database snapshot before each release so a failed release can be rolled back. Snapshots are deleted after 30 days. Each account deletion is also written, as a one-way hash, to a list kept outside the database, and is applied again if a snapshot is ever restored. Mail-provider and hosting logs follow those providers' retention.

Consent and your rights

Recovery records are health information. Creating an account asks for your consent to store them, separately from agreeing to the terms. The optional Recovery companion asks again before any message is sent to OpenRouter and OpenAI. Your agreements, with dates, are listed under Data & privacy. Withdraw consent to storing records by deleting the account; turn off the companion on its own screen.

You can see, correct, export, and delete your data yourself inside the workbook. For anything else — confirming what is held, the list of recipients, or a request you cannot complete in the app — email support@sobrietyhelper.com from the account's address. You get an answer within 45 days (one 45-day extension, with notice, when a request is complex). If a request is refused, reply with the subject "Appeal" and you get a written decision within 45 days; if the appeal is denied, you can contact your state attorney general.

Personal data is not sold, not used for targeted advertising, and not used to train large language models. The consumer health data privacy policy lists what health information is collected and who receives it.

Crisis links

The 988, Crisis Text Line, and SAMHSA links on this site are plain tel: and sms: links to those services. They work before sign-in and do not pass through this server.

Contact

Questions about this policy go to support@sobrietyhelper.com. Terms of use are at /terms.