How we protect the people who use Recoverly

What an organisation can see by default: nothing

• Joining with a programme code puts the organisation's name and support contacts on the person's own device. The organisation is not told who joined and cannot see anything anyone logs.
• The person's records, goals and chats belong to their own account. Access rules allow only that person to read them.
• There is no advertising, no tracking for advertisers and no selling of data.

What a person may choose to add (each is off until they turn it on)

• An anonymous monthly headcount: once a month the device adds one to a total for the programme. No name, account or list is stored. The organisation sees a figure only when at least 20 people are counted, rounded to the nearest 5.
• Two anonymous progress figures about last month (days with no drink, and whether they drank less than the month before), added into group averages in the same way and shown only for groups of 20 or more.
• A summary link for their own doctor or someone they trust: scrambled (end-to-end encrypted) on their device, so we cannot read it. Only what they tick goes in. It ends after 1, 7 or 30 days or when they stop it.
• A team workspace, only for a clinic or community service: the person shares their own summary by name with that team. It is encrypted on their device to a key that exists only in the team's own browser, so we cannot read it. It lasts 30 days after the last send, nothing is sent in the background, and stopping, leaving the programme or deleting the account removes it.

What is never allowed, whatever anyone agrees

• An employer, college, insurer, TPA or government body never receives individual-level data. Consent given to your own employer or insurer is not freely given, so the software refuses it: a workspace cannot be switched on for a workplace or a college.
• No list of who joined, no count shown below 20 people, nothing live that could reveal one person.

Where the data lives

The app runs on Vercel and stores accounts and records with Google Firebase (Authentication and Firestore). Data is encrypted in transit and at rest by those providers. Browsers cannot read the server-only collections used for sharing and counting, and this was checked against the real security rules. We have not yet confirmed India-only data residency, so do not assume it.

Data protection (DPDP Act 2023): an outline for your lawyer

• Roles: Recoverly decides what is collected and why, so treat it as the data fiduciary for individuals' own data. For the anonymous counts an organisation receives, no personal data is shared with it.
• Purposes: recovery tracking and guidance for the individual; the optional counts and shares described above, each on the person's own choice.
• Retention and deletion: a person can delete their account and data in Settings, which also removes their summary links and team copies. Enquiries and survey answers are kept until the person asks for deletion.
• Children: Recoverly is not directed at children; a lawyer should confirm the age and parental-consent position before a college or school programme.
• Breach contact and grievance contact: the address below. A written breach-response plan is still to be agreed with counsel.

Known limits, stated plainly

• A clinic's staff can read, print or pass on what people choose to send them, and nothing can take that back.
• A person on two devices can be counted twice in the headcount, and people who do not tick are not counted. The report says so.
• An organisation that made many accounts could pad a small total past 20. The threshold protects people from casual identification, not from a determined insider.
• The translations of the privacy text have not been reviewed by native speakers; the English version governs.
• The AI companion is a support tool, not a counsellor, and its guides have not yet had a clinical review.

Reporting a security problem

Email abhinavkumra@omal.in with what you found and how to reproduce it. Please do not access other people's data or disrupt the service while testing. We will reply and fix real problems. Our machine-readable contact is at /.well-known/security.txt. Full privacy text: privacy policy.