Privacy Policy

Last updated: June 26, 2026

All Ways Connect ("we," "us," or "our") operates the All Ways Connect mobile application and website (the "Service"). This page informs you of our policies regarding the collection, use, and disclosure of personal information when you use our Service.

Consent

By creating an account and using the Service, you consent to the collection and use of your information as described in this Privacy Policy. You may withdraw your consent at any time by deleting your account or contacting us at the email below.

Information We Collect

We collect the following types of information:

• Account Information: Name, email address, phone number, date of birth, and recovery date when you create an account.
• Health and Recovery Data: Check-in history, journal entries, gratitude lists, meditation sessions, medication information, and milestone tracking data that you voluntarily enter. This may include sensitive health-related information related to your recovery journey.
• Device Information: Device type, operating system, unique device identifiers, and push notification tokens for delivering notifications.
• Location Data: Approximate location is collected only when you voluntarily check in to a meeting or recovery center, and only with your explicit permission. We use geofencing to verify check-in proximity. Location data is not collected in the background.
• Usage Data: Information about how you interact with the Service, including pages visited, features used, and timestamps.
• Photos and Files: Only when you voluntarily upload documents, images, or files within the app (e.g., medication photos, profile pictures).
• Google Calendar Data: When you connect Google Calendar, we request the calendar.events scope solely to create and manage interview scheduling events on your behalf. We do not read, store, or access your existing calendar events.

How We Use Your Information

• To provide and maintain the Service
• To create and manage your account
• To track your recovery progress and milestones
• To connect you with your recovery house, coach, and support resources
• To send push notifications (meeting reminders, announcements) with your consent
• To generate reports for house managers regarding program participation
• To provide AI-powered recovery support and content recommendations
• To improve and personalize the Service

Legal Basis for Processing

We process your personal information based on:

• Consent: You provide consent when creating your account and using the Service.
• Contractual Necessity: Processing necessary to provide the Service you requested.
• Legitimate Interests: To improve and secure our Service.

Data Storage and Security

Your data is stored securely using Google Firebase cloud infrastructure, which maintains industry-standard security certifications (SOC 2, ISO 27001). We use encryption in transit (HTTPS/TLS) and at rest. Access to personal data is restricted to authorized personnel only.

While we implement commercially reasonable security measures, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security of your data.

Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. Specifically:

• Account Data: Retained until you request account deletion.
• Check-in and Recovery Data: Retained for the duration of your participation in the program and for up to 12 months after your account becomes inactive.
• Reports and Case Records: Retained in accordance with applicable healthcare and social services record-keeping requirements.
• Location Data: Stored only as part of individual check-in records; not tracked or retained separately.

After account deletion, we will remove or anonymize your personal data within 30 days, except where retention is required by law.

Data Sharing

We do not sell, rent, or trade your personal information. We may share information with:

• Your Recovery House: House managers and staff can see check-in data, reports, and program participation relevant to your stay.
• Recovery Coaches: Assigned coaches may access session notes and progress information.
• Service Providers: We use the following third-party services to operate the Service:
  • Google Firebase: authentication, database, hosting, cloud functions, and storage
  • OpenAI: AI-powered recovery support features
  • Google Cloud: calendar, search, and email APIs
  These providers process data according to their own privacy policies and applicable data processing agreements.
• Legal Requirements: We may disclose information if required by law, court order, or governmental regulation, or to protect the rights, safety, or property of our users or the public.

SMS Text Messaging

When you opt in to receive text messages from All Ways Connect, we use your mobile phone number to send service-related messages such as appointment and meeting reminders, account and status notifications, schedule updates, and two-way support messages with your organization's staff.

No mobile information, including your phone number and your SMS opt-in or consent, will be shared with or sold to third parties, affiliates, or lead generators for marketing or promotional purposes at any time. We share your number only with our messaging provider strictly to deliver the messages you requested.

Text messaging originator opt-in data and consent are excluded from every data-sharing category described in the "Data Sharing" section above; this information will not be shared with any third parties. SMS opt-in and consent are never shared with or sold to anyone under any circumstances.

All phone numbers used for text messaging are collected directly from individuals through our own forms. We do not purchase, rent, or use third-party phone number lists, and consent to receive messages is never a condition of any purchase or service.

Message frequency varies. Message and data rates may apply. Reply HELP for help, or STOP to unsubscribe at any time. For our SMS Terms, see our Terms of Service.

Google Calendar Integration

All Ways Connect's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• We only request the calendar.events scope to create interview scheduling events.
• We do not use Google Calendar data for advertising, market research, or any purpose unrelated to the app's core interview scheduling functionality.
• We do not allow humans to read your Google data unless you provide affirmative consent, it is necessary for security purposes, or it is required by law.
• All OAuth tokens are encrypted at rest using AES-256-GCM encryption.
• You can disconnect Google Calendar at any time from within the app, which revokes our access and permanently deletes your stored credentials.

Your Rights

You have the right to:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your account and associated data (see Account Deletion below).
• Data Portability: Request your data in a structured, machine-readable format.
• Withdraw Consent: Opt out of push notifications through your device settings, or withdraw consent for data processing by contacting us.
• Restrict Processing: Request that we limit how we use your data in certain circumstances.

To exercise any of these rights, contact us through our contact form. We will respond within 30 days.

Account Deletion

You may request deletion of your account and all associated personal data at any time by:

• Contacting us through our contact form with the subject line "Account Deletion Request"
• Using the account deletion option within the app (Profile > Delete Account)

Upon receiving a deletion request, we will:

• Delete your account and personal data within 30 days
• Remove your data from our active databases and third-party services
• Notify you via email when deletion is complete

Some data may be retained if required by law or for legitimate business purposes (e.g., fraud prevention, legal compliance). Any retained data will be anonymized where possible.

Children's Privacy

Our Service is not intended for anyone under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information promptly. If you believe a child under 18 has provided us with personal information, please contact us immediately.

International Data Transfers

Your information may be transferred to and processed in the United States, where our servers and third-party service providers are located. By using the Service, you consent to the transfer of your information to the United States, which may have different data protection laws than your country of residence.

California Privacy Rights (CCPA)

If you are a California resident, you have the right to:

• Know what personal information we collect and how it is used
• Request deletion of your personal information
• Opt out of the sale of personal information (we do not sell your data)
• Non-discrimination for exercising your privacy rights

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page, updating the "Last updated" date, and sending a notification through the app where appropriate. Your continued use of the Service after changes constitutes acceptance of the updated policy.

Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Contact: our contact form
• Website: https://allwaysconnect.org