Privacy policy

Who this policy covers

This policy applies to the Alumni Co-Pilot mobile app, center staff portal, and invitation pages operated under the Alumni Co-Pilot name. A participating center also controls how its authorized staff use information in its community and may provide additional privacy notices, consent forms, or record-retention requirements.

This policy is not a treatment center’s HIPAA Notice of Privacy Practices and the app is not an emergency service, medical device, or clinical record system.

Information we handle

• Account data, including email address, authentication provider, and verification status.
• Center membership, staff role, cohort, account status, and invitation history.
• Profile details you choose to add, such as name, bio, recovery date, graduation date, and directory visibility.
• Community content, including posts, chats, stories, event responses, encouragements, and support requests.
• Continuity information, including check-ins, aftercare progress, private reflections, gratitude entries, and meditation history.
• Meeting discovery inputs, including a city or ZIP you enter or foreground coordinates used after you choose Near Me, plus personal meeting plans and reminder notes you save.
• Referral information you submit about another person. Only submit information you are authorized to share.
• Device and security data needed to operate the service, such as push tokens, platform type, timestamps, and staff audit records.

Who can see information

Authorized center staff can access the member profile, center community activity, check-in and aftercare signals, support requests, referrals, and moderation information needed to operate their program.

Other alumni can see content you intentionally post or send. Your directory profile is hidden until you choose to make it visible. You can hide it again at any time.

If you publish a story anonymously, authorized center staff can still review the source submission, but the copy delivered to other alumni does not include your name or email. Your blocked-members list is private to your account.

Private reflections, gratitude entries, meditation history, personal Quick Attend plans, and private meeting reminders are restricted to your account and are not available to ordinary center staff through the product. Center event RSVPs and anything you explicitly choose to share are separate.

How information is used

We use information to authenticate accounts, connect members to the correct center, provide community and aftercare features, send requested notifications, support safety and moderation, prevent abuse, and maintain the service.

If you choose Near Me, the app requests foreground location at that moment and uses the resulting coordinates to return nearby public meeting listings. The app reduces the coordinates to a neighborhood-scale grid before sending the search. We do not save them to your profile or a location-history database, request background location, or continuously track you. You can search by city or ZIP without granting location access.

We do not sell member data, use it for targeted advertising, or use private recovery content to train artificial intelligence models.

Service providers and disclosures

The service uses Google Cloud and Firebase for authentication, database, server functions, messaging, and hosting. Apple and Google process sign-in requests when you choose their sign-in methods. These providers process information to deliver their services under their applicable contracts and privacy terms.

City and ZIP meeting searches use Zippopotam.us to resolve the area. Authenticated meeting searches go through Firebase and may send search coordinates to public meeting-directory servers, including BMLT-enabled services, only to return nearby listings. These independent services and network providers may process request data under their own terms and retention practices.

We may disclose information when directed by the participating center, with your authorization, to protect a person from a serious safety threat, or when legally required. We do not treat a center relationship as permission to use data for unrelated marketing.

HIPAA and substance-use records

A person’s relationship with a substance-use treatment program can remain protected after treatment ends. Depending on the center and the information involved, HIPAA, 42 CFR Part 2, state privacy laws, and contractual obligations may apply. We therefore treat center-linked information as sensitive rather than assuming alumni data is exempt.

A center must complete the appropriate legal and security review, agreements, access controls, and consent workflow before using the service with protected health or Part 2 records. The product should not be described as “HIPAA compliant” based on software features alone.

Retention and deletion

Account data is kept while the account is active and as needed to provide the center’s program. In-app account deletion removes the Firebase account, member profile, authored community content, messages, support activity, check-ins, aftercare progress, and private writing, personal meeting plans, and private meeting reminders from active systems.

A referral lead may remain as the center’s record about the referred person, but the deleting member’s email is removed. Limited security, audit, backup, or legally required records may remain for their configured retention period. A center must disclose any additional record-retention duty it applies.

Members can also request deletion without the app on the account deletion page.

Security and member choices

Data is transmitted over encrypted connections. Cloud providers encrypt stored customer content, and supported local app data uses encrypted device storage. Access is limited by center membership, role, and server-enforced rules. No system can guarantee absolute security.

Members can change directory visibility, edit profile information, choose whether to post or share, decline notifications, contact their center about staff-held information, and delete their account.

Age and contact

The service is intended for adults age 18 and older. Participating centers should not invite minors without a separately reviewed legal, consent, and safety process.

Privacy questions can be sent to support@recoverycopilot.app. Questions about how a particular center uses records should also be directed to that center.