Privacy Policy

Last updated: 2026-09-23

A recovery record is among the most sensitive things a person can keep on a phone — the kind of information that, in the wrong hands, costs people jobs, custody, and relationships. So this policy is written to be checked rather than trusted, and it deliberately avoids claiming protections Alder does not have.

Who we are

Alder's iPhone app is made by HyperSage AI Labs LLC. There is no account and no login; we do not require an email address or password. Your install is identified by a random identifier stored on your device. Optional names and identifying details you enter can be sent with messages and included in stored conversations, as described below. Contact: support@hypersage.ai.

What we will never claim

Plenty of apps in this category imply a legal confidentiality they don't have. Specifically:

• Alder is not HIPAA-covered, and we make no HIPAA claim. HIPAA governs healthcare providers, health plans, and their business associates — a consumer app is none of those.
• Alder is not covered by 42 CFR Part 2, the federal rule that protects records held by substance-use treatment programs. Alder is not such a program.
• We won't tell you your recovery record never leaves the phone. Part of it goes out with every message you send Alder, and the next two sections say exactly which part and where it goes.
• What we can say is what's actually true: no account, no separate recovery-record database on our side, one named AI provider, and controls to export or delete the records we hold. Our conversation storage and Anthropic’s separate retention are described below.

Where your record is kept

Your recovery record lives on your phone: your targets, clocks, check-ins, urge logs, debriefs, and settings are stored in the app, on the device. We keep no recovery-record database. There is no table on our server holding your check-ins, urges, lapses, or sobriety dates, so there is nothing of that kind sitting there to be breached, subpoenaed, or aged out. There is no login account. Server records use a random device identifier, but messages and replies can contain names or other identifying details you chose to provide.

But "kept on your device" is not the same as "never sent." Some apps blur those two, and that blur is how people end up surprised. So here is the part that actually leaves.

What leaves your device — and why

Alder's replies are written by an AI model that runs on someone else's computers, and for the reply to fit you rather than a generic person, it has to be told about you. You are shown this list and asked to agree before a single message is sent, and you can withdraw at any time.

• Your message — and, with every message, a slice of your recovery record. Not once at setup: every turn. Specifically, it carries your first name and the tone you chose; what you are stepping away from, each quit date and day count; your goal; your reasons, in the words you wrote them in; your people's first names and how you know them; your last seven check-ins — the date, your 0–5 craving rating, whether the day involved using, and any hungry / angry / lonely / tired flags; whatever you have told Alder about heavy use or a prescriber-managed taper; and the notes Alder keeps about you.
• A little context about the session. How long the current session has run and how many days since your last one (Alder is required to re-introduce itself as an AI on a long session or after a gap), whether you opened this conversation from SOS or flagged an active urge, your language setting, and your random device identifier.
• It goes to our backend, and on to Anthropic (Claude), which writes the reply. Anthropic is the only AI provider Alder uses. This deployment holds no key for any other provider, so no other one can receive your messages — if that ever changes, this page and the in-app consent screen change first.
• Anthropic's commercial API terms restrict processing purposes and require confidentiality and security. API inputs and outputs are not used for model training by default, subject to explicit opt-in and feedback exceptions. Its standard retention is up to 30 days, with safety, legal, model/feature and separate-agreement exceptions. Read its commercial terms, retention policy and training policy.
• What we then store, and for how long. The conversation itself — your messages and Alder's replies — is scheduled for removal 30 days after that conversation’s last message, so an ongoing conversation can pick up where the last one left off. Continuing a conversation extends that conversation’s retention; this is not a 30-day limit measured from each individual message. Saved companion memories have a separate 365-day retention period and can be removed earlier when their associated conversation is removed. Expired rows are removed by a cleanup scheduled every six hours; downtime or a failed cleanup can delay removal. Our database has encrypted automatic snapshots with five-day retention, so a previously created backup can retain a deleted row until that snapshot expires. The recovery-record slice above is used to write the reply and is not stored as a record of its own — it is not turned into a check-in table or a sobriety log on our side. Anything Alder quotes back to you is part of the reply and follows conversation retention. Separate saved memories follow the memory period above.
• A safety log with no words in it. When a crisis, overdose, or withdrawal path fires, we record that it fired — a one-way hash of your device identifier, which kind of escalation it was, and when. Never your message, never a substance, never a quoted fragment. Safety-log rows have a 30-day retention period and the same scheduled-cleanup and backup qualifications described above. We also count requests per day against a hashed IP address so the free tier can't be abused.
• Server records are indexed by a random device identifier. This does not make conversation content anonymous: a name or other identifying detail you enter, or Alder includes in a reply, can remain in that conversation.
• You can stop it. "Withdraw consent" in You › Privacy stops new AI requests and cancels pending app requests. It does not recall data already received by our service or Anthropic, or prevent a non-AI export or deletion request you choose. It does not delete what you have written — Alder keeps working with its simpler on-device companion.

What we do not collect — now or later

• An account profile, email address or login credentials required for sign-in. The app has no login; optional names and identifying text you enter are handled as described above.
• Your location, contacts, photos, or calendar.
• Any advertising identifier. There are no ad SDKs and no third-party marketing or analytics SDKs in Alder, and there never will be.
• Data about you from anywhere outside Alder.

We do not sell your data or share it for advertising. With your permission, we share the context described above with Anthropic, and Fly.io hosts our service.

Discretion on your device

Privacy here isn't only about servers — often the real risk is someone else picking up your phone. Two things are planned for that, and neither works yet. Please do not rely on either one today:

• A discreet alternate app icon. Alder does not currently include or offer an alternate icon. The home screen shows the Alder icon and the name "Alder".
• Neutral-language notifications. Alder sends no notifications at all today — the feature is unbuilt, so no notification copy exists yet. The intent is that nothing on a lock screen ever names recovery or a substance, and that every nudge is opt-in.

If your safety depends on nobody seeing this app, use your phone's own controls — a passcode or Face ID on the device, and hiding or removing the app — and check back here when these ship.

Third parties

This is the whole list. Naming one that does not receive anything would be as misleading as omitting one that does, so we keep it to the ones that actually do.

• Anthropic — the AI provider that writes Alder's replies, and the only one. anthropic.com/legal/privacy
• Fly.io — hosts Alder's backend, database and the backups described above. fly.io/legal/privacy-policy
• Apple App Store — app distribution. apple.com/legal/privacy

There is no analytics provider, no crash-reporting provider, no advertising network, and no data broker on this list, because there are none in Alder.

Same or equal protection. Anthropic receives only the data it needs to answer your requests, under commercial API terms that limit its use of it to providing that service to us (and to abuse monitoring and legal compliance) and that require confidentiality and security. We confirm that it protects your data to the same or an equal standard as this policy describes and as Apple’s App Store Review Guidelines require. It may not sell your data or use it for advertising. Fly.io hosts our servers under terms that let it use hosted data only to provide and improve its hosting service; it has no right to sell that data or use it for advertising.

Your choices & rights

• Export: you can export your full record from inside the app and keep it wherever you like. The export asks our server for its side too, so what you get is everything, not just the on-device half.
• Delete: "Delete everything" in the app erases your on-device record and tells our server to purge every row held for your device identifier — your conversations, anything remembered, and your safety-log rows. The app reports back what the server actually erased rather than just claiming success, and if the server could not be reached it says so and tells you to try again. Deleting the app itself removes its on-device data. Deletion does not recall requests Anthropic already received; those follow its separate retention terms. Exported files, device backups and copies you shared remain separate.
• EU/UK (GDPR) & California (CCPA/CPRA): you may request access to, or deletion of, data tied to your device identifier, and you can withdraw consent at any time. We do not sell your personal information or share it for advertising, and we will not discriminate against you for exercising these rights. Our legal bases (GDPR) are your consent for AI processing and our legitimate interest in operating and securing the service.
• Consumer health data laws — including Washington's My Health My Data Act — treat information about substance use as a protected category with its own consent requirements. Alder is built to that standard: nothing is collected until you have affirmatively agreed, having first been shown which providers are involved.
• Email support@hypersage.ai with any request.

Children

Alder is intended for adults 18 and older, is age-gated at first launch, and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a minor has used the app, contact support@hypersage.ai.

Changes

If we change this policy we will update the date above and post the new version here. Wherever the iPhone app is listed on the App Store, material changes will also be noted in its update notes.

Contact

Questions about privacy: support@hypersage.ai