Privacy Policy

Last updated: 2026-08-18

A recovery record is among the most sensitive things a person can keep on a phone — the kind of information that, in the wrong hands, costs people jobs, custody, and relationships. So this policy is written to be checked rather than trusted, and it deliberately avoids claiming protections Alder does not have.

Who we are

Alder is an iOS app published by HyperSage AI Labs LLC. There is no account and no login — no name, no email, no password. Your install is identified by a random identifier stored on your device, and nothing else. Contact: support@hypersage.ai.

What we will never claim

Plenty of apps in this category imply a legal confidentiality they don't have. Specifically:

• Alder is not HIPAA-covered, and we make no HIPAA claim. HIPAA governs healthcare providers, health plans, and their business associates — a consumer app is none of those.
• Alder is not covered by 42 CFR Part 2, the federal rule that protects records held by substance-use treatment programs. Alder is not such a program.
• We won't tell you your recovery record never leaves the phone. Part of it goes out with every message you send Alder, and the next two sections say exactly which part and where it goes.
• What we can say is what's actually true: no account, no recovery-record database on our side, one named AI provider, 30-day retention on the conversation, and deletable by you at any time.

Where your record is kept

Your recovery record lives on your phone: your targets, clocks, check-ins, urge logs, debriefs, and settings are stored in the app, on the device. We keep no recovery-record database. There is no table on our server holding your check-ins, urges, lapses, or sobriety dates, so there is nothing of that kind sitting there to be breached, subpoenaed, or aged out. There is no account and no login either, so none of it is tied to a name, an email, or a password — only to a random identifier held on your device.

But "kept on your device" is not the same as "never sent." Some apps blur those two, and that blur is how people end up surprised. So here is the part that actually leaves.

What leaves your device — and why

Alder's replies are written by an AI model that runs on someone else's computers, and for the reply to fit you rather than a generic person, it has to be told about you. You are shown this list and asked to agree before a single message is sent, and you can withdraw at any time.

• Your message — and, with every message, a slice of your recovery record. Not once at setup: every turn. Specifically, it carries your first name and the tone you chose; what you are stepping away from, each quit date and day count; your goal; your reasons, in the words you wrote them in; your people's first names and how you know them; your last seven check-ins — the date, your 0–5 craving rating, whether the day involved using, and any hungry / angry / lonely / tired flags; whatever you have told Alder about heavy use or a prescriber-managed taper; and the notes Alder keeps about you.
• A little context about the session. How long the current session has run and how many days since your last one (Alder is required to re-introduce itself as an AI on a long session or after a gap), whether you opened this conversation from SOS or flagged an active urge, your language setting, and your random device identifier.
• It goes to our backend, and on to Anthropic (Claude), which writes the reply. Anthropic is the only AI provider Alder uses. This deployment holds no key for any other provider, so no other one can receive your messages — if that ever changes, this page and the in-app consent screen change first.
• Under Anthropic's current API terms, your words are not used to train their models. We don't control their policy, so please also read their privacy link below.
• What we then store, and for how long. The conversation itself — your messages and Alder's replies — is kept on our server for at most 30 days, then deleted, so a new conversation can pick up where the last one left off. The recovery-record slice above is used to write the reply and is not stored as a record of its own — it is not turned into a check-in table or a sobriety log on our side. Anything Alder quotes back to you is part of the reply, and follows the same 30-day rule.
• A safety log with no words in it. When a crisis, overdose, or withdrawal path fires, we record that it fired — a one-way hash of your device identifier, which kind of escalation it was, and when. Never your message, never a substance, never a quoted fragment. Kept at most 30 days. We also count requests per day against a hashed IP address so the free tier can't be abused.
• All of it is tied to a random device identifier and nothing else. We hold no name, email, or login that could identify you.
• You can stop it. "Withdraw consent" in You › Privacy stops anything further leaving your phone, and does not delete a thing you have written — Alder keeps working with its simpler on-device companion.

What we do not collect — now or later

• Your name, email, or login credentials. The app has no account.
• Your location, contacts, photos, or calendar.
• Any advertising identifier. There are no ad SDKs and no third-party marketing or analytics SDKs in Alder, and there never will be.
• Data about you from anywhere outside Alder.

We do not sell or share your data. Not to advertisers, not to data brokers, not to insurers, not to anyone.

Discretion on your device

Privacy here isn't only about servers — often the real risk is someone else picking up your phone. Two things are planned for that, and neither works yet. Please do not rely on either one today:

• A discreet alternate app icon. The artwork is drawn and bundled with the iOS build, but there is no setting to switch it on, so the home screen currently shows the Alder icon and the name "Alder".
• Neutral-language notifications. Alder sends no notifications at all today — the feature is unbuilt, so no notification copy exists yet. The intent is that nothing on a lock screen ever names recovery or a substance, and that every nudge is opt-in.

If your safety depends on nobody seeing this app, use your phone's own controls — a passcode or Face ID on the device, and hiding or removing the app — and check back here when these ship.

Third parties

This is the whole list. Naming one that does not receive anything would be as misleading as omitting one that does, so we keep it to the ones that actually do.

• Anthropic — the AI provider that writes Alder's replies, and the only one. anthropic.com/legal/privacy
• Fly.io — hosts Alder's backend and its database, so the 30 days of conversation described above sit on their infrastructure. fly.io/legal/privacy-policy
• Apple App Store — app distribution. apple.com/legal/privacy

There is no analytics provider, no crash-reporting provider, no advertising network, and no data broker on this list, because there are none in Alder.

Your choices & rights

• Export: you can export your full record from inside the app and keep it wherever you like. The export asks our server for its side too, so what you get is everything, not just the on-device half.
• Delete: "Delete everything" in the app erases your on-device record and tells our server to purge every row held for your device identifier — your conversations, anything remembered, and your safety-log rows. The app reports back what the server actually erased rather than just claiming success, and if the server could not be reached it says so and tells you to try again. Deleting the app itself removes all on-device data.
• EU/UK (GDPR) & California (CCPA/CPRA): you may request access to, or deletion of, data tied to your device identifier, and you can withdraw consent at any time. We do not sell or share your personal information, and we will not discriminate against you for exercising these rights. Our legal bases (GDPR) are your consent for AI processing and our legitimate interest in operating and securing the service.
• Consumer health data laws — including Washington's My Health My Data Act — treat information about substance use as a protected category with its own consent requirements. Alder is built to that standard: nothing is collected until you have affirmatively agreed, having first been shown which providers are involved.
• Email support@hypersage.ai with any request.

Children

Alder is intended for adults 18 and older, is age-gated at first launch, and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a minor has used the app, contact support@hypersage.ai.

Changes

If we change this policy we will update the date above and post the new version here. Material changes will be noted in the App Store update notes.

Contact

Questions about privacy: support@hypersage.ai