Privacy Policy

Last updated: 24 July 2026

This Privacy Policy explains how Recovery Gaurdian AI ("Recovery Gaurdian", "we", "us" or "our") collects, uses, stores and protects your personal information when you use our mobile app, website (www.recoverygaurdian.com) and related services (together, the "Service").

Recovery Gaurdian is a support tool for people in recovery from addiction and for the family members, peer supporters and professionals who help them. We take privacy extremely seriously because the information you trust us with is sensitive.

We comply with the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR) and the Data Protection Act 2018.

1. Who we are (Data Controller)

Recovery Gaurdian AI is the data controller for personal data processed through the Service. You can contact us at any time about this policy or to exercise your data protection rights:

2. The information we collect

2.1 Account information

When you create an account we collect:

  • Your name and email address
  • A password (stored as a one-way hash — we never see the plain text)
  • If you sign in with Google or Apple: the basic profile information those providers share with us (name, email, and a unique identifier). We do not receive your Google or Apple password.
  • Your chosen role: Recovery User, Supporter, Family, Professional or Admin
  • Optional profile photo

2.2 Recovery information you enter

Depending on the features you use, you may choose to provide:

  • Recovery focus, sobriety start date and personal recovery goals
  • Daily check-ins (mood, cravings, sleep, wellbeing notes)
  • Private journal entries
  • Meetings you have attended or plan to attend
  • Personal trigger locations you want to be warned about
  • Emergency contacts and members of your Recovery Team

2.3 Location data

Location tracking is off by default and only turns on after you explicitly accept the in-app Recovery Agreement.

  • Foreground location is collected only while you have the app open and only if you have accepted the Recovery Agreement.
  • Background location (location while the app is closed or your phone is locked) requires a second, separate opt-in. It can be turned off at any time from within the app.
  • We collect approximate GPS coordinates, accuracy, timestamp, and basic device status (battery level, charging state, network connectivity) so that your Recovery Team can tell whether the device is reachable.

2.4 Gaurdian AI data

Gaurdian AI features (Coach, Insights, Nudges, Journal analysis) are opt-in. When enabled, we process the recovery signals you have chosen to share (risk score, mood, journal entries you explicitly submit for analysis, meetings, goals) to generate personalised replies and insights. AI conversation history is stored so the coach can maintain context across sessions. You can pause the coach or disable journal analysis at any time under Privacy & consent.

2.5 Open Banking data (TrueLayer — optional)

If you choose to connect a bank account via TrueLayer, we receive read-only transaction data so that Gaurdian AI can flag recovery-relevant spending patterns (for example gambling merchants or large cash withdrawals). We do not receive your banking password or the ability to move money. You can disconnect your bank at any time, which revokes our access and deletes the stored tokens.

2.6 Supporter and alert data

If you are a Supporter, Family member or Professional, we process the recovery information that the linked Recovery User has chosen to share with you, plus alerts generated by Gaurdian AI (for example financial risk alerts or elevated risk scores).

2.7 Technical and diagnostic data

  • Device model, operating system, app version
  • IP address (used for security and abuse prevention)
  • Crash reports and error logs
  • Anonymous product analytics via Google Analytics 4 (GA4) to help us understand which screens are used

2.8 Push notification tokens

If you enable push notifications, we store the device token issued by Apple Push Notification service (APNs) or Firebase Cloud Messaging (FCM) so that we can deliver alerts. You can disable notifications at any time in your device settings.

3. Why we use your information (lawful bases)

Under UK/EU GDPR we rely on the following lawful bases:

  • Contract — to provide the Service you have signed up for (accounts, meeting finder, alerts to your Recovery Team).
  • Consent — for optional, sensitive features such as location tracking, background location, Gaurdian AI, journal analysis, Open Banking and push notifications. You can withdraw consent at any time.
  • Legitimate interests — to keep the Service secure, prevent abuse, debug problems and improve the product.
  • Legal obligation — where we must retain or disclose information to comply with UK law.
  • Vital interests — in a genuine emergency (for example an SOS event) to help protect someone's life.

4. Sensitive (special category) data

Recovery-related information (including information about addiction, mental health and mood) is treated as special category data. We process this data only with your explicit consent, given when you sign up and again when you enable each sensitive feature. You can withdraw that consent at any time by turning the feature off or by deleting your account.

5. Who we share information with

We only share your data in these situations:

  • Your Recovery Team. Supporters, family members and professionals you have invited see the information you have chosen to share with them, at the permission level you set. You can revoke any team member's access at any time.
  • Service providers who process data on our behalf under strict written contracts:
    • Supabase (secure cloud database, authentication and storage — EU region)
    • Cloudflare (application hosting and content delivery)
    • Google (Sign in with Google, Google Analytics 4, Gemini AI models via Lovable AI Gateway)
    • Apple (Sign in with Apple, Apple Push Notification service)
    • TrueLayer (Open Banking, only if you connect a bank)
    • Resend (transactional email delivery)
    • OpenStreetMap / Nominatim (address geocoding for trigger locations and meetings)
  • Legal or safety reasons. If we are legally required to disclose information, or if we reasonably believe disclosure is necessary to protect someone from serious harm.

We do not sell your personal data, and we do not use it for advertising.

6. International transfers

Your data is primarily stored in the European Union. Some of our sub-processors (for example Google, Apple and Cloudflare) may transfer data outside the UK/EU. Where they do, transfers are protected by Standard Contractual Clauses, UK International Data Transfer Agreements, or equivalent safeguards recognised by the UK Information Commissioner's Office (ICO).

7. How long we keep your information (retention)

  • Account and profile data — for as long as your account is active.
  • Location updates — 90 days, after which they are automatically deleted.
  • Daily check-ins, journal entries and mood data — until you delete them or close your account.
  • Gaurdian AI conversation history — until you clear it or close your account.
  • Open Banking transactions — 24 months, or until you disconnect the bank (whichever is sooner).
  • Financial and recovery risk alerts sent to your Recovery Team — 12 months.
  • Technical logs and crash reports — up to 12 months.
  • Support emails — up to 24 months from the last message.

When you delete your account (see section 10), all personal data is permanently erased from live systems within 7 days, and from encrypted backups within 30 days.

8. How we protect your information

  • All traffic between the app and our servers is encrypted with TLS 1.2+.
  • Data is encrypted at rest in our EU database.
  • Banking access tokens are encrypted at the application layer with a separate key.
  • Row-level security policies restrict every database read and write to the user (or authorised supporter) who owns the record.
  • Passwords are hashed with industry-standard algorithms; we never store them in plain text.
  • Administrative access is limited, logged and requires strong authentication.

No online service can be 100% secure. If you believe your account has been compromised, contact us immediately at hello@recoverygaurdian.com.

9. Your rights

Under UK/EU GDPR you have the right to:

  • Access the personal data we hold about you
  • Rectify inaccurate or incomplete data
  • Erase your data ("right to be forgotten")
  • Restrict or object to certain processing
  • Data portability — receive an export of your data
  • Withdraw consent at any time for consent-based features
  • Not be subject to purely automated decisions that produce legal or similarly significant effects (Gaurdian AI outputs are decision support only, not automated decisions)

To exercise any of these rights, email hello@recoverygaurdian.com. We will respond within 30 days.

You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk or your local EU data protection authority.

10. Account deletion

You can permanently delete your account and all associated data from within the app (Profile → Account → Delete account) or by emailing hello@recoverygaurdian.com. See our Account Deletion Policy for full details of what is removed and when.

11. Children

Recovery Gaurdian is not intended for children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

12. Cookies and analytics

Our website uses a minimal set of strictly necessary cookies to keep you signed in and to remember your preferences. We use Google Analytics 4 to understand aggregate usage of the app and website; you can opt out via your device or browser settings.

13. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be announced in the app or by email at least 14 days before they take effect. Continued use of the Service after the effective date means you accept the revised policy.

14. Contact us

Recovery Gaurdian AI
Email: hello@recoverygaurdian.com
Website: https://www.recoverygaurdian.com