Privacy Policy

1. Information We Collect

We may collect the following categories of information.

Account Information

This may include:

• email address
• authentication information
• account identifiers
• account status
• study start date and progress

Password authentication is handled through our authentication provider. We do not intentionally store your plaintext password.

Study Content You Choose to Provide

This may include:

• written reflections
• journal entries
• prayers
• responses to study prompts
• daily “God is showing me,” “I need to surrender,” and “I will obey by” entries
• Aletheos Guide conversations
• Selah responses
• final reflection responses
• other text you voluntarily enter into the Service

Because the study invites meaningful reflection, this information may include sensitive information such as religious beliefs, recovery experiences, substance-use information, health-related information, emotional experiences, or family and relationship information.

You decide what you choose to write.

AI-Generated Content

We may store AI-generated responses created for you, including:

• Aletheos Guide responses
• weekly Selah synthesis content
• final 30-day synthesis content

We store these responses so you can return to your study history and continue your journey.

Technical and Usage Information

We may automatically receive limited technical information necessary to operate and secure the Service, such as:

• browser or device information
• IP address
• authentication and security logs
• timestamps
• application errors
• basic usage events necessary for service operation

We do not currently use your private study content for behavioral advertising.

2. How We Use Your Information

We use information to:

• provide and operate Aletheos 30 Days
• authenticate your account
• save your study progress
• preserve your reflections and journal
• provide personalized Aletheos Guide responses
• generate personalized Selah reflections
• generate your final 30-day synthesis
• maintain continuity across your study
• secure the Service
• detect misuse, fraud, or technical problems
• provide support
• comply with legal obligations

We do not claim ownership of your personal reflections.

You retain your rights in the content you write. You give us permission to process that content only as reasonably necessary to provide, secure, maintain, and improve the Service and to comply with law.

3. How Artificial Intelligence Is Used

Certain Aletheos features use OpenAI’s API.

Depending on the feature you use, relevant portions of your study content may be sent to OpenAI so that an AI response can be generated. Examples may include:

• your current reflection
• prior messages in an Aletheos Guide conversation
• relevant journal or study responses
• weekly reflections used for Selah
• information used to create your final 30-day synthesis

We do not intentionally send your email address or raw database user ID to OpenAI as part of the content of an AI request.

Where an identifier is needed for safety-related processing, Aletheos uses a pseudonymous identifier rather than intentionally providing your ordinary account identity.

However, anything you personally write may itself contain identifying information. For example, if you type your own name, another person’s name, an employer, a location, or another identifying detail into a reflection, that text may be included in an AI request when relevant to the feature you are using.

OpenAI does not train on our API content by default

OpenAI states that inputs and outputs submitted through its API Platform are not used to train its models by default unless the API customer affirmatively opts in to data sharing. Aletheos does not intentionally opt your private study content into model training.

OpenAI response storage

Aletheos configures its AI requests so that OpenAI’s optional Responses API application-state storage is disabled. This is sometimes referred to technically as store: false.

This does not mean that OpenAI can never temporarily retain API data.

Under OpenAI’s standard API data controls, OpenAI may retain API inputs and outputs for up to 30 days for service delivery, abuse monitoring, security, or legal purposes unless a qualifying Zero Data Retention configuration applies.

We believe users should know this distinction rather than being told that AI data is “never retained.”

4. How We Protect Your Information

We use multiple layers of technical and organizational safeguards.

Account-Specific Data Access

Participant-owned data is associated with authenticated accounts. We use database Row Level Security and related authorization controls designed to prevent one participant from accessing another participant’s private records.

Server-Side Identity Verification

Sensitive server operations derive participant identity from the authenticated session rather than relying solely on a user ID supplied by the browser.

Restricted Administrative Credentials

Sensitive database credentials and OpenAI API credentials are maintained on the server and are not intentionally exposed to the browser.

Encryption and Secure Infrastructure

We use Supabase for authentication and database infrastructure. Supabase states that hosted project data is encrypted at rest by default and that its HTTP APIs use encrypted SSL connections. Supabase also maintains SOC 2 Type 2 compliance and ISO 27001 certification.

Limited AI Identification

We do not intentionally include your email address or raw database user ID in AI prompt content.

No Sale of Private Reflections

We do not sell your private journals, prayers, reflections, Guide conversations, or study responses.

No system can guarantee perfect security, and we cannot promise that unauthorized access will never occur. We nevertheless take the sensitivity of this information seriously and design the Service around limiting unnecessary exposure.

5. Service Providers

We use third-party service providers to operate the Service. These may include:

These providers may process information on our behalf as necessary to provide their services.

We may change infrastructure providers from time to time as the Service evolves.

6. Sensitive Information

Your study content may contain information that is considered sensitive under applicable law, including information relating to:

• health
• mental or emotional experiences
• substance use or recovery
• religious or spiritual beliefs
• relationships or family

We process information you choose to provide for the purpose of delivering the Service you requested, maintaining your study history, providing personalized study features, securing the Service, and complying with applicable law.

We do not sell this sensitive study content or use it for targeted advertising.

7. Relationship to AletheosMD Clinical Services

Aletheos 30 Days is owned and operated by the same organization that operates AletheosMD. Some users may also separately receive services from AletheosMD.

Using Aletheos 30 Days by itself does not create a physician-patient, therapist-patient, pastoral, or other professional treatment relationship.

If you separately receive clinical services from AletheosMD, that clinical relationship may be governed by additional consents, notices, privacy rules, or legal obligations that are separate from this Privacy Policy.

Nothing in this Privacy Policy replaces any notice that applies to a separate clinical relationship.

8. Data Retention

We retain information for as long as reasonably necessary to:

• maintain your account
• preserve your 30-day study history
• provide features you request
• meet legitimate security and operational needs
• resolve disputes
• comply with legal obligations

Some information may remain in backups or security logs for a limited period after deletion from active systems.

AI providers may also retain information according to their own applicable data-retention policies as described above.

9. Your Choices and Privacy Rights

Depending on where you live, you may have rights concerning your personal information, which may include the right to:

• request access to information we hold about you
• request correction of inaccurate information
• request deletion
• request a copy of certain information
• withdraw certain permissions where applicable
• appeal a privacy-request decision where applicable law provides that right

To submit a privacy request, contact:

privacy@aletheosmd.com

We may need to verify your identity before acting on a request.

Some information may be retained when required by law or when reasonably necessary for security, fraud prevention, dispute resolution, or other lawful purposes.

10. Legal Disclosures

We may disclose information when reasonably necessary to:

• comply with applicable law, legal process, or lawful governmental requests
• protect the rights, safety, or security of users, Aletheos, or others
• investigate fraud, abuse, or security incidents
• establish, exercise, or defend legal claims

We may also transfer information in connection with a merger, acquisition, restructuring, financing, or sale of some or all of the business, subject to applicable law.

11. Children

Aletheos 30 Days is intended for adults age 18 and older. We do not knowingly offer the Service directly to children under 13.

If we learn that we collected personal information from a child in violation of applicable law, we will take reasonable steps to delete it.

12. International Users

The Service is operated from the United States. If you access the Service from another country, your information may be processed in the United States or other countries where our service providers operate.

Those locations may have different privacy laws than your place of residence.

13. Changes to This Privacy Policy

We may update this Privacy Policy as the Service evolves or legal requirements change. We will update the Effective Date when we make changes.

If a change materially affects how we handle sensitive personal information, we will provide reasonable additional notice where required.

14. Contact Us

Questions or privacy requests may be sent to: