Privacy Policy

Effective October 1, 2026 · Version 3.0

SoberHub is a free recovery companion run by a nonprofit. People trust us with some of the most personal facts of their lives, so this policy is written to be read, not skimmed. It describes what SoberHub actually does today, in plain language, including the parts we are still improving.

Contents

1. Who we are and what this policy covers
2. The short version
3. Information we collect
4. Recovery data is sensitive
5. How we use information, and our legal bases
6. Analytics, crash reports and diagnostics
7. Who we share information with
8. Sharing features and public pages
9. Cookies and similar technologies on our websites
10. Signing in with Apple, Google or Facebook
11. Push notifications
12. How long we keep information
13. Security
14. Your rights and choices
15. Children
16. International data transfers
17. Changes to this policy
18. How to contact us

1. Who we are and what this policy covers

SoberHub is a California Nonprofit Public Benefit Corporation (Entity No. 6561452) recognized by the IRS as a 501(c)(3) public charity. Our address is 603 Lake St, Huntington Beach, CA 92648, United States. In this policy, “SoberHub”, “we”, “us” and “our” mean that corporation. SoberHub is the data controller (the organization responsible for your information) for everything described here.

This policy covers all of our services (the “Services”):

• The SoberHub mobile app for iOS and Android, including beta versions.
• Our website, soberhub.life, in English, Spanish and French.
• Our share pages, share.soberhub.life, which display content that app users choose to share.

It does not cover the websites and services of other organizations that we link to, such as aa.org, the meeting directories we use, or the app stores. Their own privacy policies apply. Volunteers who work with us are covered by the separate privacy notice in our volunteer agreement.

SoberHub is an educational e-reader, audiobook and meeting-finder app for recovery literature. We are not a healthcare provider, a treatment program, a crisis service, or a covered entity or business associate under HIPAA. SoberHub does not diagnose, treat or refer anyone for substance use disorder treatment, and it is not a medical device. The meeting finder lists mutual-help meetings from public third-party directories. Nothing in the Services is medical advice. If we ever handle health information on behalf of a healthcare provider or health plan, we will tell you and protect that information as HIPAA requires. If you are in crisis, please see the “If you need help now” section of our Terms of Service.

2. The short version

• We do not sell your information, and we do not show ads in the app. The Services are free.
• The fact that you use a recovery app is sensitive. So are your sobriety date, your notes and highlights, and which meetings you look at. We treat all of it as sensitive information (section 4).
• What we store on our servers: your account and profile (including your sobriety date if you enter one), your notes, highlights and bookmarks so they sync between your devices, your push-notification token, and diagnostic logs when they are sent to us. Your notes and bookmarks are stored only so that we can provide the Services; apart from the providers that host our servers, nobody receives them unless you choose to share one publicly (section 8) or one of the legal or safety reasons in section 7.3 applies.
• What stays on your device: your meeting favorites and meeting activity history, your recent book searches, downloaded books and audio, and the data used by the home-screen widget and Siri shortcuts.
• Analytics are on by default in the app and on our websites. We use Google’s Firebase in the app, Google Analytics on our websites (soberhub.life and share.soberhub.life), and Google Ads conversion measurement on soberhub.life. Firebase receives your SoberHub user ID and an approximate sobriety range, not your sobriety date. There is no in-app switch to turn analytics off yet, and our websites do not yet show a cookie banner. Section 6 explains what is collected and section 14 how to limit it.
• The Facebook SDK is built into the app so that “Continue with Facebook” works. Today it reports basic app events (such as installs and opens) to Meta for every user, whether or not you sign in with Facebook (section 10). We are changing this.
• Anything you share is public. A shared note or bookmark is a public web page that anyone with the link can open (section 8).
• You can delete your account in the app. After 30 days your profile, notes and bookmarks are permanently deleted; some records, logs and backups persist longer (section 12).
• Questions or requests: legal@soberhub.life.

3. Information we collect

3.1 Information you give us

• Account. An email address and password (we do not store your password in readable form), or the identity information described in section 10 if you sign in with Apple, Google or Facebook. If you continue as a guest, the app generates a random identifier and stores it on your device; we have no email address for guest accounts.
• Profile. Anything you choose to add: nickname, first and last name, a short bio, a profile picture, a phone number, a birthday, a city, state and country, and your sobriety date. All profile fields are optional. Your nickname appears on pages you share.
• Library content. Notes, highlights (including the highlighted passage) and bookmarks you create in the books. They are stored on our servers so they sync between your devices and so that a note you choose to share can be displayed.
• Feedback and support. Feedback you send from the app is emailed to our support inbox, with a copy to you. Emails you send to any @soberhub.life address are kept in that mailbox.
• Volunteer and court-service enquiries. The volunteer pages on our website ask you to email us. If you contact us about court-ordered community service, we ask for your full legal name and case number so that we can confirm hours to the court. That information is handled under our volunteer privacy notice.

3.2 Information collected automatically in the app

• Device and app details sent with requests to our servers: app version, operating system and version, your language setting, your SoberHub user ID, a session identifier and your IP address.
• Device record. When you sign in, we record a device identifier, your time zone, platform and language, and a push-notification token if you allow notifications.
• Analytics, crash and performance data collected by Firebase, described in section 6.
• Facebook SDK app events, described in section 10.
• Diagnostic logs, when they are uploaded, described in section 6.5.

3.3 Information collected automatically on our websites

• On soberhub.life: page views, the pages you visit, audio you play, links and buttons you click (for example the app-store links), your approximate location derived from your IP address, browser and device details, and referring pages, collected through Google Analytics (section 6.2) with the cookies listed in section 9. As with any website, our servers and hosting providers also receive your IP address and browser details in ordinary request logs (section 6.4).
• On share.soberhub.life: the same kinds of information, collected through Google Analytics (section 6.3) with the cookies listed in section 9, and page views and loading performance collected by Vercel Analytics and Vercel Speed Insights, which do not use cookies and do not identify you to us. Vercel, which hosts the share pages, sees your IP address.

Our websites have no forms and no accounts. Every contact link is an email address.

3.4 Information from sign-in providers

If you sign in with Apple, Google or Facebook, we receive your name, email address (Apple may give us a private relay address instead), the provider’s identifier for you, and, from Google and Facebook, a profile-picture link and locale. Section 10 has the details.

3.5 Location and meeting search

• Your location is used only if you grant the app location permission, and only to center the meetings map and to sort meetings by distance. We do not store your location on our servers, except that map coordinates can appear in diagnostic logs if they are uploaded (section 6.5).
• Meeting listings come from public third-party meeting directories and reach the app through our server; the directories do not receive your identity or your location from us.
• Map tiles and address search come from Mapbox. When you type a place name, the text and, if known, your location are sent to Mapbox to find matching places. Mapbox may also collect anonymized usage telemetry through its map SDK, described in Mapbox’s privacy policy.
• Book search runs on your device, and your search text is not sent to us. If that ever changes, we will update this policy first.

3.6 Information that stays on your device

The following are stored only on your device and are not sent to our servers: your meeting favorites and meeting activity history, your recent book searches, downloaded books and audio, the acceptance of aa.org’s terms, and the data used by the home-screen widget, Siri shortcuts and Spotlight search. If you add a meeting to your calendar, it is written to your device calendar. Note that the app still reports meeting-related usage to our analytics provider (section 6.1); the favorites list and history themselves are not sent.

Deleting the app removes everything stored on the device except items you added to your calendar.

4. Recovery data is sensitive

We treat the following as sensitive personal information, whatever the law where you live calls it (special-category data under the GDPR, consumer health data under U.S. state laws, sensitive personal information in Canada and Brazil):

• the fact that you have an account with a recovery app at all;
• your sobriety date and the approximate sobriety range derived from it;
• notes and highlights, which are often about your own recovery;
• which meetings you look at, join, get directions to or favorite;
• milestone notifications such as “Day 30 of sobriety”, which may be visible on your lock screen.

We collect this information only because you enter it or because a feature you use needs it. Where the law requires explicit consent to process sensitive information (for example in the EEA, the UK, Switzerland, Quebec and Brazil, and under U.S. consumer-health-data laws), we rely today on the consent you give by entering the information after reading this policy. We are adding a separate consent screen that asks you before your sobriety date is saved. You can withdraw consent at any time by removing the information from your profile, turning off the feature, or deleting your account (section 14); withdrawal does not affect processing that already happened.

Consumer health data (Washington, Nevada, Connecticut and similar laws). Our separate Consumer Health Data Privacy Policy lists the categories of consumer health data we collect, their sources and purposes, who receives them, and how to exercise your rights. We do not sell consumer health data.

We do not share your sobriety date, notes, bookmarks, meeting activity or profile with advertisers, data brokers, employers, insurers, treatment programs or anyone else outside the processors listed in section 7, unless you share something yourself or one of the legal or safety reasons in section 7.3 applies. The one exception we have not yet closed is described in section 10: the Facebook SDK’s automatic events tell Meta that the app was opened on your device.

5. How we use information, and our legal bases

We do not use your information for automated decisions that have legal or similarly significant effects on you, and we do not use it to train artificial-intelligence models.

6. Analytics, crash reports and diagnostics

6.1 In the app: Firebase

The app uses Google Firebase for analytics, crash and performance reporting, remote configuration and push notifications. Analytics are on by default, and there is currently no in-app setting to turn them off. We do not collect the advertising identifier on either platform.

What Firebase receives:

• Your SoberHub user ID, so that we can count active users and match a crash to a problem you report.
• Your settings and pattern of use, such as how you signed in, app language, which books you have, theme and text size, and whether you have entered a sobriety date, together with an approximate sobriety range (none, under 30 days, under 1 year, under 5 years, 5 years or more), not the date itself.
• How you use the app: the screens and features you use; the books, chapters and audio you open; the meetings you view, favorite, share, join or get directions to (identified by a meeting ID, not by the meeting’s name or address); and the searches you run in the meetings tab, but not what you typed.
• Crash reports and performance data about the app and your device.

Google processes this data as our processor under its Firebase data-processing terms. Google’s own description is at firebase.google.com/support/privacy.

6.2 On soberhub.life: Google Analytics, Tag Manager and Ads

The website uses Google Analytics 4, loaded through Google Tag Manager. They record page views, audio playback, the links and buttons you click (for example the app-store links), the page address, your browser and device, and an approximate location derived from your IP address.

Google receives this information, including your IP address, as our processor (section 7.1).

We run Google Ads search advertising under Google’s Ad Grants program for nonprofits. When you arrive from one of our ads, a cookie (section 9) lets Google Ads tell us whether the visit led to an app-store click, so that we can see which searches bring people to the app. We do not use your data for remarketing or retargeting, and we do not build advertising audiences.

The website does not yet display a cookie banner. Section 14.4 explains how to block these tags.

6.3 On share.soberhub.life: Google Analytics and Vercel

The share pages use Google Analytics 4, which records the same kinds of information as on soberhub.life (section 6.2), and Vercel Analytics and Vercel Speed Insights, which count page views and measure loading performance without cookies and without identifying visitors to us. The share pages do not use Google Tag Manager or Google Ads measurement. Google Analytics does not receive the text of a shared note or the nickname of the person who shared it.

6.4 Server logs

Our servers keep request logs for security and troubleshooting. They record the time, the URL requested, your IP address, browser or app user agent, your user ID and session ID, and may contain the contents of requests your device sends us. They are kept for 90 days (section 12) and are accessible only to our engineers.

6.5 Diagnostic logs from your device

The app keeps a short debug log on your device. Diagnostic files (the log and information about the app’s state) are uploaded to our private storage in two situations:

• when you ask us to, from the sign-in screen, or
• when we ask the app to, to investigate a problem you have reported to support. In that case the upload happens automatically, without an on-screen prompt.

Diagnostic files are linked to your user ID and device identifier, and our engineers are alerted through Slack (section 7.1) so that one of them can look at them. The logs can include meeting search text, map coordinates and the titles of books and audio you opened; they do not include your password.

7. Who we share information with

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share information only in the ways below.

7.1 Service providers (processors)

These companies process information on our behalf, under contracts that limit what they can do with it:

7.2 Third parties that are not our processors

Some services receive information directly from your device and use it under their own privacy policies:

• aa.org: your device downloads literature directly from aa.org, so aa.org sees your IP address.
• Meeting directories: public third-party directories whose listings our server relays to the app (no personal information is sent to them, section 3.5).
• YouTube (Google): the app demo video on our website is embedded from YouTube; when you play it, YouTube may set cookies and collect data under its own policy.
• Apple and Google sign-in services and Meta, when you use them to sign in (section 10).

7.3 Legal reasons and protection of people

We will disclose information if we are legally required to (for example by a valid subpoena or court order), or if we believe in good faith that it is necessary to protect someone’s life or safety, to investigate abuse of the Services, or to protect our legal rights. Where the law allows, we will tell you before we do.

7.4 If SoberHub changes hands

SoberHub is a nonprofit and will stay one. If we ever merge with, or transfer the Services to, another nonprofit, your information may be transferred with them. We will give you at least 30 days’ notice and a chance to delete your account first, and the recipient must honor this policy or one at least as protective.

8. Sharing features and public pages

• Shared notes and bookmarks. When you tap “Share” on a note or bookmark, the app creates a link to a public page on share.soberhub.life that shows your nickname (or “Anonymous”), the book and chapter, a short quote from the passage, and, for notes, your note text. Anyone with the link can open the page, and search engines may index it. The link contains your SoberHub user ID. There is currently no way to un-share a single note or bookmark; deleting the note in the app does not disable the page. All of your shared pages stop working when you delete your account (section 12). We plan to add per-item revocation; until then, please share only what you are comfortable making public.
• Milestone and sobriety cards. When you share a sobriety milestone, the link and image contain only the milestone (for example “90 days”) and the card design. They do not contain your name, user ID or sobriety date.
• Shared literature passages. Passages you share from the books are short excerpts that link to the location in the book; they contain no personal information.
• Sharing with other apps. When you share through your device’s share sheet, the app you choose (Messages, WhatsApp, and so on) receives the link under its own policy.

9. Cookies and similar technologies on our websites

soberhub.life sets the following cookies. The app does not use cookies.

We also use your browser’s local storage to remember settings such as your light or dark theme. share.soberhub.life sets only the Google Analytics cookies listed above.

We do not currently respond to “Do Not Track” or Global Privacy Control browser signals. You can block or delete cookies in your browser settings, install Google’s opt-out browser add-on, or use a content blocker; the site works without cookies. Blocking sober_locale only means we cannot remember your language choice.

10. Signing in with Apple, Google or Facebook

You can use SoberHub without any third-party account by signing up with an email address or continuing as a guest. If you choose a sign-in provider:

• Sign in with Apple gives us your name and email address (or an Apple private-relay address that forwards to you) and an Apple identifier. Apple lets you stop sharing your email with us at any time in your Apple ID settings.
• Google Sign-In gives us your name, email address, profile-picture link, locale and a Google identifier.
• Facebook Login gives us your name, email address, profile-picture link and a Facebook identifier.

We use this information only to create and sign in to your account. We never post to your social accounts and never import your contacts or friends.

About the Facebook SDK. To offer Facebook Login, the app includes Meta’s Facebook SDK. Today the SDK automatically reports basic app events to Meta (for example that the app was installed or opened, together with device details) for every user, whether or not you sign in with Facebook. Meta uses this data under its own privacy policy and may associate it with your Facebook account if you have one on the device. The SDK does not receive your device’s advertising identifier (on iOS it could only do so if you allowed tracking, see below). We are changing the app so that the SDK is active only if you choose Facebook Login and sends no automatic events; we will update this policy when that change is released.

App Tracking Transparency (iOS). The app asks for permission to “track” only when you tap “Continue with Facebook”. If you decline, the app currently does not continue with Facebook Login, and you can sign in another way; the app does not track you across other companies’ apps and websites. We are moving Facebook Login to Meta’s “Limited Login” mode, which needs no tracking permission and which Meta states is not used to personalize or measure advertising.

11. Push notifications

If you allow notifications and have entered a sobriety date, we send you milestone notifications (for example “Day 90 of sobriety!” at 30 days, 90 days, one year and so on) through Apple’s and Google’s push services. These messages may appear on your lock screen, where other people can read them. You can turn notifications off in your device settings at any time, or remove your sobriety date from your profile. The records we use to schedule these notifications are kept for up to 90 days (section 12).

12. How long we keep information

If you delete a single note or bookmark in the app, it disappears from your library; it is permanently removed from our servers when your account is deleted. See section 8 for shared links. You can also ask us to delete specific information by email (section 14).

13. Security

We take reasonable measures for an organization of our size, and we want to be honest about what they are:

• All connections between the app, the website and our servers use TLS encryption.
• Passwords are stored only in hashed form. Sign-in tokens are short-lived and can be revoked.
• Our servers run in Amazon Web Services, with access restricted to our engineers and protected by access controls and firewalls.
• On your device, your sign-in credentials are kept in the operating system’s secure storage.
• We review our systems periodically. We do not undergo independent security audits at this time.

No system is completely secure, and we cannot guarantee that your information will never be accessed without authorization. If we learn of a breach of security affecting your personal information, including any disclosure of your health-related information that you did not authorize, we will notify you and the regulators we are required to notify without undue delay. Where the GDPR or UK GDPR applies, we will notify the competent data protection authorities (in the EU, the authority of each country where affected users live) within 72 hours of becoming aware of the breach where feasible. For U.S. users, we will notify you no later than 60 days after discovery and notify the Federal Trade Commission where the Health Breach Notification Rule requires it. You can help by using a unique password and by not putting information in your notes or profile that you would not want exposed.

14. Your rights and choices

14.1 Things you can do yourself

• See and change your information: in the app, open the Profile tab. You can edit or remove every profile field, including your sobriety date.
• Delete your account: Profile → Danger Zone → Delete account. Section 12 explains what happens next. If you cannot access the app, email support@soberhub.life from the address on the account with the subject “Delete my account”.
• Notifications, location, calendar and Siri: turn each off in your device settings.
• Sign-in providers: you can revoke SoberHub’s access in your Apple, Google or Facebook account settings; you will then need another way to sign in.
• Meeting history and favorites: clear them in the app; they are also erased when you sign out.

14.2 Rights you can exercise by contacting us

Wherever you live, you can ask us to:

• access the personal information we hold about you and receive a copy;
• export your notes, highlights and bookmarks in a machine-readable format (there is no self-service export in the app yet, so we prepare it on request);
• correct inaccurate information;
• delete your information (subject to the retention in section 12);
• restrict or object to processing based on our legitimate interests, including analytics;
• withdraw consent where processing is based on consent, without affecting what was done before.

Email legal@soberhub.life. We will verify that you control the account (usually by replying from the account’s email address or by asking you to take an action in the app) and respond within 30 days, or sooner if your local law requires. We will not discriminate against you for exercising your rights. You may authorize someone else to act for you, in which case we will ask for proof of that authorization.

14.3 Region-specific information

• European Economic Area, United Kingdom and Switzerland. You have the rights listed above under the GDPR, the UK GDPR and the Swiss Federal Act on Data Protection, and the right to lodge a complaint with your national data protection authority (in the UK, the Information Commissioner’s Office; under UK law you may first need to complain to us, and we will acknowledge your complaint within 30 days). Because we process health-related information regularly, Article 27 of the GDPR and UK GDPR requires us to appoint representatives in the EU and the UK. We are appointing them and will publish their contact details here; until then, contact us directly at the address in section 18.
• Canada. For residents of Quebec, the Act respecting the protection of personal information in the private sector applies to our handling of your personal information. For other residents of Canada, we follow the fair information principles of the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial law. Your personal information is stored and processed in the United States by us and by our service providers (section 7), and may be accessible to U.S. courts, law enforcement and national security authorities under U.S. law; we protect it by contract and technical safeguards. The person in charge of the protection of personal information at SoberHub is our Founder and Executive Director, who can be reached at legal@soberhub.life or by post (section 18). If a confidentiality incident presents a risk of serious injury, we will notify you and the Commission d’accès à l’information promptly. You may complain to the Commission d’accès à l’information du Québec (Quebec residents) or the Office of the Privacy Commissioner of Canada. You may write to us in French and we will answer in French.
• California. Nonprofit organizations are generally not subject to the California Consumer Privacy Act, but we honor the rights it describes anyway: to know, to delete, to correct, and to opt out of the sale or sharing of personal information. We do not sell personal information, and we do not disclose it to anyone for cross-context behavioral advertising, for users of any age. The Facebook SDK’s automatic events described in section 10 are the only data flow to an advertising company, and we are switching them off. We treat information about your recovery as confidential medical information: we do not disclose it for marketing, and we disclose it to service providers only to operate the Services. We do not respond to Do Not Track signals (section 9). California residents may request a list of the third parties with whom we have shared personal information.
• Washington, Nevada, Connecticut and other states with consumer-health-data laws. Our Consumer Health Data Privacy Policy applies. It explains your rights, including the right to a list of the third parties we have shared your data with, and how to appeal if we deny a request. Our processors are bound by contracts, and the people with access to your data are under a duty of confidentiality.
• Brazil. You have the rights in the Lei Geral de Proteção de Dados (LGPD), including confirmation, access, correction, anonymization, portability, deletion, and information about the entities we share data with. We process health-related information, such as your sobriety date and recovery notes, with your consent, which you may withdraw at any time. Our encarregado (data protection officer) is Alexandr Losikov, Founder and Executive Director, legal@soberhub.life, 603 Lake St, Huntington Beach, CA 92648, United States. We collect your data directly from you and store it in the United States. You may complain to the Autoridade Nacional de Proteção de Dados.
• Other countries. We will apply the rights above as far as we reasonably can, and we will tell you if a request cannot be met.

14.4 Limiting analytics

• In the app, there is no analytics switch yet. Your operating system’s “limit ad tracking” or “delete advertising ID” settings do not affect Firebase, because we do not use the advertising ID. You can use the app as a guest, which still sends analytics but without an email address attached to the account. We plan to add an analytics opt-out setting.
• On our websites, use the cookie controls, opt-out add-on or content blocker described in section 9.
• Facebook SDK events cannot currently be turned off; see section 10 for what we are changing.

15. Children

You must be at least 13 years old to create an account or use the Services. Some places require a parent’s or guardian’s consent below a higher age, and SoberHub does not offer a parental-consent process, so the minimum age there is higher: 14 in Quebec, and 16 in the European Union and the European Economic Area. We do not knowingly collect personal information from anyone below the minimum age, and we do not currently verify age. If we learn, including from information you give us such as a birthday, that an account belongs to someone below it, we will close the account and delete its data. If you believe this has happened, email support@soberhub.life. If you are under 18, we encourage you to involve a parent, guardian or another trusted adult. App store age ratings describe content and are not the minimum age to use SoberHub. If you are a young person looking for help with alcohol or drugs, the resources in the “If you need help now” section of our Terms are available to you regardless of age, without an account.

16. International data transfers

SoberHub is in the United States and our servers are in the AWS US East (Northern Virginia) region. If you use the Services from outside the United States, your information is transferred to and stored in the United States, and processed by our providers there and wherever they operate. For transfers from the EEA, the UK, Switzerland, Brazil and other jurisdictions with transfer rules, we rely on the standard contractual clauses and equivalent safeguards built into our providers’ data-processing terms (Amazon Web Services, Google and Meta all participate in the EU-U.S. Data Privacy Framework and offer the EU Standard Contractual Clauses), and on your consent where you provide information knowing that it will be stored in the United States. We store all personal data in the United States and do not operate databases in Russia. For users in Brazil, this is international collection under ANPD Resolution 19/2024, and our service providers are bound by contract to protect your data.

17. Changes to this policy

Each version of this policy has a version number and an effective date, shown at the top. When we change it, we publish the new version at soberhub.life/privacy-policy/ and in the app. For changes that reduce your rights or expand what we collect or share, we will also tell you in the app or by email before they take effect, and where the law requires it we will ask for your consent again. Previous versions are available on request.

This policy is published in English, Spanish, French, Portuguese and Russian, and we keep all versions equally complete and up to date. If the translations differ, the English version applies, except where the law of your place of residence says otherwise: residents of Quebec may rely on whichever of the French and English versions is more favourable to them, and consumers in Brazil may rely on the Portuguese version.

18. How to contact us

• Privacy requests and questions: legal@soberhub.life
• Account help and deletion: support@soberhub.life
• General: info@soberhub.life
• Post: SoberHub, 603 Lake St, Huntington Beach, CA 92648, United States

Back to top