Version: October 30, 2026. [OWNER TO CONFIRM: lawyer review and effective date]
Draft. Words in [square brackets] are decisions the SidexSide owner still has to make. This page is not legal advice.
Some people here are on parole or probation. Some have people in their lives who mean them harm. So for every piece of information we ask: who could use this against you? We keep as little as we can.
| What | How it is protected |
|---|---|
| Private messages | Locked on the sender’s phone. Only the two phones in the chat can unlock them. We store locked text that nobody here can open. |
| Your profile, journal, moods, check-ins, plan, firsts, emergency contact, ID checklist | Email accounts: locked on your phone with a key made from your password. Then the locked copy is saved to your account. Accounts without email: kept only on your phone. Never sent to us. |
| Release date, hometown, where you live | Inside the locked profile only. One exception: if you turn on Open to hellos, your state and the month of your release (past or still to come) are copied out of the locked profile so other members can see them. Section 2 says who. The exact day, your hometown and your city stay locked. |
| Your saved posts, and the days you pick for plan steps | Saved posts stay on your phone only and are never sent to us. The day you pick for a plan step is part of your locked plan. A calendar event you add says only “Group meeting” or “A step on my plan”, with no names, no goal text and no app name. Your calendar app keeps it; if you use the Google Calendar button, Google also gets the event’s title and time. |
| Your password | Never sent to us. Your phone makes a separate sign-in secret from it. That is what we check. |
Because we can’t read these, nobody who gets our data can read them either. Not a hacker. Not our team. Not a court.
The cost: if you lose both your password and your recovery code, we can’t get these back for you.
| What | Why | How long |
|---|---|---|
| Your email (email accounts) | To sign you in, confirm your account and reset your password | Until you delete your account. Never shown to other members, co-creators or case teams. |
| Your sign-in name (accounts without email) | To sign you in | Until you delete your account. Others see only your first name. |
| Your first name, friend code, when you joined | So people can find you | Until you delete your account |
| Who let you in (a co-creator, and who vouched for you) | So everyone here is confirmed | Until you delete your account |
| A way to reach you, if you ask for a record check | So a co-creator can reach you | Deleted when a co-creator decides, or after 14 days |
| Who you are connected to, and who you blocked | So only connected people can message you | Until either account is deleted |
| Who messaged whom, and when (not what it says) | To deliver messages | Until either account is deleted [OWNER TO CONFIRM: set a shorter limit?] |
| Message keys (the private half is locked, so we can’t open it) | So phones can lock messages for each other | Until you delete your account |
| Help out posts | Other members read them | Shown for 60 days. Stored until you delete your account [OWNER TO CONFIRM: delete after 60 days?] |
| Open to hellos, if you turn it on: your state, the month you came home or the month you expect to (up to 5 years ahead), one thing you are working on, and a sentence or two about you if you write one | So other members can say hi to you, and know where you are from. Members who are open to hellos are also shown up to 3 new people a day. | Until you turn it off, change it or delete your account. Who sees your state and month while it is on: every member, next to your first name, on People, in a conversation with you, in a group’s member list, on your Help out posts and on your replies. Posts and replies are also visible to people who have signed up but have not been let in yet. Co-creators see it in the All members list. If you turn it off, it stops showing. Nothing is shown for a request you sent that has not been answered. A sentence is shown only after it has been checked (see Anthropic below). [OWNER TO CONFIRM: delete when someone turns it off?] |
| Group chat messages | Members of that group read them | Until the group is closed or you delete your account [OWNER TO CONFIRM: set a limit?]. They are not locked. Co-creators can read one if it is reported or held for safety. A first you choose to share with a group is an ordinary group message: only the one sentence you see before you send it, never your note or your dates. |
| Reports you make, with a copy of the one message you report | So co-creators can act | Until either account is deleted. Then 60 days. |
| Steady Ground answers you choose to share | So your case team can see them | Only while you share. Stopping deletes them. |
| Usage counts (which screens and features are used) | To see what helps and what is broken | 90 days. Tagged with a code that changes every week, never with your account. |
| Error reports | To fix bugs | 90 days, with no account attached |
| Search counts for “care near you” | To see what people look for | 365 days. Counts only. Never your words, location or ZIP code. [OWNER TO CONFIRM: shorten?] |
| Places near you (shelters, food, counseling, faith communities) | To show places close to you | Your ZIP code or your phone’s location (if you allow it, rounded to about a kilometre) is used on your phone to find places. It is not sent to us. Your phone downloads a state’s place file from SidexSide, so our web server can see that the file was asked for, like any website. [OWNER TO CONFIRM: web server log retention]. The place data comes from OpenStreetMap contributors and from lists people checked by hand. |
| How to get there (walking and public transit) | To plan a route to a place you picked | When you tap it, a starting point (your ZIP’s centre, or your phone’s location rounded to about a kilometre, only if you choose “Start from where I am”) and the place go to our own route server, through our gateway, and nowhere else. The answer comes straight back. We do not save the route or attach it to your account. [OWNER TO CONFIRM: gateway and server logs]. If you tap Directions, your phone opens its maps app or Google Maps with the place’s name and position, the way any link does. |
| Support buddy pairings | So a pairing lasts until either of you ends it, and so the same person is not suggested again after you say “Not this one” | Who is paired with whom, when it started and ended, and who ended it; and who you passed on. Until either account is deleted. A buddy pairing never shares your check-ins, moods, journal or plan, and ending it tells the other person nothing. [OWNER TO CONFIRM: set a shorter limit?] |
| Organizations you suggest | So co-creators can check the organization’s own pages before anything is posted | The name, link, note and topic you send. Co-creators see these without your name. We keep which account sent it only to limit suggestions to 3 a day. [OWNER TO CONFIRM: how long] |
| Diary study entries, if you join a study | Research you agreed to | Until you leave the study |
| Records of what co-creators do | So co-creators are accountable too | [OWNER TO CONFIRM: how long] |
What we never keep: your IP address. Our gateway removes it before anything reaches our servers.
Ads and tracking: none. We don’t use ad networks, analytics companies or tracking cookies. The app’s fonts and code come from our own site. The app saves your settings in your phone’s browser storage.
Go to You > Settings > Download my data. Your phone makes a file with your journal, check-ins, plan, firsts and the rest of what you saved. The file is made on your phone and goes nowhere else. Anyone who gets the file can read it, so keep it somewhere private.
The file does not include what other people wrote to you, or the records we keep on our side (section 2). To see what we hold about you, write to us (section 8).
Deleting your account deletes what is tied to it: your profile, your messages (on both sides), your connections, your posts, your keys and your Steady Ground shares.
One exception, so that deleting an account can’t erase evidence of harm. Before your account goes, we keep a copy of:
We keep these copies for 60 days, then delete them automatically. Only co-creators can see them.
What is on your phone stays there until you sign out or clear it.
| Who | What they see |
|---|---|
| Other members | Your first name, your posts, and messages you send them. If you turn on Open to hellos: also your state and the month you came home or expect to, and what you are working on. Never your email, sign-in name, exact release date, hometown or city. You can turn it off any time in You > Open to hellos. While it is on, the app may also suggest you as a support buddy to a member who shares your state or what you are working on. They are only shown what Open to hellos shows. A buddy pairing only starts if you accept, and either of you can end it. |
| People who have signed up but are not let in yet | Help out posts and replies, with your first name and, if Open to hellos is on, your state and month. Nothing else. |
| Your case team | Only the Steady Ground answers you share, only while you share, under a record code. Never your name. |
| Co-creators (Jose, Ryan and Sarah) | The sign-up list (first name, who vouched, any contact you left for a record check), the All members list (first name, when you joined, and your state and month if Open to hellos is on), posts, reports and kept reports. They can’t see your email, messages, journal, moods or profile. They can also see waiting organization suggestions, but not who sent them. Sign-in strength: the dashboard asks for a second sign-in step, except for two co-creators whose passphrase alone opens it (an owner decision). The in-app All members list and the sign-up review need only a co-creator’s sign-in, with no second step. Every page of the All members list that is read is logged. [OWNER TO CONFIRM: require the second step for these] |
| People who run our servers | Email addresses, sign-in names, connections, and when messages were sent. Never message text or anything locked. We keep this group small and require two-step sign-in. |
| Company | What it does | What it gets |
|---|---|---|
| Supabase | Database and sign-in | Everything in section 2, plus locked data it can’t read |
| Railway | Runs the app, the gateway, search and voice-to-text | Data passes through. The gateway removes IP addresses. For the journal’s “Say it” button, a short recording goes to our own speech-to-text service. It is held in memory just long enough to turn it into words, then dropped. We don’t save the recording or the words. No other company gets them. |
| LiveKit | Group video calls | Your IP address, and the audio and video while a call runs. Nothing is recorded. Your camera and microphone start off. |
| OpenAI (moderation service) | A second safety check, instead of or alongside Claude, on Help out posts, replies, group chat messages and the sentence a member writes about themselves for hellos | Only the words of the post, reply, message or sentence. Not who wrote it, and not which group. [OWNER TO CONFIRM: OpenAI’s retention and no-training terms for the moderation service] | Only the words of the post, message or sentence (and whether a post is an ask or an offer). Not who wrote it, and not which group. [OWNER TO CONFIRM: Anthropic’s retention and no-training terms for this use] |
| Resend | Sends email | Your email address, to send you sign-up confirmations and password reset links. Also co-creators’ addresses, for alerts (a new sign-up, a held post). Alerts never include a member’s name or anything anyone wrote. |
| Have I Been Pwned | Checks if a new password was in a known data breach | The first 5 characters of a scrambled version of the password. Never the password. |
Place data © OpenStreetMap contributors (openstreetmap.org/copyright). We download it ahead of time; your phone does not talk to OpenStreetMap.
We don’t sell or rent information. We don’t allow these companies to use it for their own purposes.
See how we respond to data requests. In short: we need valid legal process, we hand over as little as the law requires, we push back on requests that go too far, and we tell you unless a court forbids it. What we can’t read can’t be handed over.
SidexSide is for adults, 18 and older. We don’t knowingly collect information from anyone younger. [OWNER TO CONFIRM: minimum age, after lawyer review]
No system is perfect. If we learn of a breach that affects you, we will tell you in the app, and by email if you have one. [OWNER TO CONFIRM: how many days, or as state law requires]
If this page changes in a way that matters, we will tell you in the app before it takes effect.
Questions, requests, complaints: [email protected].
Run by [OWNER TO CONFIRM: legal name of the organization or the co-creators]. Mailing address: [OWNER TO CONFIRM: postal address, if you want one shown].