Legal

Privacy Policy

Effective date: April 30, 2026  ·  Last updated: May 6, 2026

This Privacy Policy is prepared with care and represents our genuine commitment to protecting your information. It is not a substitute for legal advice. If you have specific questions about your privacy rights in your jurisdiction, we encourage you to consult a qualified lawyer. Nothing here constitutes legal advice to you. We are not lawyers.

1. Who we are and how to reach us

SobrCircle is operated by Moradi Labs Inc., a federal Canadian corporation (Corporation No. 1783166-8; Ontario extra-provincial registration No. 1001564375), and its predecessor sole proprietorship of Behnam Moradi. Moradi Labs Inc. is in the process of consolidating all operations and product accounts; both entities are responsible for the service during this transition.

Registered office: 1223 Enfield Ct, Windsor, Ontario, Canada N8S 4N1.

• Privacy enquiries and rights requests: [email protected]
• General support: [email protected]
• Legal notices: [email protected]
• Mail: Privacy Officer, Moradi Labs Inc., 1223 Enfield Ct, Windsor, ON, Canada N8S 4N1

Our Terms of Service are incorporated by reference into this Privacy Policy.

2. Our Privacy Officer

Designated Privacy Officer (Person in Charge of the Protection of Personal Information): Behnam Moradi, Director and sole shareholder, Moradi Labs Inc.

This designation satisfies the requirement under the Quebec Act respecting the protection of personal information in the private sector (CQLR c P-39.1, as amended by Law 25 / Bill 64, s. 3.1) and the accountability principle under the federal Personal Information Protection and Electronic Documents Act (PIPEDA, Schedule 1, Principle 4.1.1).

The Privacy Officer has independent authority to: pause new data collection activities that have not received privacy review; veto product changes that introduce undisclosed data flows; approve or deny new third-party data processors; and direct the response to any privacy incident.

• Email: [email protected]
• Mail: Privacy Officer, Moradi Labs Inc., 1223 Enfield Ct, Windsor, ON, Canada N8S 4N1

3. Scope of this policy

This policy describes how SobrCircle collects, uses, discloses, stores, and deletes personal information when you use the SobrCircle mobile application (iOS and Android) and our related website at sobrcircle.com. It applies worldwide to all users wherever the app is distributed. Regional supplements are incorporated inline in Sections 11–16 below.

This policy does not apply to third-party services linked from SobrCircle (for example, external meeting-directory sources or crisis hotline websites). Those services have their own privacy policies.

4. Who can use SobrCircle

SobrCircle is for adults aged 18 and older only. We do not knowingly collect personal information from anyone under 18. At sign-up, we require you to confirm you are 18 or older; we record the date and time of that confirmation in your account record. If we learn that someone under 18 has created an account, we will close the account and delete the associated personal information without delay.

5. Information we collect

5.1 Information you give us directly

• Account information: email address, first name, optional last name, display name, optional phone number (for two-factor authentication).
• Profile information: profile picture, bio, optional age range, optional gender identity, optional field for how you heard about us.
• Sensitive recovery information (entirely optional): sobriety or recovery start date, primary recovery goal, a free-text “about your recovery” bio field. You choose whether to enter any of this. We treat it as sensitive personal information under every applicable law. It is never displayed to other users without your active, explicit opt-in.
• Content you create: posts, comments, direct messages, group messages, journal entries, photos, videos, and audio messages you create or upload within the app.
• Reports and appeals: if you report content or appeal a moderation decision, we collect the information you provide in that report or appeal.
• Support communications: if you contact us by email, we collect the content of your message and your contact details.

5.2 Information collected automatically while you use the app

• Device and app information: device type, operating system version, app version, language, time zone, network type (Wi-Fi / cellular). Used for diagnostics and crash triage.
• Crash reports and performance data: Firebase Crashlytics records crash stack traces linked to an anonymized user identifier. Firebase Performance Monitoring records network latency and rendering metrics. We do not include the text content of your posts or messages in crash or performance data.
• App usage events (analytics — opt-in only): Firebase Analytics is disabled by default. You can opt in through Settings → Privacy → Usage Analytics. If you opt in, we collect events such as “post created,” “milestone reached,” or “feature viewed.” We do not record the content of what you wrote, your recovery date, or any recovery-context field in analytics events.
• Push notification token: a device token so Firebase Cloud Messaging can deliver push notifications you have opted into. You can revoke notification permission at any time in your device settings.
• Presence and typing indicators: Firebase Realtime Database records your online/offline status and typing indicator state while the app is open. This is visible only to members of your active circle.
• Device attestation: Firebase App Check uses Apple App Attest (iOS) and Google Play Integrity (Android) to confirm requests come from a genuine, unmodified copy of SobrCircle. No personally identifying information leaves your device as part of this check. App Check is enforced at the Firebase service-tier (the Google gateway in front of Firestore, Storage, Realtime Database, Identity Toolkit, and Cloud Functions) so requests from non-genuine clients are rejected before any application logic runs.
• Feature flags: Firebase Remote Config delivers feature flag values to your app. No personal information is transmitted as part of this.

5.3 Information from third parties

• Sign-in providers: if you sign in with Apple or Google, we receive from that provider a stable unique identifier and your email address (and, in some cases, a display name if you share it).
• Subscription status: Apple App Store, Google Play, and RevenueCat send us webhook events when your subscription changes (new, renews, cancels, refunds). We receive your subscription state and an anonymized purchase identifier. We do not receive your payment card number or full billing details.

5.4 Location information

• Meeting search (coarse location): if you use the “find meetings near me” feature, we pass a coarse location (city or region level) derived from your device to a mapping API to return nearby meeting results. We do not store this location after the search completes.
• Live location sharing (precise, opt-in only): if you choose to share your precise location in real time with a specific circle member, we temporarily store and transmit that location via Firestore for as long as you have sharing active. You control this feature and can stop it at any time.

We never collect background location. Location access requires your explicit permission and is never requested at app launch.

5.4a Device permissions and what each one is used for

Every device permission SobrCircle asks for has a single, narrowly-scoped purpose that you control. Each prompt is shown the first time you reach a feature that needs it; you can revoke any of these from your device settings at any time and the rest of the app continues to work.

• Camera — used only when you choose to capture and share a photo or video in posts or messages.
• Microphone — used only when you choose to record a video for a check-in or message, or when you tap the microphone to dictate text.
• Speech recognition (iOS) — transcribes your dictated voice into text on-device. Apple’s Speech framework may forward audio to Apple servers for recognition; we receive only the transcribed text from Apple. We never store the raw audio for that flow.
• Photo library (read) — used when you choose images to share in posts or messages.
• Photo library (add) — used only when you explicitly tap “save image” on shared content.
• Location while in use — used only while the app is open and only when you choose to share your live location with circle members. Location data is never read in the background. (Older versions of SobrCircle declared an “Always” location purpose string; that declaration has been removed since SobrCircle has never run location in the background.)
• Push notifications — used to deliver new-message, friend-request, and milestone notifications you opted into. Manage at any time in device settings.

5.5 What we do not collect

• We do not collect your contacts or sync your address book.
• We do not track you across other apps or websites. SobrCircle does not use Apple’s App Tracking Transparency framework because we do not perform any cross-app tracking; on Android, we explicitly remove the advertising-ID permission (com.google.android.gms.permission.AD_ID) at the manifest-merger layer so the app never receives an advertising identifier.
• We do not sell your personal information.
• We do not use your content to train AI or machine-learning models.
• We do not collect government-issued identifiers (social security numbers, passport numbers, etc.).
• We do not collect financial account details (payment card numbers, bank account numbers).

5.6 Subscriptions and Family Sharing

The SobrCircle Supporter monthly subscription (formerly “Premium” in older app builds; “Supporter” everywhere user-facing in current builds) is an individual subscription. Apple Family Sharing is intentionally disabled for this subscription, and Google Play Family Library is not enabled. Each member of a household who chooses to support SobrCircle does so with their own subscription. Recovery is personal — we don’t want a household’s subscription state to be visible to anyone the user has not chosen to share recovery context with.

5.7 Home-screen widgets

On iOS, SobrCircle’s home-screen and lock-screen widgets read a small set of values (recovery date, today’s reflection text, tomorrow’s reflection text) from a shared App Group container (group.com.sobrcircle.app.widgets) that lives entirely on your device. The app writes these values; the widget extension reads them. Widget data is local-only and is never transmitted to a server. The same model applies to the Android home-screen widgets (which read locally-stored values via Android shared preferences).

5.8 Maps API key

SobrCircle uses the Google Maps SDK on both iOS and Android to render maps and meeting locations. The Maps API key is embedded in the app binary (this is the design Google requires for client-side Maps SDKs); it is restricted at the Google Cloud Platform IAM layer to SobrCircle’s iOS bundle ID and Android package name + signing certificate, and is restricted to the Maps SDK only. No location tracking happens on our servers as part of map rendering — the Maps SDK communicates directly with Google’s map tile servers from your device.

6. How we use your information

We use the information we collect for the following purposes:

• Operating the app and your account — authenticating you, delivering the feed, messages, circles, milestones, map, and journal; processing your subscription; sending transactional notifications. Legal basis (GDPR/UK GDPR): performance of a contract.
• Content moderation and user safety — scanning uploaded photos and videos for prohibited content; scanning text for toxicity, harassment, and self-harm signals; detecting and reporting child sexual abuse material (CSAM) as required by law. Legal basis: legal obligation; legitimate interests (safety of users).
• Crash and reliability diagnostics — triaging and fixing crashes and performance problems using Crashlytics and Performance Monitoring data. Legal basis: legitimate interests (reliability of the service).
• Analytics (opt-in only) — improving the app based on aggregated, anonymized usage patterns if you have opted into Firebase Analytics. Legal basis: consent (which you can withdraw at any time).
• Push notifications you requested — delivering notifications about activity in your circle, milestones, and account events. Legal basis: consent; performance of a contract.
• Preventing fraud and abuse — detecting and responding to suspicious activity, account fraud, and Terms of Service violations. Legal basis: legitimate interests; legal obligation.
• Legal compliance and dispute resolution — retaining records required by applicable law; responding to valid legal process; resolving disputes. Legal basis: legal obligation; legitimate interests.

We do not use your information for advertising. SobrCircle has no advertisers, advertising networks, or advertising SDK.

We do not use automated decision-making that produces legal or similarly significant effects on you, with one exception: our content moderation classifiers may automatically hide or flag content pending human review. If your content is flagged, you will be notified and you can request human review by emailing [email protected].

7. Content moderation and safety processing

SobrCircle is a recovery community. To protect users from harmful content, we run automated moderation on content you upload or post. We describe below the controls actually deployed today. Where a control is built but not yet activated, we say so plainly. For our full child safety standards, see sobrcircle.com/child-safety-standards.

• Images you upload — in production: scanned by Google Cloud Vision SafeSearch for adult, violent, and sexually exploitative content. Images that exceed our likelihood thresholds are quarantined and hard-deleted, an audit trail is preserved, and you are notified.
• Videos you upload — in production: scanned by Google Cloud Video Intelligence using its explicit-content detection model. Videos are not visible to other users while moderation is pending. Videos that exceed our likelihood thresholds are blocked and removed.
• Self-harm signal detection in text — in production: a curated phrase classifier runs against posts, comments, and messages to identify potential crisis or self-harm signals. When a signal is detected, the user is shown an in-app card with crisis hotline resources. This is a safety net; it does not block posts.
• CSAM hash-matching (Microsoft PhotoDNA) — built, not yet activated. Infrastructure to hash-match uploaded images against the PhotoDNA database is implemented in the SobrCircle backend but is currently disabled by feature flag pending completion of Moradi Labs Inc.’s enrollment as a registered Electronic Service Provider (ESP) with PhotoDNA and the affiliated reporting bodies. Until activation, protection against CSAM relies on Cloud Vision SafeSearch (above), in-app user reporting, operator review, and manual escalation to authorities (see next bullet). This policy will be updated when hash-matching is activated.
• Automated text moderation (Google Jigsaw Perspective API) — built, not yet activated. Infrastructure to scan post, comment, and message text via the Perspective API is implemented in the SobrCircle backend but is currently disabled by feature flag while thresholds are tuned. Until activation, text content is moderated through in-app user reporting and the self-harm signal detection above. This policy will be updated when the classifier is activated.
• CSAM reporting to authorities — in production, manual workflow. When apparent child sexual abuse material is identified on SobrCircle, Moradi Labs Inc. files reports through the National Center for Missing & Exploited Children (NCMEC) CyberTipline (report.cybertip.org), as required by 18 U.S.C. § 2258A, and where applicable through the Canadian Centre for Child Protection (cybertip.ca), as required by Canadian law. Reports are currently filed manually by the trust and safety operator; automated reporting will be activated together with the PhotoDNA hash-matching above. This reporting obligation applies regardless of context or claimed intent and cannot be opted out of.

If your content is removed or restricted, you will be notified. You can appeal by emailing [email protected]. All appeals are reviewed by a human. Image and video data passed to Google Cloud Vision and Google Cloud Video Intelligence is used solely for moderation and is not retained by those providers for training or other purposes beyond the scope of the moderation scan.

8. Sharing with third parties

We do not sell personal information. We share personal information only with the service providers listed below, which process it on our instructions to operate SobrCircle. Where required, we have entered into data processing agreements (DPAs) with each provider.

• Google LLC / Google Cloud — Firebase (United States)
  Services: Firebase Authentication (identity toolkit), Firestore (database), Firebase Storage (files), Firebase Cloud Functions (server-side logic), Firebase Realtime Database (presence / typing), Firebase Cloud Messaging (push notifications), Firebase Crashlytics (crash reporting), Firebase App Check (device attestation), Firebase Performance Monitoring, Firebase Remote Config, Firebase Analytics (if opted in).
  What they see: account information, user-generated content, messages, photos, videos, audio, device information, push tokens, crash data, performance traces, analytics events (if opted in).
  DPA: Google Cloud Data Processing Addendum (online acceptance).
  Transfer basis (EU/UK/Quebec): see Section 10.
• Google LLC — Cloud Vision SafeSearch and Cloud Video Intelligence (United States)
  What they see: image and video bytes uploaded by users, processed for content classification and returned immediately. Google’s standard data processing terms apply.
  DPA: Google Cloud Data Processing Addendum.
• Google LLC — Maps Platform (Places API) (United States)
  What they see: coarse location queries for recovery meeting search results (no stored personal data beyond the API request).
  DPA: Google Cloud Data Processing Addendum.
• Apple Inc. (United States)
  Services: Apple App Store (distribution and billing), Sign in with Apple (OAuth authentication), Apple Push Notification service (APNs, push delivery to iOS devices).
  What they see: sign-in identifiers, subscription purchase records, push notification tokens (iOS).
  Governed by the Apple Developer Program License Agreement.
• Google LLC — Google Play (United States)
  Services: Google Play Store (Android distribution and billing), Sign in with Google (OAuth authentication), Firebase Cloud Messaging (push delivery to Android devices).
  What they see: sign-in identifiers, subscription purchase records, push notification tokens (Android).
  Governed by the Google Play Developer Distribution Agreement.
• RevenueCat Inc. (United States)
  What they see: subscription state, purchase receipts, and an anonymized app user ID (which equals your Firebase Authentication UID — not your email or name).
  DPA: RevenueCat Data Processing Addendum.
• National Center for Missing & Exploited Children (NCMEC) (United States)
  What they see: CyberTip reports filed manually by Moradi Labs Inc.’s trust and safety operator when CSAM is identified, including the image, account identifiers, and relevant metadata required by 18 U.S.C. § 2258A. Reports are currently filed through the public CyberTipline channel at report.cybertip.org; ESP enrollment for programmatic submission is in progress.
  Statutory obligation; no DPA required.
• Canadian Centre for Child Protection / cybertip.ca (Canada)
  What they see: reports of apparent CSAM with a Canadian nexus, filed manually by Moradi Labs Inc.’s trust and safety operator through cybertip.ca, as required by Canadian law.
  Statutory obligation; no DPA required.

We may disclose personal information to law enforcement, regulators, or courts when required by a valid legal demand (court order, subpoena, regulator request, or equivalent). We will tell you about any disclosure unless we are legally prohibited from doing so, or unless doing so would create a risk of harm to you or others.

If Moradi Labs Inc. or the SobrCircle service is sold, merged, or transferred, personal information may be transferred to the successor entity, subject to the same privacy protections described in this policy. We will notify you before any such transfer takes effect.

9. Retention

• Active account data (profile, posts, messages, photos, videos, journal entries) — retained while your account is open.
• Account data after deletion — when you tap Delete Account, your account enters a 30-day grace period during which your data is hidden from other users (your posts, messages, and profile become invisible to everyone but you) and your sign-in tokens are revoked. You can sign back in during the grace window to restore the account. After 30 days, profile and user-generated content are permanently deleted from active systems and your authentication record is removed. Technical logs for security and abuse prevention may persist for up to 30 additional days before permanent deletion. Encrypted backup copies are purged within 35 days of permanent deletion.
• Content moderation event records — up to 2 years, for safety auditing, appeals, and legal defense.
• CSAM reports — retained as required by law (potentially indefinitely under 18 U.S.C. § 2258A and applicable Canadian law).
• Subscription and billing records — up to 7 years, as required for tax and financial compliance under applicable Canadian law.
• Crash reports — 90 days in Firebase Crashlytics.
• Data export archives — available via a signed download URL for 7 days after generation, then automatically deleted.
• Breach register and privacy incident records — as required by PIPEDA and Quebec Law 25 (minimum 5 years).
• Account deletion audit records (confirmation that a deletion request was received and processed) — up to 24 months, for compliance verification.
• Data subject to legal hold — retained until the hold is lifted, regardless of the above timelines.

10. International data transfers

We are headquartered in Canada. Our primary infrastructure runs on Google Cloud in the us-central1 region (Iowa, United States). When you use SobrCircle, your personal information is transferred to and processed in the United States.

Canada to United States transfers: PIPEDA does not prohibit cross-border transfers, but requires us to use contractual means (our DPAs with Google, RevenueCat, etc.) to ensure comparable protection. Our DPAs with Google and RevenueCat include the Google Cloud Data Processing Addendum and RevenueCat’s DPA respectively, which impose obligations consistent with PIPEDA and Quebec Law 25. Google maintains Google Cloud certifications including ISO 27001 and SOC 2.

Quebec Law 25 cross-border transfer assessment: Quebec Law 25 requires a written privacy impact assessment before transferring personal information outside Quebec to confirm comparable protection. We have conducted this assessment. Our determination is that Google Cloud’s contractual and organizational protections, combined with the protections in our DPA, provide protection comparable to Quebec standards. This assessment is available to the Commission d’accès à l’information du Québec (CAI) on request.

EU and UK residents — GDPR Chapter V and UK GDPR: The United States does not benefit from an EU adequacy decision for general commercial data transfers (the EU-US Data Privacy Framework applies only to self-certified US organizations). Our transfers of EU/UK personal data to Google Cloud rely on the Standard Contractual Clauses (SCCs) included in the Google Cloud Data Processing Addendum (Module 2: Controller to Processor), supplemented by Google’s Transfer Impact Assessment. Our transfers to RevenueCat rely on RevenueCat’s DPA, which also includes SCCs. No other ad hoc mechanisms are used. We do not rely on consent as the sole basis for transfers.

Australian residents: We transfer personal information from Australia to the United States as described above. We take reasonable steps under Australian Privacy Principle 8 to ensure that overseas recipients handle your information in accordance with the Australian Privacy Principles, primarily through our DPAs.

11. Your rights

Regardless of where you are located, you have the following rights with respect to your personal information. Regional notes follow below where the law adds specific requirements or extends these rights.

• Access: request a copy of the personal information we hold about you. You can also export your data directly in-app: Settings → Account → Request Data Export. We will deliver a downloadable archive (JSON + media files in a ZIP) within 7 days of the request.
• Correction: correct inaccurate or incomplete personal information. Edit your profile in-app or email [email protected].
• Deletion: delete your account and the personal information we hold about you. Use Settings → Account → Delete Account in the app, or visit sobrcircle.com/delete-account. Deletion enters a 30-day grace period during which you can sign back in to restore the account; after 30 days, all active-system data is permanently deleted and your authentication record is removed. Technical logs are purged within 30 additional days. See Section 9 for legally required retention categories and Section 9 above for the full deletion timeline.
• Portability: receive a portable, machine-readable copy of the personal information you have provided to us. Our data export (above) is in JSON format and is machine-readable.
• Withdrawal of consent: withdraw consent to optional processing (analytics, location sharing, recovery date display, push notifications) at any time through in-app settings or device settings. Withdrawal does not affect the lawfulness of processing before withdrawal.
• Restriction and objection: ask us to restrict how we process your data, or object to a specific processing activity, by contacting [email protected].
• Human review of automated decisions: if automated moderation classifiers have flagged or removed your content, you can request human review by emailing [email protected].

How to submit a request: email [email protected] from the email address associated with your account, or use the in-app tools described above. We may ask you to verify your identity before processing your request.

Response time: we will respond to all privacy requests within 30 calendar days. If we need more time, we will notify you in writing with the reason and the new expected date. We will never charge a fee for a first request; we may charge a reasonable fee for repeated or manifestly unfounded requests, consistent with applicable law.

12. Regional rights — Canada (PIPEDA and Quebec Law 25)

We comply with the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, Quebec’s Act respecting the protection of personal information in the private sector (CQLR c P-39.1, as amended by Law 25 / Bill 64).

Your rights under PIPEDA include access, correction, and withdrawal of consent. We process your personal information only for the purposes identified in this policy, and only with your knowledge and consent (express for sensitive information such as recovery date; implied for necessary operational purposes).

Quebec residents have additional rights under Law 25:

• Right to be informed of automated processing: we use automated classifiers for content moderation (Section 7). You have the right to be informed of this and, upon request, to have a human review any automated decision that directly affects you.
• Right to data portability (new under Law 25): you may request a copy of your personal information in a structured, commonly used, technological format, or have it transferred directly to another organization if technically feasible. Use our data export feature or email [email protected].
• Consent for sensitive information: we obtain explicit consent before collecting your recovery date, recovery context, or other sensitive personal information.
• Cross-border transfer assessment: as noted in Section 10, we have completed a written privacy impact assessment for transfers outside Quebec, available to the CAI on request.

To file a complaint: Office of the Privacy Commissioner of Canada (federal / PIPEDA) at priv.gc.ca  ·  Commission d’accès à l’information du Québec (Quebec) at cai.gouv.qc.ca  ·  BC Information & Privacy Commissioner at oipc.bc.ca  ·  Alberta Information and Privacy Commissioner at oipc.ab.ca.

Notre politique de confidentialité est disponible en français sur demande. Contactez-nous à [email protected].

13. Regional rights — European Economic Area and United Kingdom (GDPR / UK GDPR)

SobrCircle is not actively marketed in the European Economic Area (EEA) or the United Kingdom. If you nonetheless use SobrCircle from within the EEA or the UK, the General Data Protection Regulation (GDPR) and UK GDPR apply to our processing of your personal data.

Legal bases for processing (Article 6 and Article 9 GDPR):

• Performance of a contract (Art. 6(1)(b)): operating your account, delivering app features, processing your subscription.
• Legal obligation (Art. 6(1)(c)): mandatory CSAM reporting; responding to valid legal process; retaining records as required by applicable law.
• Legitimate interests (Art. 6(1)(f)): crash diagnostics and reliability; fraud and abuse prevention; safety moderation. We have assessed that these interests are not overridden by your interests or fundamental rights, given the limited nature of the data involved and the direct safety benefit to users.
• Consent (Art. 6(1)(a)): optional analytics (Firebase Analytics, opt-in); optional location sharing; optional push notifications. You may withdraw consent at any time.
• Special category data (Art. 9(2)(a) — explicit consent): your recovery date and recovery context are special category health data under the GDPR. We collect and process this only with your explicit, specific, informed consent. You can withdraw this consent and delete this data at any time.

Your GDPR and UK GDPR rights: access (Art. 15), rectification (Art. 16), erasure (“right to be forgotten,” Art. 17), restriction (Art. 18), portability (Art. 20), objection (Art. 21), and the right not to be subject to automated decision-making with legal effects (Art. 22 — see Section 7 on human review of moderation decisions).

To file a complaint: contact your national data protection authority (EU member state supervisory authority) or, in the UK, the Information Commissioner’s Office (ICO) at ico.org.uk. Because we are based in Canada and do not have an EU/UK establishment or EU/UK representative formally designated, your lead supervisory authority is the authority in the EU member state or UK where you reside.

Cross-border transfers (EU/UK to US): as described in Section 10, transfers rely on Standard Contractual Clauses in our Google Cloud and RevenueCat DPAs.

14. Regional rights — United States

14.1 California (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) gives you the following rights:

• Right to know: what personal information we collect, use, disclose, and sell. This policy is the complete disclosure; contact us for a copy specific to your account.
• Right to delete: delete your account in-app or email [email protected].
• Right to correct: edit your profile in-app.
• Right to opt out of sale or sharing: we do not sell or share your personal information for cross-context behavioral advertising. There is nothing to opt out of. We do not have a “Do Not Sell or Share My Personal Information” link because we have no such activity to stop.
• Right to limit use of sensitive personal information (SPI): under the CPRA, the following categories of SPI that we may handle are your recovery-related health information and your precise geolocation (if you activate live location sharing). We use SPI only for the purpose of providing the service to you, not for secondary purposes. You can delete recovery information or disable location sharing at any time.
• Non-discrimination: we will not discriminate against you for exercising any of these rights.
• Authorized agent: you may designate an authorized agent to submit requests on your behalf. We may require verification of both the agent’s authorization and your identity.

We respond to verifiable California consumer requests within 45 days (extendable by 45 days when reasonably necessary, with notice).

We do not have actual knowledge of collecting personal information of California residents under 16.

14.2 Other US state privacy laws

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), and other US states with consumer privacy laws have rights similar to those described in Sections 11 and 14.1 above, including rights to access, correct, delete, and obtain a portable copy of your personal information, and to opt out of any sale or targeted advertising (neither of which we engage in). We honor these rights. Contact [email protected] to exercise them. We will respond within the shorter of 45 days or the statutory deadline of your state.

Colorado SB 24-205 (AI Law, effective June 30, 2026): to the extent we deploy any automated decision-making covered by that law after its effective date, we will provide required notices at that time.

15. Regional rights — Australia (Privacy Act 1988)

If you are in Australia, we handle your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

• We collect personal information only by lawful and fair means (APP 3) and only what is reasonably necessary for our functions (APP 3.2).
• We take reasonable steps to ensure personal information we hold is accurate, up-to-date, and complete (APP 10).
• You may request access to or correction of personal information we hold about you by contacting [email protected] (APP 12, APP 13). We will respond within 30 days.
• Cross-border transfers to the United States are made as described in Section 10. We take reasonable steps under APP 8 to ensure overseas recipients handle your information consistently with the APPs.

To file a complaint: Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. Please contact us first; we will try to resolve your concern within 30 days.

16. Breach notification

We take security incidents seriously. If we discover a breach of personal information that poses a risk of harm, we will act immediately to contain it and notify the affected users and regulators according to the following obligations:

• Canada — PIPEDA: we will report to the Office of the Privacy Commissioner of Canada (OPC) and notify affected individuals without unreasonable delay if the breach poses a “real risk of significant harm.” We maintain a breach register as required by PIPEDA s. 10.3.
• Quebec — Law 25: we will notify the Commission d’accès à l’information (CAI) and affected individuals as soon as possible if the breach poses a risk of “serious injury.”
• GDPR / UK GDPR: where the GDPR or UK GDPR applies, we will notify the relevant supervisory authority within 72 hours of becoming aware of a qualifying breach, and affected data subjects without undue delay where there is a high risk to their rights and freedoms.
• CCPA (California): we will notify California residents of a breach of unencrypted personal information as required by California Civil Code § 1798.82 in the most expedient time possible.
• Australia — Notifiable Data Breaches (NDB) scheme: if a breach is likely to result in serious harm to any Australian individuals, we will notify the OAIC and affected individuals as required under Part IIIC of the Privacy Act 1988.

17. Security

We protect your information using:

• HTTPS / TLS encryption for all data in transit between your device and our servers.
• Encryption at rest for data stored in Google Cloud / Firebase (AES-256).
• Firebase App Check — blocks requests from non-genuine, modified, or jailbroken clients using Apple App Attest (iOS) and Google Play Integrity (Android).
• Strict server-side Firestore Security Rules and Storage Security Rules enforcing who can read, write, and delete each document.
• Least-privilege access controls: only the Privacy Officer (Behnam Moradi) holds full administrative access to production systems.
• Two-factor authentication on all administrative accounts.
• Automated content moderation scanning (Sections 6 and 7) to protect users from harmful content.
• Point-in-time recovery (PITR) enabled on Firestore for disaster recovery.

No system is perfectly secure. If we discover a breach that affects your information, we will notify you and the relevant regulator(s) as described in Section 16.

18. Push notifications

We send push notifications only with your permission. You can grant or revoke notification permission in your device settings at any time. We send push notifications for: new messages, friend request activity, milestone events, and important account alerts (such as deletion confirmation). We do not send commercial marketing push notifications unless you have separately opted in.

19. Cookies and tracking technologies

The SobrCircle mobile app does not use cookies. We use a device-level advertising identifier (IDFA on iOS, GAID on Android) only if Firebase Analytics is active and only if you have opted in (Section 5.2). You can reset or limit this identifier through your device settings at any time.

The SobrCircle website (sobrcircle.com) uses no third-party analytics, advertising, or tracking cookies. We set no persistent cookies beyond what is technically necessary to serve the site.

20. SobrCircle is not medical care

SobrCircle is a peer-support social community. It is not medical treatment, addiction therapy, clinical care, crisis intervention, or a substitute for professional health services. Content you encounter on SobrCircle reflects the personal experience of the user who shared it. It is not medical advice or clinical guidance.

If you are in crisis or immediate danger, contact emergency services (911 in Canada/US, 999 in the UK, 000 in Australia, 112 in the EU) or a crisis line: 9-8-8 Suicide Crisis Helpline in Canada (call or text 988); 988 Suicide & Crisis Lifeline in the US (call or text 988). Additional crisis resources are listed within the app.

Recovery meeting information shown in SobrCircle is provided by users and third-party directories. We cannot guarantee a meeting is taking place at the time and location shown. Always confirm directly with the meeting host before attending.

21. Changes to this policy

We may update this Privacy Policy. Material changes — those that expand what we collect, add a new category of third-party processor, or limit your rights — will be announced in the app and by email at least 30 days before they take effect. You may close your account before a material change takes effect if you do not agree.

Non-material changes (updated contact details, typographical corrections, clarifications that do not change our practices) take effect when published. The “Last updated” date at the top of this policy will always reflect the most recent change.

Archived versions of this policy are available on request by emailing [email protected].

22. Contact us and regulator escalation

For any privacy question, rights request, or concern, please contact our Privacy Officer first:

• Privacy Officer: Behnam Moradi
• Email: [email protected]
• Mail: Privacy Officer, Moradi Labs Inc., 1223 Enfield Ct, Windsor, ON, Canada N8S 4N1
• Response time: 30 calendar days (we commit to meeting or beating all applicable statutory deadlines)

If you are not satisfied with our response, you have the right to escalate to the relevant privacy regulator in your jurisdiction:

• Canada (federal): Office of the Privacy Commissioner of Canada — priv.gc.ca
• Quebec: Commission d’accès à l’information du Québec — cai.gouv.qc.ca
• British Columbia: Office of the Information & Privacy Commissioner for BC — oipc.bc.ca
• Alberta: Office of the Information and Privacy Commissioner of Alberta — oipc.ab.ca
• United States — California: California Attorney General — oag.ca.gov/privacy
• United States — other states: your state Attorney General’s office
• United Kingdom: Information Commissioner’s Office (ICO) — ico.org.uk
• EU member states: your national data protection authority (see edpb.europa.eu)
• Australia: Office of the Australian Information Commissioner (OAIC) — oaic.gov.au