Privacy Policy

1 Information We Collect

• Contact information: names, phone numbers, and email addresses of family members/contacts and Residents.
• Message content: the text of messages you send or receive through the Service, so we can relay it.
• Facility messaging account details: where our staff manages a facility messaging login on a Resident's behalf, the associated email and password (stored encrypted — see Section 6).
• Payment information: handled directly by Stripe; we receive only limited billing metadata (plan, status), never full card numbers.
• Usage data: basic technical logs (timestamps, delivery status, error logs) needed to operate and troubleshoot the Service.

2 How We Use Information

We use the information above to: operate the messaging relay between you and the Resident; manage your subscription and billing; provide customer support; detect and prevent abuse; and comply with legal obligations.

3 Federal Monitoring Disclosure

Messages relayed to or from a Resident pass through the facility's messaging system and are subject to review by Bureau of Prisons staff, independent of our own practices described here. See Section 7 of our Terms of Service.

4 Service Providers We Use

We share information with the following processors, only as needed to operate the Service:

• Twilio — sends and receives SMS and WhatsApp messages.
• Resend — sends and receives email.
• Cloudflare — routes incoming email and hosts infrastructure.
• Stripe — processes subscription payments.
• Supabase — hosts our database.
• OpenAI and Perplexity — power the optional STAR and COMET AI commands, and only receive the specific message content a Resident sends using those commands.

We do not sell your personal information.

5 SMS Consent & Data Sharing

6 Data Security

Facility messaging account passwords are encrypted at rest (AES-256-GCM) and are never stored or displayed in plain text. Access to production systems is restricted, and administrative actions require authentication. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

7 Data Retention

We retain account data — including alias mappings, contact lists, and message history — for twelve (12) months following the last successful payment or account cancellation. This window exists so that a customer who cancels and later returns can reactivate their account without losing their contact list or alias mapping. After 12 months of continuous inactivity without reactivation, account data is permanently deleted from our active systems, except where we are required to retain records longer for legal, tax, or billing purposes.

8 Your Choices

You can update your contact information or delete a contact at any time using the DELETE command or through our support team. You can opt out of SMS at any time by replying STOP. To request deletion of your account data, contact us at the address in Section 12.

9 Children's Privacy

The Service is intended for use by adults (18+) and is not directed at children. We do not knowingly collect personal information from children.

10 International Data

Some contacts and Residents' families are located outside the United States. By using the Service, you understand your information may be transferred to and processed in the United States, where our infrastructure and service providers operate.

11 Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be posted here with an updated effective date.

12 Contact

Questions about this Privacy Policy, or requests to access or delete your data — including reactivation requests within the retention window described in Section 7 — can be sent to [email protected].