Privacy Policy

Last updated: July 15, 2026 · Applies to the MyBattleBuddy Closed Beta

This policy explains, in plain language, what MyBattleBuddy collects, why, who it is shared with, how long it is kept, and the choices you have. We wrote it the way we built the product: your circle, your terms, your pact. If anything here is unclear, write to us at support@mybattlebuddy.ai.

Your circle. Your terms. Your pact. What you tell your Buddy is private, with one exception you explicitly agree to at signup: if the system believes your life may be in danger, it alerts the battle buddies you chose. Those alerts never contain your conversations, medications, moods, or safety-plan contents. They carry only the consented "reach out now" message and a link to acknowledge.

1. Who this policy covers

MyBattleBuddy ("MyBattleBuddy," "we," "us") is a support tool for United States veterans and the supporters they invite. This policy covers veterans who create an account, people invited to be a battle buddy, and anyone who joins our waitlist. The service is for adults 18 and older. It is not a healthcare provider, health plan, or medical record system, so it is not covered by HIPAA. Because it handles health-adjacent and crisis-related information, we hold ourselves to strong consumer-health privacy practices anyway.

2. What we collect

We collect only what the product needs to do its job. That falls into these groups:

• Account and security data: your name, email, and a securely hashed password (we never store your password itself). If you use two-factor authentication, we store an encrypted authenticator seed and hashed one-time recovery codes. We keep session records and basic sign-in metadata (device type, IP address, timestamps) to keep your account secure and let you manage your sessions.
• Profile: details you choose to provide, such as service branch, service era, and location fields (state, city, ZIP, and mailing address), plus an optional phone number. Location and contact fields help tailor support and, where you enable it, reach the right people.
• Care data you create: your medications (including any bottle or label photos you upload for reading), your check-ins and moods, your Action Plan (safety plan) entries, and your text and voice conversations with Buddy.
• Your battle-buddy roster: the names, roles, phone numbers, and email addresses of the people you add, their acceptance status, and an optional photo. You are responsible for adding only people who have agreed to the role.
• Crisis records: when an escalation fires, we keep an auditable record of the event, who was alerted, the timing of each step, and when a human acknowledged. This record is the core promise of the product.
• Product and technical logs: app and server logs and a private audit ledger of sensitive actions (sign-ins, security changes, crisis events). Phone numbers in logs are masked.
• Waitlist: if you join the waitlist, your email, optional name, your relationship to the mission (veteran, family, organization, or other), and where you signed up from.

3. Why we collect it, and our basis for doing so

We collect information to run the service you asked for and for no hidden purpose. Specifically:

• To create and secure your account, and to verify it is you.
• To provide the four pillars: daily structure, medication organization and reminders, the Battle Buddy network, and the crisis handoff.
• To operate the consented alert system when the safety layer indicates your life may be at risk.
• To keep the product working, diagnose problems, and prevent abuse.

Our basis for handling your information is your consent and the need to deliver the service you requested. Sensitive information, including anything health-related and the crisis exception, is handled with heightened care and is used only for the purposes above. We do not use your information for advertising, for training unrelated models, or to build a profile of you to sell.

4. What we never do

• We never sell your data. Not to advertisers, not to data brokers, not to anyone.
• We never share your conversations, medications, moods, or safety plan with your battle buddies. Buddies receive only the consented "reach out now" alert and a link to acknowledge. They never see what you told Buddy, your clinical details, or why the alert fired.
• Organization sponsors never see individual data. If an organization ever sponsors veteran access, it will receive aggregate adoption reporting only, subject to minimum group sizes, and never anything that identifies you or reveals your care. Your sponsor pays for it; your sponsor never sees inside it. (This is a standing commitment; sponsored access is not part of the current beta.)
• We never store recordings of your voice conversations. Audio is processed live to power the conversation and is not saved. See section 6.
• We never use your data for advertising or to sell you anything.

5. What Buddy remembers

So conversations feel continuous, Buddy keeps a short set of durable facts about you, for example that your brother lives in Tulsa or that you walk at 6 a.m. You can see and delete these at any time in the app, on the "What Buddy remembers" screen. By design, Buddy's long-term memory:

• never stores your medications, doses, or prescription details (the medication system handles those separately);
• never stores your moods of the moment ("rough night," "feeling low"); and
• never stores anything from a crisis or self-harm conversation. That content is handled only by the protected safety pipeline and is deliberately kept out of memory.

When you delete a remembered fact, it stops being used in every future conversation immediately.

6. Voice conversations

When you talk to Buddy by voice, your audio is streamed to our AI provider to power the live conversation. We do not record or store the audio. A text transcript of the session is saved into your Buddy chat thread so you have a written record, marked to show it was spoken. You can delete your chat history at any time. The same safety layer that watches text also watches voice, so the crisis handoff works whether you type or speak.

7. How artificial intelligence is used

MyBattleBuddy uses Google's Gemini AI, through the Gemini API, for:

• The Buddy companion: your text and voice conversations.
• Medication photo reading: extracting the details from bottle labels and prescription lists you photograph. Every reading is a draft that you review, correct, and approve before anything is saved. The AI never writes to your medication list on its own.
• Risk awareness: your conversations and check-ins pass through a safety layer (a deterministic word list plus an AI classifier) whose only job is the pact: connecting you to real humans when your life may be at risk. It is a signal, never a diagnosis, and it is never used for advertising or scoring.

To produce a response, we send Google the content needed for that request, and Google processes it as our service provider. AI can be wrong. Medication data is human-approved by design, and crisis handling always routes to humans (your buddies, the Veterans Crisis Line, 911). The AI is never the last line.

8. The crisis exception, and what an alert contains

The one exception to "what you tell Buddy is private" is the exception you agree to at signup: if the safety layer indicates your life may be in immediate danger, the system helps connect you to a real human and alerts the battle buddies you chose. This is a life-safety measure.

An alert to a buddy contains only the consented message asking them to reach out to you now, and a link they can open to acknowledge. It does not contain your conversation, your medications, your moods, your safety plan, or the words that triggered it. Internally, we keep an auditable crisis record (including a short trigger excerpt used only for our safety review) so we can show the handoff worked and improve it. That excerpt is never sent to a buddy.

9. Who we share your information with

We do not sell your data and we do not share it with advertisers. We use a small set of trusted service providers to run the product. Each receives only what its job requires:

The Twilio buddy-alert channel and the VA prescription connection are off by default in the beta. While the VA connection is off, the app does not mention or use any VA data. We may also disclose information if the law requires it, to protect someone's safety, or as part of a business transfer, in which case we will honor the commitments in this policy.

10. Where your data lives and how it is protected

Your data is stored in a dedicated Google Cloud project (Firestore and Cloud Storage, in the US, us-central1 region), isolated from any other product. Protections include:

• Encryption in transit and at rest.
• Passwords stored only as bcrypt hashes; two-factor seeds encrypted with a versioned key; recovery codes stored only as hashes.
• Two-factor authentication (TOTP) available on your account, with one-time recovery codes and account lockout after repeated failed sign-ins.
• Session records you can revoke, and re-authentication for sensitive actions.
• Restricted, least-privilege administrative access, with every sensitive action written to a private audit ledger.
• Uploaded photos served only through your authenticated session, never from a public link.

No system is perfectly secure, but we design for the sensitivity of what you trust us with.

11. How long we keep your information

We keep your account and care data for as long as your account is active, and then only as long as we need it. When you delete something in the app, it is removed from your active experience right away. When you ask us to delete your account, we complete verified deletion requests within 30 days, subject to the points below.

• Crisis and audit records may be retained longer than ordinary data, in a minimized form, because they document life-safety events and support our legal and safety obligations.
• Limited information may persist briefly in routine backups before it cycles out.
• We may keep the minimum needed to meet a legal requirement, resolve a dispute, or enforce our terms.

12. Your rights and choices

You are in control of your information:

• Edit or delete in the app, anytime: your medications, your battle buddies, your Action Plan, and your check-ins.
• Delete what Buddy remembers: the "What Buddy remembers" screen lets you remove any remembered fact. This is a live right today.
• Delete your chat history: you can clear your conversation history in the app. This is a live right today. (Your separately-controlled remembered facts are not affected by clearing chat, and can be deleted on their own screen.)
• Full account deletion or a copy of your data: during the closed beta this is one email away. Write to support@mybattlebuddy.ai and we will complete verified requests within 30 days. Self-serve export and deletion will ship before public launch.

You can also decline or remove optional information (such as your phone number or a buddy), turn off the buddy-alert channel, and manage two-factor settings. We will not deny you the core service, charge you differently, or retaliate for exercising a privacy right.

13. California and other US state privacy rights

Depending on where you live, you may have specific rights over your personal information, including the right to know what we collect, to access it, to correct it, and to delete it. You may also have rights over "sensitive personal information" and "consumer health data," which can include health-related information and precise location. MyBattleBuddy does not sell your personal information and does not share it for cross-context behavioral advertising, so there is nothing to opt out of on that front. We limit the use of sensitive information to providing and securing the service.

To exercise any of these rights, email support@mybattlebuddy.ai. We will verify your request through your account and respond within the time the law allows. You may use an authorized agent where the law permits, and we will not discriminate against you for making a request. This section is provided under laws such as the California Consumer Privacy Act (as amended) and comparable state consumer-health-data laws.

14. Age and children

MyBattleBuddy is intended only for adults 18 and older. It is not directed to children, and we do not knowingly collect information from anyone under 18. If we learn that a minor has created an account, we will delete it. If you believe a minor has used the service, contact support@mybattlebuddy.ai.

15. Changes to this policy, and how to reach us

We may update this policy as the product grows. If a change is material, we will notify account holders and update the date at the top. Continued use after an update means you accept the revised policy. Questions, privacy requests, or concerns: support@mybattlebuddy.ai.