Privacy policy
A.0 The short version
Be My Perspective connects people in 12-step recovery for a call. To do that it holds a first name, your program, a few matching choices, and a record of each call for 30 days so that you can report it. It never records calls, never asks for your email, phone number or birthdate, and sends nothing about you to advertisers or analytics companies. You can delete your account in the app at any time.
A.1 Who we are
Be My Perspective is operated by the developer ("we"). A contact address will be published here before the external beta (section A.17). Be My Perspective is not affiliated with, endorsed by or sponsored by Alcoholics Anonymous, Alcoholics Anonymous World Services, Inc., or any other fellowship named in the app.
A.2 What this policy covers
This policy covers the Be My Perspective app and the service behind it: the server that places calls, and the media server that carries them. It describes the app as it is now. Before we add a feature that collects anything new, we will change this policy first (section A.16).
During the beta. While Be My Perspective is tested through Apple's TestFlight, everything here applies, and section A.3.6 and section A.7 add what is particular to testing.
A word on health information. Using Be My Perspective at all says something about you: that you take part in a recovery program, or are close to someone who does. We treat everything we hold about you as sensitive for that reason, whether or not a particular law calls it health information.
A.3 What we collect, and why
A.3.1 When you sign up
| What | Why |
|---|---|
| A sign-in through Apple ("Sign in with Apple"). We ask Apple for nothing: no name and no email. Apple gives us an identifier for you that is specific to Be My Perspective; we keep only a scrambled form of it (a keyed hash), never the identifier itself | so that you can sign in again on a new phone, and so that a member who has been removed from the service cannot sign up again with the same Apple ID (section A.11) |
| An account number we make up at random, and a scrambled form of the sign-in key your phone keeps | to recognise your phone when it talks to our server |
| When the account was made | to keep the account record |
| That you confirmed you are 18 or older, and when | the app is for adults; we do not ask for your birthdate |
| Your program, chosen from a list | calls are between members of the same program |
| A first name. A nickname is just as good | it is what the other person sees on a call |
| Optional: your gender, and whether you want calls only with members of the same gender | matching, only if you choose to set it |
| Your languages. The app fills these in from your phone's language settings, and keeps them even if you skip the optional screen; you can change them | so that you are matched with someone who speaks a language you speak |
| Optional: the date you count your time from. This stays on your phone. The server receives only a yes or no: whether that date is a year or more ago | members with a year or more may answer calls from anyone in their program |
| A token from Apple that lets us cancel your Apple sign-in when you delete your account, stored encrypted | Apple requires apps to revoke the sign-in on deletion |
| Whether you have been stopped from answering calls, and until when, or removed from the service | so that the decision of section A.8 holds (sections A.8 and A.11) |
A.3.2 When you offer to answer calls
| What | Why |
|---|---|
| That you agreed to the helper guidelines, which version, and when | you must agree before you can answer (the guidelines are the ones shown in the app) |
| Whether you are available, until when, and a count of rings you missed in a row | to ring only people who are available, and to switch availability off after three missed rings in a row, so that a member asking for help is not waiting on someone who is away |
| When you last answered or declined a ring | so that an availability nobody has confirmed for a long time is not rung |
| A token from Apple that lets our server ring your phone (a push token) | to ring you |
| How many times you have been rung, how many of those became calls, and when your last call was | to see whether a few helpers are being rung far more than others, and, if a report is made about a helper, as context for reading it (section A.8). Never shown to anyone in the app |
A.3.3 When you ask for a call or take one
| What | Why |
|---|---|
| The request: who asked, who was rung, who answered, and the times | to place the call. The rings that were not answered are deleted as soon as someone answers |
| A list of people who just declined or missed your ring, for 10 minutes | so that they are not rung again at once |
| A key that encrypts the call's audio and video, made by our server for that one call and sent to the two phones | so that the media server carrying the call cannot hear or see it (section A.5). Cleared when the call ends |
| A record of the call: who called whom, when it connected and ended, and how it ended | so that either of you can report or block the other after the call. Kept for 30 days, longer only if a report names the call |
| A rating of the call, if you give one | an internal signal, folded into a count for that helper; never shown to anyone |
| The time offset of your phone, when you choose how long to be available | to work out "tonight" or "today". Used at once and not stored |
A.3.4 When you report or block
| What | Why |
|---|---|
| A report: who reported, who was reported, which call, the reason you chose from a list, what you wrote, when, and how it was settled | so that a person can read it and act (section A.8). Please do not write anyone's full name, address or phone number in a report; it is never needed |
| A block: who blocked whom, and when | so that the two of you are never connected again, in either direction. The other person is never told |
A.3.5 Counts we keep without names
Every hour the server writes counts: how many calls were asked for, answered, missed or dropped, how long answering took, how many helpers were available, by program and hour of day. These counts hold no account, name, location or device. With few members, a count for one program in one hour can stand for one person, so we treat the counts as internal and never publish them. Kept for 24 months.
The server also keeps a technical log of how each request moved from step to step, with timings and errors. It names requests, never people, places, call content or internet addresses. Kept for 14 days.
A.3.6 Beta feedback (test builds only)
Test builds have a feedback form. It sends what you write (up to 4,000 characters), the screen you were on, the app version and the day, not the time, and a way to contact you if you add one (up to 200 characters). It is linked to your account, so that the person who operates the service can see your first name and talk an issue through with you during the test; if you delete your account, that link is removed. Only the person who operates the service reads it, through a tool that records each reading. It is deleted when it has been dealt with, and after 90 days at the latest; a record that it was read and dealt with, with nothing you wrote, is kept 12 months. The form is not in the public app. What you write can name another member, so feedback is protected the way reports are. Please use Report, not feedback, for anything about how another member behaved.
A.3.7 What stays on your phone
Your sign-in key (in the phone's secure storage); the date you count from; a photo or a few words about yourself, if you add them; and a short list of your recent calls' reference numbers and times (no names), so that you can report or block after leaving the call screen. The list is kept as long as the server keeps the call record, 30 days, and is cleared when you sign out or delete your account. In test builds, the contact you last typed into the feedback form is remembered on the phone so that it is filled in next time; it is cleared when you sign out or delete your account.
A photo or the few words about yourself are shown only to the person you are connected with, during the call, and only if you have chosen to show them. They pass between the two phones for that call and are not stored on our server.
A.4 What we never collect
- Recordings of calls: no audio, no video, ever.
- Text sent during a call (when the app offers it): it lives on the two phones for the length of the call and is not stored anywhere.
- Your email address, phone number, birthdate, or home address.
- Your contacts, or anything from your address book.
- Your location. The app does not ask for it.
- Your internet (IP) address, beyond the moment it is needed to connect you (section A.12 states one exception that we turn on only to fix a fault).
- Apple's identifier for you in readable form, or any identifier Apple gives your device.
- Payment details of any kind.
- Anything about people who are not members.
A.5 Calls
Every call starts with audio only. Video is each person's own choice: turning your camera on never turns on the other person's.
Calls are not recorded. The service has no recording component, and our server never gives any phone or service permission to record. On top of that, audio and video are encrypted end to end with a key made for that call, so the media server that carries the call handles only scrambled data.
What that does not protect against, said plainly. Our server makes the key, so the encryption protects the call if the media software or the machine carrying it is ever compromised or misconfigured; it does not protect the call from us. What keeps us from recording is that no recording component exists and none is ever enabled. And the other person's own phone, or a second device in the room, can record you. The helper guidelines forbid it and it is a reason you can report, but the app cannot prevent it. Say only what you are comfortable saying to a stranger.
A.6 Who can see your information
- The person you are connected with sees your first name and, during the call, anything you choose to show: your camera, a photo or the words you added. A helper who is rung sees your first name. Nobody who was rung and not connected learns anything more.
- Nobody else in the app. There are no member lists, profiles, search or public pages. Nothing about you is published.
- The service. Our server uses what section A.3 lists to place calls, to keep the service working (A.3.2's counts, A.3.5), and to handle reports (A.8); for nothing else.
- The person who operates the service can reach the server and its database to keep it running. In the beta this is one person.
- The person who handles reports reads reports as section A.8 describes, through a tool that records every report read. In the beta this is the same one person.
- Apple (section A.7).
- Our hosting provider, Amazon Web Services, on whose machines the server runs (section A.7).
We do not sell your information, share it for advertising, or use it to track you across other companies' apps or websites.
A.7 The companies involved, and where your data is kept
Where it is kept. Our server, its database and its backups run in our own Amazon Web Services account, in the United States (the Ohio region). The database, the technical log and the backups are on encrypted storage. Nothing about you is copied outside that account. The one thing that leaves it is a count of unread reports, with nothing else, sent to the phone of the person who handles reports so that they know to look.
The software that carries calls (LiveKit) is open-source software that we run ourselves on our own server. No outside calling or messaging company handles your calls.
Apple is involved in four ways:
- Sign in with Apple. Apple knows that you use Be My Perspective. Apple's handling of your Apple ID is under Apple's own privacy policy.
- Ringing. To ring a helper's phone, our server sends Apple's push service the phone's push token and a message that carries a ring reference and the time the ring ends, nothing about anyone. The phone then fetches the caller's first name from our server directly. So Apple learns that a phone was rung, and when.
- The App Store and TestFlight. Apple handles downloads and, for test builds, the TestFlight program. If you test through TestFlight, Apple collects and shares with us what Apple's TestFlight terms describe: the email you were invited with and the name entered with it (not for a public link), your device model and a device identifier, system version and language, how often you opened the test build, crash counts and crash reports, and anything you send through TestFlight's own feedback (with battery level and screen resolution). Apple may keep crash and usage data until the faults are resolved. Apple states that it keeps TestFlight feedback for one year. Please use the app's own feedback form, not TestFlight's, for anything about a call.
- Crash reports, if you have chosen in your phone's settings to share analytics with app developers. That is Apple's system and your choice; the app contains no crash or analytics service of its own.
No analytics, advertising or tracking companies. The app contains none of their software, and our server sends them nothing.
A.8 Reports
You can report the other person after any call that connected, from the screen after the call or, for 30 days, from your recent calls.
- A person reads every report, within twelve hours, safety reports first. Reports are read only through a tool that records each reading. No automatic system decides anything from a report.
- What the reader sees: the reason and what you wrote; the call's times and how it ended; other reports about the same member in the last 12 months; reports you have filed; the helper's count of calls and their internal rating. What the reader does not see: your name or the other person's (unless you typed one), your program, your location, or anything said on the call, since nothing is recorded.
- The member you reported is never told that a report exists, who made it, or which call. If action is taken, they are told only that their account can no longer answer calls, or can no longer be used, and which guideline it concerns.
- You are told that the report was received. To protect everyone's privacy, you are not told what happens next.
- What can follow: nothing; a stop on answering calls; or removal from the service (section A.11). The terms of service describe this (section 7 of the terms of service).
- We cannot send help. We hold no number, address or location for anyone. If someone is in danger, use Urgent help in the app, or call 988 or 911 in the US.
- Reports are kept for 12 months after they are settled.
A.9 How long we keep it
| Information | Kept |
|---|---|
| Your account (section A.3.1 and A.3.2) | until you delete it |
| The scrambled form of your Apple identifier | with your account; after deletion only in the two cases of section A.10 |
| Whether you are available | only while it is current; overwritten |
| Your push token | until your phone replaces it or you delete your account |
| A request and its rings | the unanswered rings until someone answers; the request until you close it or 5 minutes after the call, whichever is first, then it becomes the call record or, if no call happened, is deleted |
| The 10-minute list | 10 minutes |
| The call record | 30 days; longer only while a report names the call |
| Your rating count and ring counts | with your account |
| Reports | 12 months after they are settled |
| Blocks | until the person who made the block removes it or deletes their account |
| Hourly counts (no names) | 24 months |
| The technical log (no names) | 14 days |
| A short list of deleted accounts' random numbers and of blocks made or removed, used only to re-apply deletions and blocks if we ever restore the database from a backup | 8 days |
| Backups of the database | see section A.10: up to 8 days after the data was deleted from the live database |
| Beta feedback (test builds) | until dealt with, at most 90 days; the record of its handling 12 months |
| Mail you send to the contact address, once there is one | 30 days after our answer |
A.10 Deleting your account
How. In the app: Settings, Delete my account, one confirmation. It takes effect at once.
What happens. In one step we delete your account, your availability, your push token, your rating and ring counts, the blocks you made, and anything in progress (a request is cancelled; a ring is declined). We ask Apple to revoke your Sign in with Apple authorization; if Apple's service cannot be reached, we delete your account anyway. Your phone then clears what the app kept on it.
What remains, and why. We say this plainly because you are entitled to know it.
- If another member blocked you, we keep the scrambled form of your Apple identifier with their block, for as long as their block stands, so that the block still applies if the same Apple ID signs up again. Nothing else about you is kept with it.
- If you were removed from the service (section A.11), the scrambled form of your Apple identifier stays on our list of removed accounts indefinitely, with nothing else.
- Call records that name your account run out on their own 30-day clock, and reports that name your account are kept for their 12 months. After deletion the account number in them points to nothing: we cannot tell from it who you were.
- The restore list. For 8 days we keep your account's random number on a short list, so that if we ever have to restore the database from a backup, your deletion is applied again rather than undone.
- Backups. Our backups are encrypted copies of the database, kept in the same account and region. A backup made before you deleted your account still contains it, until that backup expires: up to 8 days after your deletion. We do not use backups except to recover from a fault, and a recovery re-applies deletions. If a fault or a legal requirement ever made us keep a particular backup longer, the data in it would be kept longer too, and only for that purpose.
If you sign up again later with the same Apple ID, you start with a new, empty account, except that blocks other members made against you still apply, and a removal still applies.
If you revoke the app in your Apple ID settings, or delete your Apple ID, Apple tells our server, and we treat that as deleting your account, in the same way.
A.11 Removal from the service, and its limit
A member who breaks the guidelines in the ways the terms of service describe can be stopped from answering calls, or removed from the service. Removal is decided by a person, never automatically, and is permanent. When a member is removed, their account stops working at once; the account itself is replaced by the removal entry when they delete it, or 30 days after the removal, whichever is first.
The limit, in plain words: removal stops the same Apple ID. It does not stop a new Apple ID. We do not try to identify people beyond that, because doing so would mean collecting exactly what we promise not to.
A.12 How we protect it
- Everything between the app and our server is encrypted in transit; calls are also encrypted end to end (section A.5).
- The database, the technical log and the backups are on encrypted storage. The Apple revocation token is encrypted again inside the database, and the Apple identifier and your sign-in key are stored only as keyed or one-way hashes.
- Our server keeps no internet addresses. Its web front end logs requests without the client's address. The media server needs your address to carry the call while it lasts; it is set not to log it. The one exception: to diagnose a fault, the operator may turn on the media server's detailed log for a short session, and that log does include connection addresses. It is kept on the server, limited in size, and turned off again when the fault is found.
- Access to the server is limited to the person who operates it, by key, from known addresses. Reports are readable only through the reporting tool.
- No system is perfectly secure.
A.13 Your choices and rights
- See and change: your first name, program, languages, gender and same-gender choice, and availability are in the app's settings. Your blocks are listed in settings and you can remove any of them.
- Delete: in the app, at any time (section A.10).
- Ask us: once a contact address is published here, you can write to it about anything in this policy. Because we do not know who you are (no email, no phone number), we cannot look up an account from a letter, and we will not ask you to identify yourself to us.
A.14 Children
Be My Perspective is for adults. You must be 18 or older to use it, and you confirm that when you sign up. The app will be rated 18+ on the App Store. We do not knowingly hold information about anyone under 18.
A.15 Requests from courts and the police
We do not volunteer information about members to anyone. A legal demand is referred to our lawyer the same day. What we could provide is limited to what section A.3 lists: we hold no recordings, no email addresses, no phone numbers and no locations.
A.16 Changes to this policy
When this policy changes we will update the date at the top and, for a change that collects something new or uses something in a new way, tell you in the app before the change takes effect.
A.17 Contact
Contact: a contact address will be published here before the external beta. Operated by the developer.
Not yet in effect: beta draft of 2026-11-13.