Updated October 11, 2026 · Policy version 6
Coach Jeff is an AI companion, not a therapist, healthcare provider or emergency service. This policy explains what MyBFFCoach collects, how information is used, and your choices. Contact rusty@mybffcoach.com for access, correction, recovery or deletion help.
We store account identifiers (phone number, email and name), a protected password credential for older accounts, conversation messages, memories, and information you choose to put in My World. That can include health, relationships, military history, faith, political views, recovery and safety-plan information. We use it to operate your account, personalize conversations and support safety. We do not sell it or use it for advertising.
My World and its PIN credential are stored in our PostgreSQL database. The PIN is verified by the server; it is not a device-only password. The app may hold temporary profile data while open and stores sign-in credentials in protected native storage. Earlier app versions may have left local caches; account deletion attempts to clear them.
On iOS, CarPlay sign-in tokens are stored in Keychain. Web fallbacks use browser local storage, which is not encrypted by the app; do not use shared browsers for private information.
Twilio Verify receives your phone number and verification requests to send and check sign-in codes. We retain your verified phone number on your account and temporary verification records to prevent code reuse and abuse. We do not store the text-message code as an account password. Twilio processes delivery and security records under its privacy notice. New accounts use text-message codes; older accounts can connect a verified phone while keeping their existing data. If you lose access to that phone number, contact support for identity-verified recovery.
Before AI features start, we ask permission to send messages, relevant memories and permitted profile context to our AI providers. Inco runs DeepSeek for current backend replies and supporting memory processing. It receives safety-approved transcripts, permitted profile and memory context, recent conversation context and authorized tool results. Requests go to the selected model backend; provider account retention and training exclusions have not been independently verified. Anthropic supports configured alternatives. Google Gemini, Cerebras and OpenAI may support configured alternatives or supporting features. ElevenLabs supplies synthesized speech and, for earlier or configured managed phone and CarPlay calls, orchestrates conversational replies through its AI model providers. Those managed calls send ElevenLabs safety-approved transcripts, permitted profile and memory context, recent conversation context and authorized tool results; the backend retains safety checks and control of saved records. Backend-mediated phone and CarPlay conversations use the shared backend with Deepgram for speech recognition and Google Gemini for transcription and uncertain tone cues only during crisis mode. These cues are model guesses, not clinical assessments; they do not determine or reduce the app’s crisis response. The app uses them for the current turn and does not save them to your account or include them in app logs or analytics. Transcripts and permitted memories are saved to your account. Configured backend alternatives use Anthropic for responses. Legacy voice paths may also use an ElevenLabs-hosted agent and its model providers, including Anthropic. OpenAI may process dictation and photos that you explicitly choose to scan. Search queries may go to Tavily for current news and places. Configured legacy news searches may send your search terms to The Guardian or NewsAPI.
Earlier or configured direct native phone and CarPlay calls send microphone audio to ElevenLabs for speech recognition, turn taking, conversational replies and speech through its AI model providers. These calls share permitted profile and memory context, recent conversation context and authorized tool results. Provider generation and audio can start before the backend receives a transcript and checks distress; provider safety checks can miss or interrupt responses. The backend retains authorization and control of saved records, and can pause live capture for fixed supportive speech followed by a fresh support call. Native post-call transcripts are sent to the backend on an authenticated webhook for bounded history recovery. Other backend-mediated voice routes retain their existing speech-recognition and safety sequence. Recording, retention, security and training protections depend on the provider account and its settings; provider deletion may be delayed and training exclusion has not been verified for the current account.
Typed My World medical diagnoses, medications, healthcare records, therapist session notes and relapse-history fields are excluded from profile context sent to AI. If you say or type health information in a conversation, that message is processed by AI like other messages. The optional medication scanner sends the selected image to OpenAI to read its label; entering the form manually does not send those fields to AI.
Providers process submitted information under their service terms and retention settings. Retention can include security and abuse-monitoring records. We do not promise immediate erasure of every provider log. Google data-use protections depend on the service plan; the linked terms explain these differences. We may review conversations for quality and safety; this is not live crisis monitoring.
Typed medical and wellness fields, therapist session notes and relapse details are excluded from profile context sent to conversation models. If you choose Pill-Bottle Scan, the photo is sent to OpenAI to read its label. Health information you say or type in a conversation is processed as conversation content under your AI consent.
We may review conversations to see how Coach Jeff is doing — how he talks with people, whether his responses are safe, whether he follows his rules, and how he handles crisis moments.
Voice is optional. After you accept the updated voice disclosure, microphone audio is transmitted for speech recognition, uncertain temporary tone cues and voice conversation. Existing users must review fresh consent for this change; declining voice keeps text available after completing the required privacy choices. We do not use it to identify you biometrically or sell a voiceprint. You can use text instead. Voice providers may retain call recordings; linked ElevenLabs conversations are included in account deletion.
With separate Apple Health permission, the iOS app can read heart rate. A heart-rate value may be shared in enabled voice context to support the interaction. It is not a diagnosis, emergency detector or medical measurement service. You can deny or revoke Health access in iOS. We do not use HealthKit data for advertising or marketing.
Contacts access lets you choose Battle Buddies; selected names and contact details are saved in your profile. Optional location lookup lets you save a city or area for local search. With separate explicit opt-in, precise live location shares your current city, coordinates, observation time and accuracy with our backend while the app is open or a call is active, including supported unified CarPlay calls. Existing city-only permission remains city-only until you opt into precise sharing. iOS and Apple Maps use your position for nearby-place searches; Coach Jeff receives city context, place results and calculated approximate straight-line distances, rather than your coordinates in ordinary conversation prompts. Coordinates stay in temporary session memory; precise samples are used for up to one minute and city context for up to five minutes. Sharing stops outside those sessions. City names, place addresses and distances may appear in saved conversation answers. Other web/news search providers receive city-level queries. Turn off live location sharing in Mission Control or revoke location permission in iOS Settings. We do not request Always Allow tracking. Manual city entry remains available. Camera/photo access supports user-selected scans and profile images. You can enter information manually where offered. Apple manages permission settings.
Render hosts our service and PostgreSQL data. Cloudflare R2 may hold encrypted backups, and legacy Upstash records remain subject to migration and deletion handling. Network connections use encryption. No system is risk-free.
Apple handles App Store payments. We retain transaction identifiers, subscription tier and entitlement status to verify access and restore purchases; we do not receive your payment-card details. Trial-code claims link a single-use Apple offer to your account to prevent code reuse. Account deletion removes that link while retaining a deidentified record that the code was claimed. Device/push identifiers support notifications. Usage events help operate the service. Firebase analytics and Sentry diagnostics may collect interactions, crash and performance information; diagnostic handling aims to exclude direct personal identifiers and message content.
Account data and conversation history are retained while your account is open unless removed through an available control. Delete My Account in Mission Control (Settings) closes access and requests deletion of account data, linked recordings and backups. Cleanup can continue after sign-out. Keep the deletion receipt on the sign-in screen and use Check deletion status to see whether cleanup is pending or complete. Failed provider cleanup is retried; it is not reported as complete.
We retain a non-content account-generation hash to prevent old credentials or delayed callbacks from recreating a deleted account. A limited deletion record and necessary provider identifiers are retained to finish cleanup and report status. Provider identifiers and the account identifier in that job are removed when cleanup completes. Independent provider security/abuse records may remain subject to their terms.
Deleting the app alone does not delete your account. Deleting your account does not cancel Apple subscription billing: manage your subscription with Apple. You can request immediate account deletion without first cancelling. Password reset uses your recovery email. If you have an older phone-only account or cannot access that email, contact support for identity-verified recovery; never send your password.
Coach Jeff is for adults aged 18 or older. AI can make mistakes and miss distress. Safety behavior differs between phone and CarPlay; neither is an emergency service. In a crisis, Dial 988 then Press 1 for the Veterans Crisis Line. In immediate danger, call 911.
We may keep limited safety-event metadata and review conversations for safety and quality. Material changes to AI sharing require updated in-app consent. Privacy requests and questions: rusty@mybffcoach.com.
For account-linked usage analytics, we record your name, email address when supplied, platform, session duration, message counts and screens used. These records are not anonymous. Session analytics and daily activity records expire automatically after 90 days; registration records and longer-lived indexes remain until account deletion.