Privacy Policy
Effective July 21, 2026
Recovery Garden is built so that your recovery stays yours. This policy is short because the app collects almost nothing.
Nothing. Recovery Garden has no accounts, no sign-in, no analytics, no advertising, and no tracking of any kind. We never receive, see, or store anything you write or do in the app.
Everything you write — your check-ins, your garden, your stars — is stored locally on your device, and nowhere else, unless you explicitly share it with a circle (below). If you delete the app, your local data is deleted with it. Your device's standard backup (such as iCloud device backup, controlled entirely by you and Apple) may include the app's data like any other app on your phone.
Your circle is the people you connect with individually. Each connection is exactly two people who exchanged an invite; there is no group that someone else can add members to. Connections are optional; the app never shares anything on its own, and nothing you write ever leaves your device unless you tap a share button after a check-in.
When you do choose to share, here is exactly what happens:
What travels. The kind of check-in (morning, afternoon, or evening), the calendar date, the name you chose for yourself (or nothing, if you left it blank), and — only if you tap "Send it with your words" — the answers you wrote for that one check-in. It travels once per connection, to each person you're connected with. Nothing else, and never automatically.
Where it goes. Shared days are stored in Apple's iCloud (CloudKit), subject to Apple's privacy policy. We operate no server of our own and cannot read what you share.
How it's protected. Every shared day is encrypted on your device before it leaves, using a key derived from that connection's invite. Each connection has its own key — what you send one person can never be read by another. The invite is never uploaded; treat it like a key, because it is one, and hand it to one person only.
How long it lasts. A shared day is visible for that calendar day. Afterward, your device deletes its own shared records from iCloud.
Ending a connection. You can end any connection at any time. Your device deletes the shares it sent to that person from iCloud, forgets the invite, and nothing more travels in either direction. Your other connections are unaffected, and no one is notified. What someone already saw while a share was visible cannot be unseen.
Who people are. Names are self-chosen, and any nickname you give a connection stays on your device. An invite connects two phones; it does not verify anyone's identity — exchange invites in person or over a channel you trust.
If you grant location permission, the app uses your approximate location once in a while to fetch local weather through Apple Weather (WeatherKit), so the sky in the app can match the sky outside. Your location is sent only to Apple's WeatherKit service, subject to Apple's privacy policy. It is never stored by the app and never sent to us or anyone else. Decline the permission and the app works fully, with fair weather.
Check-in reminders are scheduled locally on your device; no server is involved. If you have connections, Apple's push service delivers a silent signal when someone you're connected with shares, and your device — not a server — composes the notification you see. What they wrote is never included in a notification.
Recovery Garden is not directed at children under 13.
If this policy ever changes, the updated version will be posted at this address with a new effective date.
Questions: clay@stoppauseplay.com