bpOSBipolarOS

Privacy Policy

Effective 21 October 2026 · App Strategist LLC, Virginia, USA

This policy describes BipolarOS (“bpOS”), made by App Strategist LLC and published alongside The Bipolarist. It is written to be read rather than to be survived, and it describes what the software actually does today. Where something is designed but not yet shipped, it says so.

The short version: your device holds the record. If you use bpOS only on your own phone or browser, there is no account and no row of yours on any server of ours — not an empty one, not a hashed one. Two features are opt-in and involve a server, and they are described in full below.

1. Who we are

App Strategist LLC, a Virginia limited liability company, is the controller of any personal information described here. Contact: info@bipolaros.com.

2. You must be 18 or older

bpOS is for adults. We do not knowingly collect information from anyone under 18. If you believe a minor has created an account, write to us and we will delete it.

3. What we hold depends entirely on what you turn on

There are three arrangements. Find yours.

Local only — no account

Your states, logs, runbooks, journal entries, patterns, emergency contacts and settings are stored on your own device, by your browser or by the app. We hold nothing. There is no account, no identifier, and nothing of yours transmitted to us. Exporting your data produces a file on your device, by your own action.

Loop — opt-in, requires an account

The Loop lets up to three people you choose receive a content-free signal that you would like someone near. Turning it on creates an account and means we hold:

your email address and, if you enable text reminders, your phone number;
session and sign-in challenge records (secrets stored only as SHA-256 hashes, never raw);
the first names you give your Loop members, and the “how to show up” note you write about each of them;
a Loop member’s email address or phone number if they choose to receive notifications, with the time they consented;
your reminder schedule and time zone, if you enable reminders;
timestamps of check-in requests and responses — when, never what.

Your states, logs, journal entries and patterns are never sent to the Loop. Loop messages carry a first name, a fixed phrase, a tokenized link and opt-out language. Nothing about how you are doing is in them.

Loop members do not have accounts. They hold a link, and either side can revoke it at any time, which immediately invalidates every token for that member.

Encrypted sync — designed, not yet shipped

Backup and multi-device sync is planned and is not running today. When it ships, the design is end-to-end encrypted: a random key encrypts your record on your device and is itself wrapped under a key derived from your passphrase and under a recovery key you generate at setup. The passphrase and the derived key never leave your device, so what we store is a blob we cannot read, plus metadata about when a sync happened and how large it was. There is no escrow, no reset and no support path: losing both the passphrase and the recovery key loses the backup.

We will update this policy before that feature is enabled for anyone.

4. Usage counters

bpOS sends an anonymous daily tally — numbers like how many times the app was opened or how many runbooks were run — as a single {day, {event: count}} record once per day. There is no identifier, no session, no timestamp finer than a day and no content, and the server will only add small integers into per-day buckets. Crisis-path usage is never counted. If your browser sets navigator.doNotTrack, this is disabled entirely.

The marketing page at bipolaros.com carries Google Analytics. The app does not, and neither does this page.

5. Who else ever sees any of it

Who	What reaches them	Why
Twilio	A recipient phone number and the message body	To deliver Loop texts and your own reminders. Only if you enable texts.
Resend	A recipient email address and the message body	To deliver sign-in links, invitations and Loop email.
Opalstack	Whatever is stored server-side, as our host	Hosting. They do not use it.
Substack	Your subscription and payment details, held by them	The Bipolarist subscription. We never see your payment information.

That is the whole list. We do not sell your information, we do not share it for advertising, and we never use location — bpOS does not ask for it and the app is served with a policy that disables it outright.

6. How long we keep it, and what deletion means

Deleting your data deletes your account. There is no half-state where the account survives empty: the account record, Loop members and their tokens, signals and reminder schedules all go, and member links stop working the same way they do after an ordinary revocation.

Server backups are taken nightly and kept seven days, so a deleted record can persist in a backup for up to a week before aging out. We keep the window short on purpose — the data is small and largely reconstructible, and a longer window only keeps deleted contact details alive for no good reason.

One exception, named because a policy that hides it is worth less. If we are served with legal process, or have reason to believe litigation is coming, the law requires us to stop deleting what is relevant to it. Routine deletion then pauses for that data until the matter resolves. No law requires us to keep backups longer than seven days, and we do not.

7. What we can and cannot produce under legal process

Stated plainly, because the people using this deserve to know which it is.

Local only, no account: we hold nothing. There is nothing to produce.
Account, no sync: we can be compelled to produce your identity, your account lifetime, your Loop members’ names and contact details, your own notes about those people, and the dates check-ins were requested.
Encrypted sync, once it ships: all of the above, plus ciphertext we cannot read and metadata describing when a sync happened and how large it was.

One honest weakness, specific to the web. The same server that would store your ciphertext also serves the JavaScript that decrypts it. “We are incapable of producing plaintext” is true of data already stored and not true of data not yet entered: a sufficiently broad order could compel a modified bundle. The native app is materially stronger — it is signed, reviewed and not re-delivered on every visit. We do not claim otherwise, and anyone whose threat model includes a court order against us should prefer the app.

8. bpOS is not covered by HIPAA, and that matters

HIPAA binds health care providers, health plans and their business associates. A consumer app is none of those, and bpOS is not a HIPAA covered entity. The practical consequence is worth understanding: records your clinician holds are shielded by rules that do not protect records you keep yourself, and information you give a consumer app can be reachable by ordinary civil discovery in a way clinical records are not.

That asymmetry is the reason this product is built the way it is — the device holds the record, the server is told as little as possible, and the sections above tell you exactly what that “as little as possible” amounts to.

9. Security

On iOS: the database carries Data Protection, so it is encrypted at rest under a key tied to your device passcode, and it is excluded from iCloud backup.
On the web: browser storage has no application-layer encryption. Your protection is your device’s — OS account, disk encryption, browser profile. On the web, your device’s security is the app’s security.
You can require an unlock before anything but the crisis path. Where that setting appears, the app also tells you that biometrics are a convenience, not a second lock: US courts have split on whether a face or a thumb can be compelled where a passcode could not be.
Sign-in uses emailed links or one-time codes, never a password. Tokens are random, stored only as hashes, single-use where appropriate, and never written to logs.

Our full security model, including the threat model it is built against, is published at SECURITY.md.

10. Your rights

Export. Everything on your device, in one tap, as a file you keep.
Deletion. Delete your data and your account, from inside the app or by writing to us. Losing your passphrase never strands your data with us — you can still sign in by email or text and delete everything.
Access and correction. Write to us and we will tell you what we hold.
Withdraw consent. A Loop member can revoke their link at any time, from their own page, without asking you.

If you are a Washington, Nevada or Connecticut resident, additional rights apply to consumer health data and are described in our Consumer Health Data Privacy Policy.

11. Changes

If we change this policy in a way that affects what we collect or who receives it, we will say so in the app before the change takes effect, not only by revising this page. The effective date at the top always reflects the current version.

12. Contact

info@bipolaros.com · App Strategist LLC, Virginia, USA