Your reasons
stay yours.

The current local profile keeps name, birth details, sobriety start, check-ins and optional mood or note in a device journal. Journey selection, reveals and completions use a separate owner-scoped local file. Selected avatar and cover photos are saved as resized JPEGs in a separate local photo store. Conversation history and selected companion memories have separate protected stores.

Local does not mean immune to device backups or loss. Some companion conversation and memory files are excluded from new backups after this version opens them; the core journal and photo store have different backup behavior. App deletion can remove local records, and Halo has no cross-device recovery service.

The current local app does not use a live Journey or Together server. Some optional connections do leave the phone: Apple Maps receives a birthplace search; a daily reading fetches a public feed from Sigastra without sending your selected sign; an older saved online portrait may load from its image host; and a development cloud companion reply uses the configured Halo gateway and OpenAI after a per-reply choice.

The website is separate. A waitlist email goes to Halo’s subscribe endpoint and Mailchimp. Reservation flows, when enabled, use Halo’s database and Stripe; reservation data details describe those fields and event identifiers. Hosting providers also receive ordinary connection information such as IP address.

Together currently runs as a synthetic local preview. It does not connect real friends across devices. Its proposed live contract describes minimal membership, consented presence, progress visibility and encouragement, but no production server or authorization has been qualified.

A friend should never automatically see a journal, photo, missed-day reason, emotional check-in, aspiration, companion memory or Support/SOS activity. Shared world, different private reasons: this is the boundary for a future connected version, not a current deployment claim.

The app uses Apple’s system photo picker for avatar and cover. You choose the images; Halo does not scan your library or perform face or family inference. It saves a normalized copy without the source photo’s location and camera metadata. You can replace or remove these copies in the profile controls.

Private Journey preparation, personal scene slots and photo placement in worlds are planned. Before asking intimate questions, Halo must let you skip, edit and remove answers. A shared scene can request a type of memory; the device should choose the actual photo or reflection locally. Limited Photos access, iCloud-only files, source deletion, backup and device migration still need device qualification for that future flow.

Local Spirit uses Apple’s on-device model when supported and available. There is no automatic cloud fallback. For a development cloud reply, the app asks for that reply and sends the current message, companion name and traits, recent check-in dates, streak and progress through Halo’s gateway to OpenAI. Earlier messages, saved companion memories and Your Context are excluded by the current cloud request builder, although your current message can contain whatever you type.

Separate development experiments can send Room messages and participant aliases for facilitator replies, or a species and style recipe for portrait generation, through the gateway to OpenAI when enabled. These pathways need their own release and consent review.

Some authored Journey scenes and the current share card use no AI. A future personalized Journey does not need to depend on AI availability. Remote model handling and provider retention need separate operational review before a production connected service.

Support/SOS is a local preview. Saving a signal does not contact another device or person. You may deliberately share an invitation link through iOS or tap a call link. A support person does not gain app access to your journal, photos, Journey preparation, check-ins or companion context by being chosen. The current preview cannot be relied on for emergency delivery.

The native app has no advertising, tracking or third-party analytics SDK in the inspected source. Apple diagnostics can depend on device settings. Optional daily invitations are local notifications with generic text; notification previews can still appear on a lock screen. When website reservations are enabled, allowlisted funnel events can record random visitor/attempt identifiers and may be linked to a reservation. They do not need recovery content.

Future Journey metrics must use event names and minimal counts, never reflection text, photo identifiers or private discoveries. Debug evidence and crash diagnostics require a separate release review.

The development Journey preview’s share image contains authored scenery, a companion still, Journey name and day. The preview shows the final composition before you choose a destination in the iOS share sheet. It does not include mood, note, sobriety date or check-in history. Halo attempts to remove its temporary export when the preview closes; a destination you choose can retain its copy.

Future personal images and reflections must be masked in exports by default. Including any one of them will require a specific choice and another exact preview. Today you can remove selected profile photos, edit or delete Your Context, and manage selected companion memories in their own screens. Forgetting a memory does not erase its original conversation or a prior remote request. Halo does not yet offer one control that erases every local Journey and companion record, and cannot recall an export already sent.

A production Together server, Journey preparation, personal scene slots, full deletion controls, cloud account migration, device backup behavior, provider operations and a formal App Store privacy disclosure remain to be completed and tested. No end-to-end encryption, anonymity, universal local-only processing or complete deletion guarantee is claimed here.

For privacy questions or a request about website information, write to hello@habithalo.com. For reservation information, see the reservation notice. A separate formal Privacy Policy will need review before app release.