Initial Effective Date: June 1, 2026  ·  Last updated:

Alanna Privacy Policy

This Privacy Policy describes what data we collect and how we handle your information when you use Alanna, including heyalanna.com, our web application, and our mobile applications for iOS and Android (together, the “Services”). Together with our Terms of Use, this Privacy Policy governs our legal relationship with you.

Alanna is operated by ALANNA APP LLC, a Florida limited liability company doing business as Alanna (“Alanna,” “we,” “us,” or “our”).

Key Points

Before we get into the detail, here is what matters most:

• Alanna is an AI emotional companion built for family caregivers. You mainly interact with Alanna by having conversations with our AI chatbot.
• We may collect and process sensitive information such as details about your health, your caregiving situation, your emotions, or your well-being, but only as much as necessary for the Services to work.
• We do not sell your personal information.
• We do not use your conversation content, health information, or emotional information for advertising or retargeting.
• With your optional consent, we may send you marketing communications by email. We do not send identifiable subscription or purchase conversion events to advertising platforms, and we do not provide subscriber lists for custom or lookalike audiences.
• We do not use your conversations to train AI models. Not ours, and not our AI provider’s.
• Automated systems check your messages for signs of crisis and for a narrow set of serious safety disclosures. In most cases nothing reaches a human. See “Automated Safety Systems” below, which explains exactly when a person may read part of a conversation.
• We process your information for the purposes described in this Privacy Policy. Where applicable law requires consent for a particular collection, use, or disclosure, we will obtain the required consent before engaging in that activity.
• Alanna is available only to users physically located in the United States who are 18 years of age or older.

Legal Compliance

We work to comply with applicable data protection and privacy laws in the jurisdictions where we operate, including:

• The California Consumer Privacy Act and California Privacy Rights Act, where applicable to us
• Washington’s My Health My Data Act, Nevada’s consumer health data law, and Connecticut’s Data Privacy Act. If you are a resident of Washington, Nevada, or Connecticut, please also review our separate Consumer Health Data Privacy Notice, linked on our homepage and in the app, which explains how we handle consumer health data
• Other applicable U.S. state comprehensive privacy laws
• The Federal Trade Commission Health Breach Notification Rule
• The Children’s Online Privacy Protection Act
• State laws governing AI companion systems, AI disclosure, and AI representations

We review and update these practices as laws and regulations evolve.

What Data Do We Collect?

Account Information

Your name, email address, and (if you choose to provide it) phone number, collected when you create an account. This also includes your account credentials and, where applicable, your subscription status.

We ask for your date of birth to confirm you are 18 or older. We do not store your date of birth. We store only an age range.

Conversation Data

The content of your conversations with Alanna, including anything you share about your caregiving situation, the person you care for, your emotions, your relationships, or your well-being. This may include sensitive health information about you.

A note about third parties in your conversations. Because Alanna is built for caregivers, you may naturally mention details about the person you care for. Please share only what you feel is necessary. We treat this information with the same protections as your own data, but you should be aware that you may be sharing information about another person.

Journal Data

If you use Alanna’s journal feature, we collect the content of your entries, any scheduled reminders you set, and calendar linking preferences. Journal entries are private to you and are not shared with other users or used for advertising.

Affirmation and Push Notification Data

Your notification preferences and delivery history for daily affirmations and conversation follow-ups.

Alanna Allies Data

If you participate in Alanna Allies, we collect your onboarding questionnaire responses (used to match you into a group), your posts and comments within your circle, and any moderation actions taken on your account. Your real name, email, phone number, and other identifying information are never displayed to other members. Posts and comments are visible only to members of your circle and to our moderation team.

Memory Notes

To help Alanna remember context between conversations, we generate a short internal summary of key facts, ongoing concerns, and emotional patterns from your conversations, for example your caregiving situation or what kinds of support tend to help you. This note is inferred by our AI systems, not written directly by you, and is used only to personalize future conversations. It is stored securely, treated with the same protections as your conversation data, and deleted in accordance with the Data Retention section below.

You can request a copy of your memory note at any time.

Safety Detection Data

See “Automated Safety Systems” below for how these systems work. What we record:

Crisis detection. When our system identifies language that may indicate risk of suicide, self-harm, disordered eating, or harm to another person, we record that a detection occurred, the category, whether we showed you crisis resources, which resources, and the time. We do not record the content of your message.

Safety disclosure flags. In a narrow set of circumstances described below, we record that a flag occurred, its category, and a short excerpt of the relevant message so that an authorized person can review it. Where no report is made, the excerpt is deleted within 30 days.

Payment and Transaction Information

When you purchase a subscription, we, our third-party payment processor, and the applicable app store collect information about the transaction, such as your subscription plan and status, purchase, renewal, cancellation and refund history, transaction identifiers, and billing status. We do not collect or store your full payment card number.

Platform Usage Data

Pages visited, session length, features used, links clicked, number of sessions, and general interaction patterns.

Log and Device Data

Your IP address, browser type and settings, device type, operating system, device identifiers, and the date and time of your requests.

Geolocation Data

General, approximate location only, such as city or region, derived from your IP address. We do not collect precise or GPS location.

Communication Information

If you contact us by email or through the app, we collect your name, contact information, and the contents of your message.

Automated Safety Systems

This section explains something most privacy policies leave vague, and we would rather be specific.

Two automated systems read your messages. Neither is a person, and neither diagnoses, scores, or rates you.

Crisis detection

Checks for language that may indicate risk of suicide, self-harm, disordered eating, or harm to another person. When it fires, Alanna surfaces crisis resources such as the 988 Suicide & Crisis Lifeline. No person is notified and no person reads your conversation. We record the flag, not your words. Our public crisis protocol page explains this in full.

Safety disclosure detection

Checks for a narrow set of explicit disclosures of serious harm to a child or a vulnerable adult — for example, disclosed sexual abuse of a minor, physical violence causing injury, financial exploitation of a vulnerable adult, or a stated intention to seriously harm a specific person.

This is a deliberately narrow set. Ordinary caregiver distress does not trigger it. Exhaustion, guilt, frustration, saying you lost your temper, saying you are frightened of your own capacity, worrying that you are not doing enough — none of that is flagged, and none of it is reviewed by a person. Alanna may offer you support resources in those moments, but nothing is escalated.

When this narrow set does fire, an authorized person reviews it. That review is limited by design: they see the flagged message and a small amount of surrounding conversation, and nothing else. They cannot search your other conversations, open a conversation that is not flagged, read your journal or memory notes, or export anything. They must record a written reason before the content is shown to them, and every access is permanently logged.

Why we do this. Florida law, and the law of many other states, requires a person who has reasonable cause to suspect abuse of a child or a vulnerable adult to report it. We would rather find those disclosures than not.

We will not tell you if a report is made. For some reports, federal law prohibits it. For others, notifying can put the person at risk in greater danger.

How We Use Your Information

We do not sell your personal information. We do not share your conversation data, memory notes, or health information with any third party for their own marketing or advertising purposes.

AI Training and Model Development

We do not use your conversations to train artificial intelligence models. Not our own, and not our AI provider’s.

Your conversations are sent to our AI provider only to generate a response to you in the moment. Under our agreement with them, that content is not used to train or improve their models.

We review anonymized, aggregate patterns, such as how often certain features are used or how our safety systems perform, in order to improve Alanna. This does not involve reading individual conversations.

If this ever changes, we will tell you clearly and ask for your consent first. We will not quietly begin training on your conversations.

Automated Decision-Making

Alanna uses large language models to generate personalized responses during your conversations.

How it works. When you send a message, our AI analyzes your input and generates a response, considering your conversation history, your memory notes, and your stated preferences.

Your control. You choose what to share. You can delete individual conversations or your entire history at any time, adjust your settings, or delete your account.

No high-impact decisions. Alanna does not make decisions that significantly affect your legal rights or other important matters. Alanna does not diagnose conditions, prescribe treatment, or make binding decisions on your behalf.

Data Disclosure to Third Parties

We disclose information to service providers that help us deliver Alanna. Service providers receive only information reasonably necessary to perform services on our behalf and are subject to contractual restrictions on their use of that information. We do not send identifiable subscription or purchase conversion events to advertising platforms.

You can ask us for the specific list of third parties your data has gone to, with contact information for each. See “Your Data Rights.”

Data Minimization

We disclose only information reasonably necessary for the applicable purpose. Our email provider receives your email address and related delivery information. Our AI provider receives only the conversation content and context needed to generate a response. Our payment processor and email provider are technically prevented from receiving conversation content, memory notes, journal entries, or safety detection data.

Business Transfers

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your information may be reviewed in the diligence process and transferred to the successor entity. We will notify you if your information becomes subject to a materially different privacy policy as a result.

Safety and Legal Disclosures

We may access, preserve, or disclose your information, including conversation content, where we believe in good faith that doing so is reasonably necessary to:

• Comply with applicable law, regulation, legal process, subpoena, or governmental request, including mandatory reporting obligations
• Enforce our Terms of Use or investigate potential violations
• Prevent or address an imminent risk of death or serious physical harm to any person
• Protect the safety, rights, or property of our users, our team, or the public
• Detect, prevent, or address fraud, security issues, or technical problems

Crisis and Emergency Situations

Alanna is not designed for crisis or emergency situations and is not a crisis service.

Alanna is an AI companion, not a licensed therapist, counselor, or medical provider, and cannot provide emergency support. If you are in crisis or thinking of harming yourself:

• Call or text 988 (Suicide & Crisis Lifeline), or chat at 988lifeline.org
• Text HOME to 741741 (Crisis Text Line)
• If you are in immediate danger, call 911

Our public crisis protocol page explains exactly what Alanna does when crisis language is detected, what she will never do, and what we record.

Internal Access

In ordinary operation, no one on our team reads your conversations. Our internal dashboard shows aggregate numbers only, such as total message volume and general engagement trends, and provides no way to open a conversation that has not been flagged, search across conversations, or export conversation content.

Authorized personnel may access specific conversation content only in the narrow circumstances described in “Automated Safety Systems” and “Safety and Legal Disclosures.” Every such access requires a recorded written reason and is permanently logged.

Alanna Allies is different: posts and comments in Allies circles are read by our moderation team as part of normal moderation. Your identity is never attached.

Tracking Technologies and Advertising

We use cookies and analytics tools on our website to understand how people find and use Alanna. We do not install advertising SDKs such as the Meta SDK or TikTok SDK in our mobile applications. We do not send identifiable subscription or purchase conversion events to advertising platforms.

We do not provide customer lists for custom or lookalike audiences. We do not use conversation content, memory notes, journal entries, caregiving information, health information, or emotional information for advertising.

If we later implement activity that requires permission under Apple’s App Tracking Transparency framework, we will request that permission first.

Cookies and Privacy Preference Signals

We use cookies on our website. We do not use cookies in our mobile applications. You can stop, restrict, or remove cookies through your browser settings, though parts of the Services may not work correctly if you do.

We recognize opt-out preference signals, including Global Privacy Control, and treat them as a request to opt out of any sale or sharing of personal information. Because we do not sell or share personal information and do not engage in targeted advertising, there is currently nothing for such a signal to stop. Browser “Do Not Track” signals are not a substitute for legally recognized privacy preference signals.

Your Responsibilities

Protect your account. Use a strong password, keep it private, and secure the device you use to access Alanna. If you share a device with the person you care for or with other family members, consider whether that affects what you are comfortable sharing.

Be thoughtful about third parties. Because Alanna is built for caregivers, you may share details about the person you care for. Share only what feels necessary.

Read the policies of anyone we link to. If you follow a link from Alanna to a crisis line, a support organization, or another resource, their privacy policy governs, not ours.

Check back on this policy. We will notify you of material changes, but we encourage you to review this policy periodically.

Our Security Framework

We implement technical, administrative, and organizational measures designed to protect your information, including:

• Encryption in transit using HTTPS with TLS
• Encryption at rest using AES-256
• Row Level Security, meaning each account’s data is walled off at the database level so one user’s records cannot be reached from another account
• Multi-factor authentication on all administrative accounts
• Permanent, tamper-resistant logging of any access to conversation content
• Password protection and secure credential management
• Regular review of our security practices

Error monitoring. Our error logs capture status codes and error names only. They do not capture message content, conversation text, email addresses, or account information.

No system is completely secure and no method of transmission over the internet is fully safe. We cannot guarantee absolute security, and you should use your judgment about what you choose to share.

Reporting a vulnerability. If you believe you have found a security issue in Alanna, please report it to us at heyalannaai@gmail.com.

Data Breach Notification

If we experience a breach of security or other unauthorized acquisition or disclosure of information for which notice is required, we will notify affected users, the Federal Trade Commission, state authorities, or other recipients as required by applicable law, including the FTC Health Breach Notification Rule. The timing, content, and method of notice will follow the requirements applicable to the incident.

So that we can reach you, we ask at signup whether email is your primary method of receiving important notices.

Data Retention

Active accounts. While your account is active, we retain:

• Account information: while your account is active
• Conversation history, journal entries, and memory notes: while your account is active, unless you delete them
• Usage and log data: up to 24 months from collection
• Support correspondence: up to 3 years from your last interaction
• Crisis detection records: flag, category, and timestamp only, retained for reporting and safety-system evaluation
• Safety disclosure flags: where no report is made, the excerpt is deleted within 30 days. Where a report is made, records are retained for 12 months, or longer where the law requires preservation
• Allies moderation records: for the lifetime of the account plus up to 12 months after deletion or removal, subject to legal preservation requirements and to the health data exception described below
• Consent and privacy-request records: limited records retained to document your choices and demonstrate compliance, even after other account data is deleted

Dormant accounts. If you do not sign in or use Alanna for 2 consecutive years, we will email you to ask whether you want to keep your account. If we do not hear back within 30 days, we will delete your account and all associated data.

Deleted accounts

When you delete your account:

• We delete your account information, conversation data, journal data, memory notes, and crisis detection records from our active systems within 30 days
• We notify every service provider and third party that has received your data and require them to delete it, within 30 days of that notice
• We delete your data from backup and archive systems within six months
• We keep a record that you asked us to delete, so we can show we honored it

If you are in a state with consumer health data rights and you exercise them, we delete or de-identify the content of any Allies moderation records about you, keeping only the date, category, action taken, and outcome — unless the law requires us to preserve the content.

Limited exceptions

In narrow circumstances we retain certain information even after deletion:

• Payment and transaction records, to meet tax, accounting, and audit obligations
• Information subject to a legal hold, subpoena, or ongoing legal or regulatory obligation, including federal preservation requirements that follow a report to a child protection authority
• Records documenting privacy requests, consent choices, and compliance with legal obligations
• Records of any report we made to a government agency under a mandatory reporting law

These exceptions do not include chatbot conversation content, journal entries, or memory notes in the ordinary course.

AI provider retention

Under our AI provider’s current standard commercial API retention policy, API inputs and outputs are generally deleted from its backend systems within 30 days. If its automated safety systems flag content as potentially violating its usage policy, the provider may retain that content for up to two years, and certain safety classification results for longer. These practices may change.

When you delete your account, we delete from our systems as described above and send deletion requests to our processors. We cannot independently delete information that our AI provider is permitted or required to retain on its own systems.

We do not use provider-retained safety data for advertising or marketing, and we do not receive or review it.

We are telling you this because you deserve an accurate picture rather than a comfortable one.

Your Data Rights

Depending on where you live, you have the following rights:

How to Exercise Your Rights

You can export your data and delete your account directly in Settings. For all other requests, contact us at heyalannaai@gmail.com.

Our Response Standard

We will respond within 45 calendar days. Where permitted and reasonably necessary, we may extend once by up to an additional 45 days, and we will tell you within the first 45 days if we do, along with the reason.

Verification

To protect your information, we may need to verify your identity before acting on a request. We will not require you to create a new account to exercise a right.

Authorized Agents

You may submit a request through an authorized agent. The agent must provide proof of authority to act on your behalf, and we may still ask you to verify your identity directly.

Appeals

If we deny your request, you may appeal by contacting heyalannaai@gmail.com with the subject line “Privacy Appeal.” We will respond in writing within 45 calendar days with our decision and the reasons for it.

If we deny your appeal, you may contact your state Attorney General:

• Washington: atg.wa.gov/file-complaint
• Nevada: ag.nv.gov/Complaints/File_Complaint/
• Connecticut: portal.ct.gov/ag/general/contact-the-attorney-general

Fees

Requests are free. If a request is manifestly unfounded, excessive, or repetitive, we may charge a reasonable administrative fee or decline, and we will tell you in advance and explain why.

Children’s Privacy

Alanna is intended exclusively for adults aged 18 or older and is not directed to anyone under 18. Companion chatbots may not be suitable for some minors.

We ask for your date of birth at signup to confirm you are an adult. We do not knowingly collect personal information from anyone under 18. If we learn that a user is under 18, we will close the account and delete the associated data.

Consistent with the Children’s Online Privacy Protection Act, we do not knowingly collect personal information from children under 13. If we learn we have collected information from a child under 13, we will delete it as quickly as possible and terminate the associated account.

If you believe a minor has provided us with information, contact us at heyalannaai@gmail.com.

Geographic Availability

Alanna is offered only to individuals physically located in the United States. By using Alanna, you represent that you are located in the United States. Your information is processed and stored on servers located in the United States.

Third-Party Links

Alanna may link to outside resources, including crisis lines and caregiver support organizations. Once you leave our Services, this Privacy Policy no longer applies. We do not control and are not responsible for the privacy practices of those organizations.

Changes to This Privacy Policy

We may update this Privacy Policy as Alanna evolves. When we do, we will post the updated version here with a new revision date. If the changes materially affect your rights, we will notify you by email or in-app notice.

If we ever want to collect a new category of information, or use your information for a new purpose, we will tell you and obtain your consent before we begin — not afterward.

If we make a change that affects information we already collected, we will give you a reasonable opportunity to withdraw your consent to any further processing of that information.

Contact Us

ALANNA APP LLC
13725 Beach Blvd Ste 3
Jacksonville, FL 32224
heyalannaai@gmail.com

Alanna is a general wellness tool. She is not a substitute for clinical care. If you are in crisis, call or text 988.

© 2026 ALANNA APP LLC. All rights reserved.