Initial Effective Date: September 1, 2026  ·  Last updated: October 14, 2026

Alanna Privacy Policy

This Privacy Policy describes what data we collect and how we handle your information when you use Alanna, including alannaapp.com, our web application, and our mobile applications for iOS and Android (together, the “Services”). Together with our Terms of Use, this Privacy Policy governs our legal relationship with you.

Alanna is operated by ALANNA APP LLC, a Florida limited liability company doing business as Alanna (“Alanna,” “we,” “us,” or “our”).

Key Points

Before we get into the detail, here is what matters most:

• Alanna is an AI emotional companion built for family caregivers. You mainly interact with Alanna by having conversations with our AI chatbot.
• We may collect and process sensitive information such as details about your health, your caregiving situation, your emotions, or your well-being, but only as much as necessary for the Services to work.
• We do not sell your personal information.
• We do not use your conversation content, health information, or emotional information for advertising or retargeting.
• Our public website, alannaapp.com, uses cookies and analytics tools, including to measure and show ads for Alanna. They are never used inside the Alanna app and never receive your conversations, journal, or health information.
• With your optional consent, we may send you marketing communications by email. We do not send identifiable subscription or purchase conversion events to advertising platforms, and we do not provide subscriber lists for custom or lookalike audiences.
• We do not use your conversations to train AI models. Not ours, and not our AI provider’s.
• Automated systems check your messages for signs of crisis and for a narrow set of serious safety disclosures. In most cases nothing reaches a human. See “Automated Safety Systems” below, which explains exactly when a person may read part of a conversation.
• We process your information for the purposes described in this Privacy Policy. Where applicable law requires consent for a particular collection, use, or disclosure, we will obtain the required consent before engaging in that activity.
• Alanna is available only to users physically located in the United States who are 18 years of age or older.

Legal Compliance

We work to comply with applicable data protection and privacy laws in the jurisdictions where we operate, including:

• The California Consumer Privacy Act and California Privacy Rights Act, where applicable to us
• Washington’s My Health My Data Act, Nevada’s consumer health data law, and Connecticut’s Data Privacy Act. If you are a resident of Washington, Nevada, or Connecticut, please also review our separate Consumer Health Data Privacy Notice, linked on our homepage and in the app, which explains how we handle consumer health data
• Other applicable U.S. state comprehensive privacy laws
• The Federal Trade Commission Health Breach Notification Rule
• The Children’s Online Privacy Protection Act
• State laws governing AI companion systems, AI disclosure, and AI representations

We review and update these practices as laws and regulations evolve.

What Data Do We Collect?

Account Information

Your name, email address, and (if you choose to provide it) phone number, collected when you create an account. This also includes your account credentials and, where applicable, your subscription status.

We ask for your date of birth to confirm you are 18 or older. We do not store your date of birth. We store only an age range.

Where You Are in Your Caregiving

When you set up your account, you tell us where you are: caring for someone now, your caregiving has ended, or the person you cared for has died. You can change this at any time in Settings.

If something you say in a conversation suggests this has changed, Alanna may ask whether you want it updated. She will never change it on her own. Nothing changes unless you confirm it, and we record your confirmation the same way we record your other consents.

Conversation Data

The content of your conversations with Alanna, including anything you share about your caregiving situation, the person you care for, your emotions, your relationships, or your well-being. This may include sensitive health information about you.

A note about third parties in your conversations. Because Alanna is built for caregivers, you may naturally mention details about the person you care for. Please share only what you feel is necessary. We treat this information with the same protections as your own data, but you should be aware that you may be sharing information about another person.

Journal Data

If you use Alanna’s journal feature, we collect the content of your entries, any scheduled reminders you set, and calendar linking preferences. Journal entries are private to you and are not shared with other users or used for advertising.

Affirmation and Push Notification Data

Your notification preferences and delivery history for the notifications you turn on in Settings: daily or weekly reminders, a check-in after an appointment you added to your journal, and a check-in the day after Alanna showed you crisis support. Each is off unless you turn it on. A notification never says why it was sent and never names an appointment.

We also record which affirmations you keep. We use that, along with the feelings you selected when you set up your account, to choose which affirmations to show you next. This stays inside your account. It is never shared and never used for advertising.

Alanna Allies Data

If you participate in Alanna Allies, we collect your onboarding questionnaire responses (used to match you into a group), your posts and comments within your circle, and any moderation actions taken on your account. Your real name, email, phone number, and other identifying information are never displayed to other members. Posts and comments are visible only to members of your circle and to our moderation team.

Memory Notes

To help Alanna remember context between conversations, we generate a short internal summary of key facts, ongoing concerns, and emotional patterns from your conversations, for example your caregiving situation or what kinds of support tend to help you. This note is inferred by our AI systems, not written directly by you, and is used only to personalize future conversations. It is stored securely, treated with the same protections as your conversation data, and deleted in accordance with the Data Retention section below.

You can see your memory note in Settings under “What Alanna remembers” and ask us to correct it. If you ask Alanna to remember something, it is added to the note. If you ask her to forget something, or tell her something was a test, it is removed. Nothing you write in a message where Alanna shows you crisis support, and nothing she says in reply, is ever saved to the note.

Safety Detection Data

See “Automated Safety Systems” below for how these systems work. What we record:

Crisis detection. When our system identifies language that may indicate risk of suicide, self-harm, disordered eating, or harm to another person, we record that a detection occurred, the category, whether we showed you crisis resources, which resources, and the time. We do not record the content of your message.

Safety disclosure flags. In a narrow set of circumstances described below, we record that a flag occurred, its category, and a short excerpt of the relevant message so that an authorized person can review it. Where no report is made, the excerpt is deleted within 30 days.

Payment and Transaction Information

When you purchase a subscription, we, our third-party payment processor, and the applicable app store collect information about the transaction, such as your subscription plan and status, purchase, renewal, cancellation and refund history, transaction identifiers, and billing status. We do not collect or store your full payment card number.

Platform Usage Data

Pages visited, session length, features used, links clicked, number of sessions, and general interaction patterns.

Log and Device Data

Your IP address, browser type and settings, device type, operating system, device identifiers, and the date and time of your requests. If you turn on notifications, we also store a notification token for your device, a random identifier that lets us deliver the notifications you chose. If you turn notifications off or delete your account, we delete it.

Geolocation Data

In the Alanna app, we do not collect your location. Our hosting provider’s logs include your IP address, which can indicate a general area, but we do not derive or store a location from it. On our public website, our analytics and advertising tools may estimate a general location, such as city or state, from your IP address. We do not collect precise or GPS location anywhere.

Communication Information

If you contact us by email or through the app, we collect your name, contact information, and the contents of your message.

Reports About Alanna’s Replies

If you report one of Alanna’s replies, we store a copy of that reply, the reason you chose, and any note you add, so our team can review it. We never store the rest of your conversation with the report, and never your own messages. The alert our team receives contains no conversation content. We keep a report for 90 days after it has been reviewed, and then delete it.

Automated Safety Systems

This section explains something most privacy policies leave vague, and we would rather be specific.

Two automated systems read your messages. Neither is a person, and neither diagnoses, scores, or rates you.

Crisis detection

Checks for language that may indicate risk of suicide, self-harm, disordered eating, or harm to another person. When it fires, Alanna surfaces crisis resources such as the 988 Suicide & Crisis Lifeline. No person is notified and no person reads your conversation. We record the flag, not your words. Our public crisis protocol page explains this in full.

Safety disclosure detection

Checks for a narrow set of explicit disclosures of serious harm to a child or a vulnerable adult, for example, disclosed sexual abuse of a minor, physical violence causing injury, financial exploitation of a vulnerable adult, or a stated intention to seriously harm a specific person.

This is a deliberately narrow set. Ordinary caregiver distress does not trigger it. Exhaustion, guilt, frustration, saying you lost your temper, saying you are frightened of your own capacity, worrying that you are not doing enough, none of that is flagged, and none of it is reviewed by a person. Alanna will respond with extra care in those moments, but nothing is escalated.

When this narrow set does fire, an authorized person reviews it. That review is limited by design: they see the flagged message and a small amount of surrounding conversation, and nothing else. They cannot search your other conversations, open a conversation that is not flagged, read your journal or memory notes, or export anything. They must record a written reason before the content is shown to them, and every access is permanently logged.

Why we do this. Florida law, and the law of many other states, requires a person who has reasonable cause to suspect abuse of a child or a vulnerable adult to report it. We would rather find those disclosures than not.

We will not tell you if a report is made. For some reports, federal law prohibits it. For others, notifying can put the person at risk in greater danger.

How We Use Your Information

We do not sell your personal information. We do not share your conversation data, memory notes, or health information with any third party for their own marketing or advertising purposes.

AI Training and Model Development

We do not use your conversations to train artificial intelligence models. Not our own, and not our AI provider’s.

Your conversations are sent to our AI provider only to generate a response to you in the moment. Under our agreement with them, that content is not used to train or improve their models.

We review anonymized, aggregate patterns, such as how often certain features are used or how our safety systems perform, in order to improve Alanna. This does not involve reading individual conversations.

If this ever changes, we will tell you clearly and ask for your consent first. We will not quietly begin training on your conversations.

Automated Decision-Making

Alanna uses large language models to generate personalized responses during your conversations.

How it works. When you send a message, our AI analyzes your input and generates a response, considering your conversation history, your memory notes, and your stated preferences.

Your control. You choose what to share. You can delete individual conversations or your entire history at any time, adjust your settings, or delete your account.

No high-impact decisions. Alanna does not make decisions that significantly affect your legal rights or other important matters. Alanna does not diagnose conditions, prescribe treatment, or make binding decisions on your behalf.

Data Disclosure to Third Parties

We disclose information to service providers that help us deliver Alanna. Service providers receive only information reasonably necessary to perform services on our behalf and are subject to contractual restrictions on their use of that information. We do not send identifiable subscription or purchase conversion events to advertising platforms.

You can ask us for the specific list of third parties your data has gone to, with contact information for each. See “Your Data Rights.”

Data Minimization

We disclose only information reasonably necessary for the applicable purpose. Our email provider receives your email address and related delivery information. Our transactional email provider also receives your first name so emails can greet you. Our AI provider receives only the conversation content and context needed to generate a response. Our payment processor and our email providers are technically prevented from receiving conversation content, memory notes, journal entries, or safety detection data.

Business Transfers

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your information may be reviewed in the diligence process and transferred to the successor entity. We will notify you if your information becomes subject to a materially different privacy policy as a result.

Safety and Legal Disclosures

We may access, preserve, or disclose your information, including conversation content, where we believe in good faith that doing so is reasonably necessary to:

• Comply with applicable law, regulation, legal process, subpoena, or governmental request, including mandatory reporting obligations
• Enforce our Terms of Use or investigate potential violations
• Prevent or address an imminent risk of death or serious physical harm to any person
• Protect the safety, rights, or property of our users, our team, or the public
• Detect, prevent, or address fraud, security issues, or technical problems

Crisis and Emergency Situations

Alanna is not designed for crisis or emergency situations and is not a crisis service.

Alanna is an AI companion, not a licensed therapist, counselor, or medical provider, and cannot provide emergency support. If you are in crisis or thinking of harming yourself:

• Call or text 988 (Suicide & Crisis Lifeline), or chat at 988lifeline.org
• Text HOME to 741741 (Crisis Text Line)
• If you are in immediate danger, call 911

Our public crisis protocol page explains exactly what Alanna does when crisis language is detected, what she will never do, and what we record.

Internal Access

In ordinary operation, no one on our team reads your conversations. Our internal dashboard shows aggregate numbers only, such as total message volume and general engagement trends, and provides no way to open a conversation that has not been flagged, search across conversations, or export conversation content.

Authorized personnel may access specific conversation content only in the narrow circumstances described in “Automated Safety Systems” and “Safety and Legal Disclosures.” Every such access requires a recorded written reason and is permanently logged.

Alanna Allies is different: posts and comments in Allies circles are read by our moderation team as part of normal moderation. Your identity is never attached.

Tracking Technologies and Advertising

We use cookies, pixels, and similar tools to understand how people find and use the site, to measure our marketing, and to show ads for Alanna on other websites and platforms. These tools may collect your IP address, device and browser information, the pages you visit, and the links you click on our website. They are not used inside the Alanna app or web application, and they never receive conversation content, memory notes, journal entries, or anything you tell Alanna. We do not install advertising SDKs such as the Meta SDK or TikTok SDK in our mobile applications. We do not send identifiable subscription or purchase conversion events to advertising platforms.

We do not provide customer lists for custom or lookalike audiences. We do not use conversation content, memory notes, journal entries, caregiving information, health information, or emotional information for advertising.

If we later implement activity that requires permission under Apple’s App Tracking Transparency framework, we will request that permission first.

Cookies and Privacy Preference Signals

Our public website uses cookies, including analytics cookies and advertising cookies. You can turn off advertising cookies through the cookie settings link on our website, and you can stop, restrict, or remove cookies through your browser settings. Our mobile applications do not use cookies. Our web application keeps you signed in by storing your session in your browser. You can clear it in your browser settings, and you will then need to sign in again.

We recognize opt-out preference signals, including Global Privacy Control. If your browser sends one, we treat it as a request to opt out of advertising cookies and of any sharing of your personal information for targeted advertising, and we apply it automatically on our website. Browser “Do Not Track” signals are not a substitute for legally recognized privacy preference signals.

Your Responsibilities

• Protect your account. Use a strong password, keep it private, and secure the device you use to access Alanna. If you share a device with the person you care for or with other family members, consider whether that affects what you are comfortable sharing.
• Be thoughtful about third parties. Because Alanna is built for caregivers, you may share details about the person you care for. Share only what feels necessary.
• Read the policies of anyone we link to. If you follow a link from Alanna to a crisis line or another outside site, their privacy policy governs, not ours.
• Check back on this policy. We will notify you of material changes, but we encourage you to review this policy periodically.

Our Security Framework

We implement technical, administrative, and organizational measures designed to protect your information, including:

• Encryption in transit using HTTPS with TLS
• Encryption at rest using AES-256
• Row Level Security, meaning each account’s data is walled off at the database level so one user’s records cannot be reached from another account
• Multi-factor authentication on all administrative accounts
• Permanent, tamper-resistant logging of any access to conversation content
• Password protection and secure credential management
• Regular review of our security practices
• Error monitoring. Our error logs capture status codes and error names only. They do not capture message content, conversation text, email addresses, or account information.

No system is completely secure and no method of transmission over the internet is fully safe. We cannot guarantee absolute security, and you should use your judgment about what you choose to share.

Reporting a vulnerability. If you believe you have found a security issue in Alanna, please report it to us at hello@alannaapp.com.

Data Breach Notification

If we experience a breach of security or other unauthorized acquisition or disclosure of information for which notice is required, we will notify affected users, the Federal Trade Commission, state authorities, or other recipients as required by applicable law, including the FTC Health Breach Notification Rule. The timing, content, and method of notice will follow the requirements applicable to the incident.

So that we can reach you, we ask at signup whether email is your primary method of receiving important notices.

Data Retention

Active accounts. While your account is active, we retain:

• Account information: while your account is active
• Conversation history, journal entries, and memory notes: while your account is active, unless you delete them
• Usage and log data: up to 24 months from collection
• Support correspondence: up to 3 years from your last interaction
• Crisis detection records: flag, category, and timestamp only, retained for 36 months for reporting and safety-system evaluation, and used to send a next-day check-in only if you turned it on in Settings
• Safety disclosure flags: where no report is made, the excerpt is deleted within 30 days. Where a report is made, records are retained for 12 months, or longer where the law requires preservation
• Allies moderation records: for the lifetime of the account plus up to 12 months after deletion or removal, subject to legal preservation requirements and to the health data exception described below
• Consent and privacy-request records: limited records retained to document your choices and demonstrate compliance, even after other account data is deleted

Dormant accounts. If you do not have an active paid subscription and you do not sign in or use Alanna for 2 consecutive years, we will email you to let you know your account will be deleted in 30 days unless you sign in. If you do not sign in within those 30 days, we will delete your account and all associated data and email you to confirm. This also applies to accounts where signup was never finished.

Deleted accounts

When you delete your account:

• We delete your account information, conversation data, journal data, memory notes, and crisis detection records from our active systems within 30 days
• We notify every service provider and third party that has received your data and require them to delete it, within 30 days of that notice, other than a report we were required by law to make to a government agency or child protection authority
• We delete your data from backup and archive systems within six months
• We keep a record that you asked us to delete, so we can show we honored it

Before you delete your account, you can download your data from the deletion screen. Once your data has been deleted, there is nothing left for us to export.

If you are in a state with consumer health data rights and you exercise them, we delete or de-identify the content of any Allies moderation records about you, keeping only the date, category, action taken, and outcome, unless the law requires us to preserve the content.

Limited exceptions

In narrow circumstances we retain certain information even after deletion:

• Payment and transaction records, to meet tax, accounting, and audit obligations
• Information subject to a legal hold, subpoena, or ongoing legal or regulatory obligation, including federal preservation requirements that follow a report to a child protection authority
• Records documenting privacy requests, consent choices, and compliance with legal obligations
• Records of any report we made to a government agency under a mandatory reporting law

These exceptions do not include chatbot conversation content, journal entries, or memory notes in the ordinary course.

AI provider retention

Under our AI provider’s current standard commercial API retention policy, API inputs and outputs are generally deleted from its backend systems within 30 days. If its automated safety systems flag content as potentially violating its usage policy, the provider may retain that content for up to two years, and certain safety classification results for longer. These practices may change.

When you delete your account, we delete from our systems as described above and send deletion requests to our processors. We cannot independently delete information that our AI provider is permitted or required to retain on its own systems.

We do not use provider-retained safety data for advertising or marketing, and we do not receive or review it.

We are telling you this because you deserve an accurate picture rather than a comfortable one.

Your Data Rights

Depending on where you live, you have the following rights:

How to Exercise Your Rights

You can export your data and delete your account directly in Settings. For all other requests, contact us at hello@alannaapp.com.

Our Response Standard

We will respond within 45 calendar days. Where permitted and reasonably necessary, we may extend once by up to an additional 45 days, and we will tell you within the first 45 days if we do, along with the reason.

Verification

To protect your information, we may need to verify your identity before acting on a request. We will not require you to create a new account to exercise a right.

Authorized Agents

You may submit a request through an authorized agent. The agent must provide proof of authority to act on your behalf, and we may still ask you to verify your identity directly.

Appeals

If we deny your request, you may appeal by contacting hello@alannaapp.com with the subject line “Privacy Appeal.” We will respond in writing within 45 calendar days with our decision and the reasons for it.

If we deny your appeal, you may contact your state Attorney General:

• Washington: atg.wa.gov/file-complaint
• Nevada: ag.nv.gov/Complaints/File_Complaint/
• Connecticut: portal.ct.gov/ag/general/contact-the-attorney-general

If your state is not listed, you may contact your own state Attorney General’s office.

Fees

Requests are free. If a request is manifestly unfounded, excessive, or repetitive, we may charge a reasonable administrative fee or decline, and we will tell you in advance and explain why.

Children’s Privacy

Alanna is intended exclusively for adults aged 18 or older and is not directed to anyone under 18. Companion chatbots may not be suitable for some minors.

We ask for your date of birth at signup to confirm you are an adult. We do not knowingly collect personal information from anyone under 18. If we learn that a user is under 18, we will close the account and delete the associated data.

Consistent with the Children’s Online Privacy Protection Act, we do not knowingly collect personal information from children under 13. If we learn we have collected information from a child under 13, we will delete it as quickly as possible and terminate the associated account.

If you believe a minor has provided us with information, contact us at hello@alannaapp.com.

Geographic Availability

Alanna is offered only to individuals physically located in the United States. By using Alanna, you represent that you are located in the United States. Your information is processed and stored on servers located in the United States.

Third-Party Links

Alanna may link to outside resources, such as crisis lines. Once you leave our Services, this Privacy Policy no longer applies. We do not control and are not responsible for the privacy practices of those organizations.

Changes to This Privacy Policy

We may update this Privacy Policy as Alanna evolves. When we do, we will post the updated version here with a new revision date. If the changes materially affect your rights, we will notify you by email or in-app notice.

If we ever want to collect a new category of information, or use your information for a new purpose, we will tell you and obtain your consent before we begin, not afterward.

If we make a change that affects information we already collected, we will give you a reasonable opportunity to withdraw your consent to any further processing of that information.

Contact Us

ALANNA APP LLC
13725 Beach Blvd Ste 3
Jacksonville, FL 32224
hello@alannaapp.com

Alanna is a general wellness tool. She is not a substitute for clinical care. If you are in crisis, call or text 988.

© 2026 ALANNA APP LLC. All rights reserved.