Doorway is a free self-reflection app made by The Open Door Project, a nonprofit organization based in California ("we," "us," "our"). This policy explains what information Doorway collects, how it's used, and the choices you have. We've tried to write it in plain language.

The short version:

• What you write in Doorway is private to your account. We don't sell it, rent it, or use it for advertising — ever.
• We only collect what Doorway needs to work.
• You can export or delete your information at any time, right in the app.
• Doorway never contacts anyone on your behalf — not parents, schools, employers, police, or emergency contacts.
• Doorway is not an emergency service. If you are in immediate danger, call 911. You can call or text 988 to reach the 988 Suicide & Crisis Lifeline.

1. Who this policy covers

This policy applies to the Doorway app for iPhone and iPad and the services that support it. It does not cover other websites or services we link to, like crisis lines, treatment providers, or government resources. Those have their own privacy policies.

2. Information we collect

Account information

• Email address and password if you sign up with email. Your password is handled by our sign-in provider (Google Firebase Authentication) and is never visible to us.
• Sign in with Google: if you choose it, Google shares your name, email address, and profile photo with us so we can confirm who you are and let you sign back in. See "Google Sign-In data" just below for exactly where this information is stored and how long we keep it.
• Sign in with Apple: if you choose it, Apple shares a unique identifier and an email address with us. You can choose to hide your real email, in which case Apple gives us a private relay address. We don't request your name.
• Account status, like whether your email has been verified, and the date you agreed to these policies.

Beyond what your chosen sign-in method shares with us, we do not ask for your age, gender, diagnoses, or other demographic details.

Google Sign-In data: exactly where it lives

If you sign in with Google, your Google account details are kept in only two places: Firebase Authentication (Google's own servers) and your phone's Keychain. They never enter the Firestore database where your check-ins and other content are stored.

• Firebase Authentication. When you sign in with Google, Firebase creates one sign-in record for you containing: Doorway's own user ID (the "uid"), your Google account's email address and whether it's verified, your Google account ID (recorded as a "google.com" sign-in method), your Google name and profile photo link (copied automatically by Firebase; Doorway itself never reads or displays these), and the account's creation date and last sign-in date. Access to this record is limited to a small group of authorized Open Door Project staff.
• Your device's Keychain. The sign-in tokens that keep you logged in are stored on your phone, encrypted by iOS: Google's sign-in library keeps its own tokens, and Firebase keeps its own tokens under Doorway's Keychain group. Signing out clears both.
• Firestore (our database). No Google account information is stored here. The `users/{uid}` document can only contain your onboarding status, an account creation time, and which Terms and Privacy versions you accepted. Our security rules reject any other field, so your email, name, or photo cannot end up here — even by mistake. Your check-ins, notes, and other entries are filed under your uid alone, not your Google identity.

We never collect, through Google Sign-In: your Google password (you type it into Google's own sign-in screen, never ours); your Gmail, contacts, Drive, or calendar (Doorway only requests Google's basic sign-in — identity, email, and profile — so it cannot access any of these); or anything tied to your email or uid in analytics and crash reports.

When you delete your account: your Firestore data is deleted; your Firebase sign-in record is deleted, which removes your Google email, name, and photo from our systems; Doorway's access to your Google account is disconnected; and a background cleanup function deletes anything left over, as a backup.

We never share your Google Sign-In data (name, email, or profile photo) with any third party. It is used only to operate Doorway — to confirm your identity and keep you signed in — and nothing more.

What you choose to record (your "health information")

Doorway exists to help you keep track of how you're doing, so it stores what you enter. This can include:

• Daily check-ins: your answers (for example mood, stress, sleep, energy, and connection ratings), any notes you add, and the exact wording of each question you were asked.
• Notes: titles, text, mood, and tags.
• Screening questionnaires (such as PHQ-9 and GAD-7): your answers, scores, and the date.
• Safety plan: what you write, including the names and phone numbers of people or services you add. Please only add someone's contact details if you're comfortable doing so; we use them only to show them back to you.
• Recovery tracking (optional): counters you create, their dates, events you record, and urges or cravings you log.
• Coping tools: which exercises you used and any distress ratings you chose to give.
• Saved treatment providers: providers you save from the treatment finder, your progress with each, and your private notes.
• Tracked behaviors and preferences: things you choose to track, your check-in time, reminder wording, the concerns and support preferences you selected, and which resource topics you want to see.

Some laws call this "consumer health data." See Section 9 for more.

Information that stays on your device

Some settings never leave your phone:

• Resource filters for communities you belong to (for example LGBTQ+, BIPOC, veterans, or teens).
• App lock, quick-exit, and discreet-icon settings.
• Your choices about analytics and crash reports.

Location

Doorway only uses location if you tap "Use my location" in the treatment finder, and only after you give permission. Your phone uses your approximate location to look up your ZIP code on the device. Only the ZIP code is sent to search for providers. Your location is never stored by Doorway. You can always type a ZIP code or city instead.

Treatment searches

When you search for treatment, Doorway sends the ZIP code or city you entered, the type of care, and the search distance to The Open Door Project's treatment locator (at opendoornonprofit.org), which uses public provider data from SAMHSA's FindTreatment.gov. These searches are not linked to your Doorway account. Like most websites, our server may briefly keep standard technical logs (such as IP address and time of request) for security and troubleshooting.

Keeping the service secure

Doorway uses Apple's App Attest and DeviceCheck through Firebase App Check to confirm that requests come from the genuine Doorway app. This involves a device verification token, not your content.

Optional analytics and crash reports (off unless you turn them on)

In Settings → Privacy, you can choose to share:

• Usage analytics: a small, fixed list of events such as "app opened" or "check-in completed." These events never include your answers, scores, notes, screener names, or anything you write. Google Analytics for Firebase may also collect standard device information such as device model, operating-system version, app version, and approximate region.
• Crash reports: technical details about app crashes (through Firebase Crashlytics) so we can fix bugs.

Both are off by default, and you can turn them off at any time. We do not collect your device's advertising identifier, and we don't track you across other apps or websites.

Reminders

Daily reminders are scheduled on your device. The reminder shows only the wording you choose. By default it's "Your daily moment is ready when you are." Reminders never mention mental health.

When you contact us

If you email us, we'll receive your email address and whatever you include in your message.

3. How we use information

We use information only to:

• Provide Doorway's features, such as saving your check-ins, showing your history and charts, and choosing relevant check-in questions.
• Sync your information across your devices when you sign in.
• Keep Doorway secure and prevent abuse.
• Respond to your questions and requests.
• Understand and improve Doorway using opt-in analytics and crash reports, which never contain your health information.
• Meet legal obligations.

The questions Doorway suggests are based on clear, written rules about your own recent answers (for example, "sleep has been low on 3 of your last 5 check-ins"). Doorway does not use artificial intelligence to analyze what you write, and it does not diagnose you.

We do not:

• sell, rent, or trade your information;
• use your information for advertising or allow advertisers to target you;
• share your health information with employers, schools, insurers, or data brokers;
• use your health information to train artificial-intelligence models.

4. How information is shared

We share information only in these limited ways:

• Service providers that run Doorway for us. Google (Firebase and Google Cloud) stores your account and synced data and provides sign-in, security checks, and optional analytics and crash reporting. Apple provides Sign in with Apple and device verification. These providers may only use your information to provide services to us, under their terms and data-protection commitments.
• When you choose to share. If you export your data, create an appointment summary, or share your safety plan, you decide where it goes. Once you share it outside Doorway, that copy is no longer controlled by Doorway.
• If required by law. We may disclose information if we're required to by a valid law, subpoena, or court order. When we're legally allowed to, we'll try to tell you first. We will push back on requests we believe are overly broad.
• If The Open Door Project's programs change. If Doorway is transferred to another organization, for example a successor nonprofit, your information would be protected by this policy or one at least as protective, and we would tell you in advance.

Doorway does not monitor your entries in real time and does not contact anyone on your behalf. If an answer suggests you might want support, Doorway shows you crisis resources. What you do next is up to you.

5. Who can see your information

Your content is protected by per-account security rules, so only your signed-in account can read it through the app. Our staff do not routinely look at your content. Access to our systems is limited to a small number of authorized people and is used only when necessary to operate, secure, or troubleshoot Doorway, or when required by law.

6. How long we keep information

• We keep your information while your account is active, so your history is there when you want it.
• You can delete individual entries at any time.
• Settings → Delete data permanently deletes all your Doorway data but keeps your account.
• Settings → Delete account permanently deletes your data and then your account. If you used Sign in with Apple, we also revoke Doorway's access to your Apple ID.
• Deletion from our active systems happens right away, and needs an internet connection. Copies in backups, if any, are removed within 30 days.
• Technical server logs from treatment searches are kept for up to 30 days.

7. Security

We protect your information with:

• encryption in transit (HTTPS);
• encryption at rest by our cloud provider;
• security rules that keep each account's data separate;
• App Check verification;
• your device's built-in data protection.

You can also turn on App Lock (Face ID, Touch ID, or passcode), and Quick Exit to hide Doorway quickly.

Your information is not end-to-end encrypted, and no system is perfectly secure. If a security incident affects your information, we'll notify you as required by law.

8. Your choices and rights

You can:

• See and download your information: Settings → Export data (JSON and spreadsheet files).
• Correct it: edit or delete entries in the app.
• Delete it: delete entries, all data, or your whole account in Settings.
• Turn off optional analytics and crash reports, location access, and reminders at any time.
• Withdraw consent: you can stop using Doorway and delete your account at any time.

Depending on where you live, you may have additional rights. These can include the right to confirm whether we collect or share your health information, to get a list of third parties it's shared with, to withdraw consent, and to appeal our decision about a request. To make a request or appeal, email info@opendoornonprofit.org. We'll respond within the time required by law (generally within 45 days), and we won't treat you differently for exercising your rights.

9. Consumer health data

This section is our consumer health data privacy notice. It's for people covered by laws such as Washington's My Health My Data Act, and Nevada's and Connecticut's consumer health data laws.

• What we collect: the information you record, listed in Section 2 under "What you choose to record." This includes check-ins, notes, screening answers, safety plan contents, recovery and urge logs, coping sessions, and saved providers.
• Where it comes from: directly from you, when you enter it.
• Why we collect it: only to provide the features you use (Section 3).
• Who we share it with: only the service providers described in Section 4 that store and process it for us, or as required by law. We do not sell consumer health data.
• Your rights: see Section 8. You can access, delete, and withdraw consent for your consumer health data at any time.

10. Children and teens

Doorway is for people 13 and older. We do not knowingly collect information from children under 13. If we learn that a child under 13 has created an account, we will delete it. If you believe a child under 13 is using Doorway, please contact us.

If you're a teen, we encourage you to involve a parent, guardian, or another trusted adult in your care when you can. Doorway's resources section includes support made for young people.

11. Where information is stored

Doorway is intended for people in the United States. Your information is stored on servers in the United States operated by Google Cloud.

12. Changes to this policy

If we make important changes, we'll update the version and date above and ask you to review and agree to the new version in the app before you continue. Earlier versions are available on request.

13. Contact us

The Open Door Project — Email: info@opendoornonprofit.org — Phone: 925-582-3409