The short version: what you write in Responder stays on your phone. We never receive it, so we can never read it, hand it over, or lose it.
Nothing. Not by default, and not ever, unless you deliberately join the optional research study described below.
There is no account. No sign-up, no email address, no phone number, no username, no password. We do not know who you are, that you installed the app, or that you opened it.
Check-ins, journal entries, and anything you write about a hard call are stored on your device only.
Every piece of free text is encrypted with a key held in your phone's secure hardware. That key is marked so it can never be extracted, never copied to another device, and never included in a backup — not even an encrypted iCloud backup. The database itself is also excluded from backups.
If you set a PIN, your entries are not merely hidden while locked. They are unreadable, because the key that decrypts them is itself wrapped by your PIN.
One honest limit: a four- to six-digit PIN is a small number of possibilities. Someone who took a forensic image of your unlocked phone and had the right tools could work through them. That is a real constraint of short PINs, not something specific to this app — but you should know it rather than assume the encryption makes a short PIN unbreakable.
Nothing, because we hold nothing.
This is worth being precise about. Many apps promise not to look at your data. That is a policy, and policies can change, be overridden by a court, or be broken by someone who gains access to a server. Responder does not store your writing on a server, so there is no server to subpoena, seize, or breach.
Deleting a single entry removes it from your device.
"Delete everything" in Settings destroys the encryption key first, then removes the records. Once the key is gone, anything that somehow survived on disk is permanently unreadable — not by us, not by you, not by anyone with a forensic tool.
You can choose, in advance, to have everything clear itself if you do not open the app for 14, 30, 60, or 90 days. It is off unless you turn it on.
This is a standing choice you make ahead of time. It is not something we can trigger, and it is not something anyone can ask us to trigger, because we have no way to reach your phone.
If you pair with another responder, you do it in person — the two phones exchange keys directly, and you both confirm three matching words on screen.
A session between you runs phone to phone over Bluetooth. It does not go through the internet, through us, or through any company. We do not know that you paired with anyone, who they were, or that you ever spoke.
Nothing from a session is written to disk on either phone. Not a draft, not a cache. When it ends, the keys and every line are destroyed.
This is the only part of Responder that ever uses the network, and it is off unless you deliberately turn it on. It is not on by default, there is no prompt nudging you toward it, and nothing about the app changes if you never enable it.
If you join, here is precisely what leaves your phone when you complete a questionnaire:
| Field | What it is |
|---|---|
| Study ID | A random identifier created on your phone. It is not derived from anything about you or your device, and it is not linked to your name, email, or hardware. |
| Instrument code | Which standard questionnaire it was. |
| Day | The date. Not the time — "the 4th", not "03:14 on the 4th". |
| Answers | Numbers. A list of integers, one per question. |
That is the entire payload. No free text ever leaves your phone — not journal entries, not notes, not anything you wrote about a call. No IP addresses are logged. No device identifiers are sent.
The app keeps a ledger on your phone of everything that has ever been submitted, so you can see exactly what left and when. If it is not in that list, it never left.
You can leave the study at any time, immediately, without being asked why. Deleting everything removes the study enrolment and the ledger too.
| Permission | Why, and when |
|---|---|
| Bluetooth | Only to reach a peer standing next to you, phone to phone. Never used for location, beacons, or discovery of anything else. |
| Camera | Two uses: scanning a peer's pairing code, and the optional breathing biofeedback tool. Nothing is recorded and no image ever leaves your phone. |
| Microphone | Only for the Low Tone breathing exercise, which listens to your exhale. Nothing is recorded. |
| Face ID / Touch ID | Only if you choose to unlock with it. Biometric data never leaves Apple's secure hardware and is never seen by us. |
| Notifications | Only if you turn on a shift-end reminder. The notification text deliberately says nothing about mental health or how you are doing, because it appears on your lock screen where anyone nearby can read it. |
Each of these is requested at the moment you first use the feature, never at launch, and declining any of them leaves the rest of the app fully working.
Responder is not therapy and not treatment. It does not diagnose anything. It is a private tool for noticing your own patterns over time.
It also carries no legal privilege. Peer support privilege laws in most states protect conversations with a designated, trained peer support team member — they do not cover two responders talking on an app, and no court has ever held otherwise. The protection Responder offers is architectural: there is no record for anyone to obtain. We would rather say that plainly than imply a legal shield that does not exist.
If you are in crisis, 988 answers by call or text, any hour.
Responder is intended for working and retired first responders. It is not directed at children and collects no information from anyone, including children.
If this policy changes in a way that affects what leaves your phone, the app will tell you inside the app, before the change takes effect. Given that the answer today is "nothing," any change would be a significant one and will be treated that way.
Questions about this policy can go to the address listed on the App Store page for Responder.
We cannot help you recover a forgotten PIN, restore deleted entries, or retrieve anything from a lost phone. Not because of a rule we chose, but because we have never had a copy of any of it.