Privacy Policy
At Step One Recovery Resources (“we,” “us,” or “our”), your privacy is important to us. This Privacy Policy explains what information we collect when you visit steponerecovery.org (the “Site”) or use our services (the “Services”), how we use it, who we share it with, and the choices you have. By using the Site and Services, you agree to this Privacy Policy.
The short version
- You can search the directory, read listings and find meetings without an account or giving us any personal information.
- We count how often each listing is viewed and contacted, as anonymous totals with no cookies or personal information, so providers know their listing is working. We don't record what you search for.
- We don't use advertising or analytics tracking cookies, and we don't sell, rent or trade your personal information.
- We only collect personal information you choose to send us, such as through a form, a newsletter signup or a business account.
1. Information We Collect
1.1 Information you give us
- Contact and registration forms: your name, email address, and anything you write in your message. If you report a problem with a listing, your report includes the listing's name.
- Newsletter signups: your email address and the page where you signed up.
- Resource guide downloads: your email address, your first name if you give it, and which guide you downloaded. We email you the guide and add you to the newsletter, which you can unsubscribe from at any time.
- Sobriety story submissions: your name, email address, your answers to the story questions, your sobriety date if you choose to share it, and any photos you upload.
- Event submissions: your name, email address and the event details.
- Business (vendor) accounts: your name, business name, email address, a password, and the listing information, logos, photos and brochures you add. Your password is stored by our sign-in provider in a protected, encrypted form, and we can't see it.
- Payments: businesses pay for listings through Stripe. Your card details go directly to Stripe and never reach our servers. We receive only your subscription status, plan, and Stripe customer reference.
1.2 Information collected automatically
- Security checks: our forms use Cloudflare Turnstile to block spam and bots. Turnstile examines information about your browser and device to confirm you're a person.
- Server logs: our hosting provider, Cloudflare, processes basic technical information such as your IP address, browser type, and the pages requested, to deliver the Site and protect it from attacks.
- Listing statistics: when a listing page is opened, or someone taps a listing’s Call, Website, Email or Get directions button, we add one to that listing’s daily total. We don’t store your IP address, use cookies, or keep anything that could identify you. Only the totals are kept.
- Sign-in storage: if you sign in to a business or admin account, your browser stores a sign-in token so you stay signed in. Visitors who don't sign in don't get one.
2. A Note About Health Information
Step One is a directory, not a healthcare provider, and we don't provide medical advice or treatment. Please don't send us medical details through our forms unless you want to share them. If you submit a sobriety story, we review it before publishing it on the Site with the name you gave us. We never publish your email address, and you can ask us to change or remove your story at any time. If you're in crisis, call or text 988 any time, or call 911 in an emergency.
3. How We Use Your Information
- To answer your messages and handle requests, such as correcting a listing.
- To send the newsletter, if you signed up for it.
- To review and publish sobriety stories and events you submit.
- To run business accounts and listings: approving listings, handling subscriptions, and sending account and billing emails.
- To keep the Site secure and prevent spam and abuse.
- To comply with legal obligations.
4. Who We Share Information With
We do not sell, rent, or trade your personal information. We share it only with the service providers that run the Site for us, and only so they can do that work:
- Supabase: our database, file storage, and account sign-in.
- Cloudflare: website hosting, security, and spam protection (Turnstile).
- Postmark: sends our emails, including form notifications, account emails, and the newsletter. For emails inviting a business to claim its listing, Postmark tells us whether the email was opened and whether a link was clicked. We don't track opens of any other emails.
- Stripe: processes listing payments.
We may also disclose information if the law requires it, to protect the rights, property, or safety of Step One Recovery Resources, our users, or others, or as part of a merger, acquisition, or sale of assets.
Business listings are public by design. The information a business adds to its listing, such as its name, phone number, address, website and photos, appears on the Site.
5. How Long We Keep Information
We keep form submissions and newsletter signups for as long as we need them for the purpose you sent them. Business account and billing records are kept while the account is active and afterward as needed for tax and legal records. You can ask us to delete your information at any time (see section 7).
6. Data Security
We use reasonable administrative and technical measures to protect your information: encrypted connections (HTTPS), access limited to the Step One team, private storage for submitted photos until they're approved, and database rules that keep each business's account separate. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.
7. Your Choices
- Access, correction and deletion: email info@steponerecovery.org to see, correct, or delete the personal information we hold about you.
- Newsletter: unsubscribe at any time by replying to any newsletter or emailing us.
- Business accounts: update your listing from your account, and manage or cancel your subscription through the Stripe billing page linked in your account.
- Stories: ask us at any time to remove a story you submitted.
8. Third-Party Links
The Site links to provider websites, meeting lists, and other organizations we don't operate. This Privacy Policy doesn't apply to those websites, and we encourage you to read their privacy policies. Some meeting information is provided by recovery fellowships and is credited on the meetings page.
9. Children’s Privacy
Our forms and accounts are not intended for people under 18, and we don't knowingly collect personal information from children. If we learn that we have collected information from a child under 18, we will delete it promptly.
10. International Users
The Site serves Colorado. If you access it from outside the United States, your information will be processed and stored in the United States.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with a new “Last updated” date. Your continued use of the Site after changes are posted means you accept the updated policy.
12. Contact Us
Questions about this policy? Email info@steponerecovery.org or use our contact form.
