Privacy policy

Present privacy policy

Effective October 14, 2026

Present proves you were at a meeting. To do that it saves a GPS reading when you check in and check out. Nobody sees your records unless you share them. We don't sell your data and we don't use it for ads.

"Present," "we," and "us" mean SobaSearch, which is operated by Core Values Recovery. "You" means the person using the Present app. This policy covers the Present app and this website, verifiedpresent.com, including its verify pages. The SobaSearch privacy policy covers sobasearch.com.

At a glance

This is the short version, in the same terms the App Store and Google Play use.

We do not sell your data, share it for advertising, or track you across other apps and websites.

1. What we collect

Your account

A Present account is its own account. It is separate from any SobaSearch account, even one with the same email, and signing in to one never signs you in to the other. We keep your name, your email address, your password, your time zone, and when you created the account. We never store the password itself, only a scrambled version (a hash) that can't be turned back into it.

Each time you sign in we create a session. For each session we keep a scrambled copy of its key, the time it started and expires, and the app name your phone reports. Sessions last up to 30 days.

If you ask to reset your password, we email you a link and keep a scrambled copy of its key until it's used or an hour has passed.

Your location

Present asks for location access "while using the app." It reads your location at two moments:

• When the Today screen is open, to list in-person meetings within a mile of you. Your position is sent to our server to find those meetings. We don't save it with your account or in your records.
• When you tap Check in or Check out. Your phone takes one reading and sends it to our server. That reading is saved as part of your attendance record.

Present never reads your location in the background, and it can't: the app does not ask for that permission.

Each check-in and check-out

When you check in or out, the record saves:

• Your GPS latitude and longitude, how accurate the phone says the reading is, and your altitude if the phone provides it.
• The time on your phone, and the time on our server. The server's time is the one that counts.
• Your distance from the meeting, worked out by our server.
• Whether your phone reported a fake ("mock") location.
• Your phone's platform (iPhone or Android), operating system version, model (for example "iPhone16,1"), and the Present app version.
• A device ID. On first launch the app makes a random number and keeps it in your phone's secure storage. Only a scrambled version of it (a SHA-256 hash) ever leaves your phone. It is not your phone's advertising ID or serial number. We keep it to ourselves. The signed record holds only a one-time stand-in made from it, which is different on every check-in, so no one who sees your records can recover the device ID or use it to link one record to another.
• A copy of the meeting as it was listed at that moment: its name, program (for example AA or NA), address, map location, schedule, and time zone. We copy it so that later changes to the listing never change your record.
• A verification code, such as PRS-7K3Q-M9XD, and the digital signature described under Security.

Reports

When you make a report, we save the date range, the records in it, your name, a masked version of your email (like j•••@example.com), and, if you type them, who the report is for and a case or reference number. Your full email address never appears on a record or report.

When you contact us

If you email us, we keep the email and our reply so we can help you.

On your phone

The app keeps your sign-in key and the random device ID in your phone's secure storage, plus one setting that remembers you've seen the Reports intro. When you share a PDF report, your phone makes the file itself.

2. What we don't collect

• No background location. No location history between check-ins.
• Nothing about anyone else at the meeting: no names, no photos, no nearby phones.
• No contacts, photos, camera, microphone, calendar, or health app data.
• No advertising ID. No ads. No ad or analytics tools inside the app.
• No crash-reporting tool inside the app.
• We don't sell your data or trade it with anyone.

3. Why we collect it

• To make the record. A record is only worth something if it shows where and when. Location, times, and distance are the proof.
• To catch cheating. The mock-location flag, GPS accuracy, device details, and device ID help show whether a record is believable. Everyone who checks a record sees the same facts.
• To run your account. Your name and email let you sign in, and your name goes on the records you share.
• To keep the service secure and working. Session details help us spot misuse of accounts.

We don't use your data to build an advertising profile, and we don't use it for anything unrelated to Present.

4. Who can see your records

You. When you're signed in, you can see all of your records and reports.

Anyone you give a code or link to. Every record and every report has its own verification code, printed with a QR code. The code works like a key. Anyone who has it can open that record or report at verifiedpresent.com/verify, without signing in. A report's code also opens each record inside it. Older sobasearch.com/verify links send you to the same page.

Someone with a record's code can see:

• Your name (or "Name not provided") and masked email.
• The meeting's name, program, address, and scheduled time.
• When you checked in and out, your distance from the meeting, the GPS accuracy, and your position rounded to about 11 meters.
• Your phone platform, app version, and whether a mock location was reported.
• Under "Technical details," the full signed entry, so an expert can check the signature. That entry also contains your exact coordinates, altitude, phone model, operating system version, phone time, and a random ID the app made for that check-in. In place of your device ID and account number it holds one-time stand-ins that change with every check-in. They can't be turned back into either, and they don't link one record to another.

Someone with a report's code also sees the date range, the totals, and the recipient and case number if you added them.

Nobody who opens a code sees your full email address, your device ID, or your account number.

Officers you choose to share with. If you pair with an officer in the app and tap Allow, their agency can see your name, your records (with their codes), your streaks and totals, and reports they make, until you stop sharing. They never see your full email address, password, device ID, or account number. You can see each time they looked, and stop sharing at any time in Account → Sharing.

Our team. A small number of SobaSearch staff can reach the database to provide support, keep the service secure, and meet legal duties. We don't browse your records.

When the law requires it. We may have to hand over records if a court order, subpoena, or other legal process requires it. We will push back on requests that are too broad, and, where the law allows, we will tell you first.

If SobaSearch changes hands. If SobaSearch is sold or merged, your data may move to the new owner, who must keep honoring this policy.

5. The public verify page

The verify page, verifiedpresent.com/verify/code, is built to keep codes private:

• It loads no analytics. In fact, no page on verifiedpresent.com does.
• It tells search engines not to list it.
• It tells browsers not to pass the address along when someone clicks a link away from it.
• Our error monitoring removes verification codes before any error report leaves our server or the browser.

6. Health information

Going to a recovery meeting can reveal something about your health, such as a history with alcohol or drugs. Records include the meeting's name and program. We treat all of it as sensitive:

• It's private by default. Only you decide who gets a code.
• We never use it for ads, never sell it, and never share it with data brokers.
• The app's name, icon, and screens never mention a program or recovery, so it stays discreet on your phone.

SobaSearch is not a doctor, clinic, treatment program, or health plan. That means we are not a "covered entity" under HIPAA, the US health privacy law, and HIPAA's rules don't apply to Present. We protect your data because it matters, as this policy describes. If your treatment program or court keeps a copy of a record you gave them, their own rules govern that copy.

7. Companies that help us

We use a few service providers. They may handle your data only to provide their service to us.

Present takes no payments.

8. How long we keep it

• Records and reports are kept for as long as your account exists, and erased when you delete it. They are append-only: nobody, including us, can edit one in normal operation. A correction is added as a new, signed entry. This is what lets a court trust them.
• Your account details are kept until you delete your account. Deleting it erases your records and reports too (see Deleting your account).
• Nearby-meeting lookups are not saved by us. Our hosting provider's request logs may hold them briefly.
• Sessions expire after 30 days or when you sign out.
• Support emails are kept as long as we need them to help you.

Signing out of the app does not delete anything. Your records are still there when you sign back in.

9. Deleting your account

You can delete your account yourself, at any time. In the app, go to Account, then Delete account at the bottom. You'll re-enter your password and type DELETE to confirm. If you forgot your password, reset it from the sign-in screen first. If you can't sign in at all, email hello@sobasearch.com from the address on your account and we'll do it for you once we've confirmed it's really you. Deleting your Present account doesn't touch a SobaSearch account, if you have one.

Deletion happens right away and can't be undone. We erase:

• your name, email address, password, time zone, every signed-in session, and any unused reset link;
• every check-in, check-out, and report: the meeting details, the GPS readings (position, accuracy, and altitude), the phone details, and any recipient or case number you added to a report;

What we keep. For each verification code you were given, we keep a short note: the code, whether it was a record or a report, the date it was issued, and the date it was deleted. Nothing in that note says who you are or which meeting it was. We keep it so that anyone who opens a code you shared sees "This record was deleted at the member's request on (date). It can no longer be verified," rather than "No record found," which could look like a fake code.

Backups. Our database provider, Supabase, keeps backup copies of the database. Deleted data stays in those copies until they roll off on Supabase's backup schedule, and we never restore a deleted account from them. If the law requires us to keep something, for example because of a court order, we'll keep only that and tell you, unless the law forbids it.

10. Security

• All traffic between the app, the website, and our server is encrypted (HTTPS).
• Passwords and session keys are stored only as hashes. On your phone, the sign-in key is kept in the system's secure storage.
• Every check-in, check-out, and report is digitally signed with an Ed25519 key that only our server holds. Each entry includes a SHA-256 fingerprint of the one before it, so a missing or changed entry is easy to spot. Our public keys are published so anyone can check a signature without trusting us.
• The database refuses edits and deletions of attendance entries, and the public can't reach it directly. The one exception is deleting your account, which erases all of your entries at once and nothing else.

No system is perfectly secure. If we learn of a breach that affects your data, we'll tell you as the law requires.

11. Your choices and rights

• Location. You can turn off location for Present in your phone's settings at any time. You won't be able to check in without it.
• Sharing. You choose which records and reports to share, and with whom.
• A copy of your data. You can see every record in the app and make a report for any date range. Email us for a full copy.
• Corrections. Records can't be edited, but if one is wrong, email us. A correction is added as a new signed entry.
• Deletion. See Deleting your account.

Some states, such as California and Washington, give you extra rights over personal and health data, including the right to know what we hold, get a copy, have it deleted, and not be treated differently for asking. We honor these requests for everyone, wherever you live. Email us to make one. If we say no, you can ask us to reconsider.

12. Age limit

Present is for adults 18 and older. Records are often used by courts and probation offices, and we don't want to hold this kind of record about a child. If we learn that someone under 18 has an account, we'll delete it. If you think a child has signed up, email us.

13. Where we operate

SobaSearch is based in the United States, and Present is meant for use in the United States. Our providers may process data in the United States and other countries.

14. Changes and contact

If we change this policy, we'll post the new version here and update the date at the top. If a change matters, such as a new use of your location, we'll tell you in the app or by email before it takes effect.

Questions, requests, or concerns: email hello@sobasearch.com. We read every message.

See also the Present terms of use.