Draft for owner and legal review. This is not legal advice. It describes what the LoHi app and its Supabase project do in the source reviewed for this draft. It is not a HIPAA determination, a business-associate contract with a vendor, or a substitute for counsel. Do not submit this URL to Apple until every [KEVIN TO CONFIRM] item is replaced and a lawyer has approved the page.

Privacy Policy

LoHi keeps the information it needs to connect a client with their counselor and to store the check-ins the client chooses to submit.

Effective date: November 9, 2026.

Who we are

LoHi is operated by Align Christian Counseling (alignchristiancounseling.com). The app owner is Kevin Marcum, a licensed professional counselor and ordained minister.

Mailing address: 106 West Walnut St., Bolivar, MO 65613.

Privacy and support email: [email protected].

Invite email is intended to come from [email protected]. [KEVIN TO CONFIRM: that the live Resend setting INVITE_EMAIL_FROM is [email protected]. If that setting is empty, the code falls back to LoHi <[email protected]>.]

The in-app Terms of Service are version 1.1, dated November 9, 2026. That is the text counselors accept, including the rule that users must be 18 or older and the email process for a copy of check-in data. The Business Associate Agreement and Client Disclaimer remain version 1.1, dated July 14, 2026. Those documents are separate from this privacy policy. Your counselor remains responsible for clinical care, informed consent, and their own Notice of Privacy Practices.

What LoHi is

LoHi is offered to adults in the United States. You must be 18 or older to use it.

Clients use LoHi to record a daily check-in: mood, stress, energy, sleep, and written answers. Counselors use it to review check-ins and summaries for the clients assigned to them. Counselors invite clients by email or by an invite code. A new counselor account cannot see client information until Align Christian Counseling approves it.

LoHi does not sell personal information, does not show ads, and does not include an advertising or cross-app tracking SDK. The source reviewed here does not use HealthKit, the camera, photos, contacts, microphone, or location services.

Information the app collects

Account and sign-in

When you create an account or sign in, Supabase Auth stores your email address and a password. The password is handled by Supabase Auth. LoHi does not keep a readable copy of it in the app database. During counselor signup, the password stays in the app’s memory only long enough to create the account. It is not placed in the navigation history.

The app also stores a user ID, a role (client or counselor), and, for counselors, an approval status of pending or approved. Password reset and, when required, account confirmation emails are sent by Supabase Auth, not by the invite-email provider. [KEVIN TO CONFIRM: the From address and wording of those Auth emails.]

Client profile and check-ins

A counselor enters a client’s name and, if they have it, the client’s email and initials. When the client accepts the invite, the client record is linked to that client’s login. If the counselor entered an email, the accepting account must use that same email.

Each saved check-in can include:

• the date
• mood and stress, as numbers you set on a scale
• sleep, as a label such as poor, okay, or good
• energy, as a label such as low, medium, or high
• written answers about what felt difficult, a follow-up, persistent thoughts, an optional reflection, and anything you want to talk about next session
• the wording of the prompt that was shown with each answer

Those written answers can include whatever you choose to type. That may be health information. It may also include other personal details if you write them. The app does not have separate fields for race, religion, sexual orientation, or similar categories.

Weekly and monthly summaries are calculated on the device from check-ins already stored. There is no separate reports database.

A check-in that you have not finished is held in memory so you can leave the screen and come back. It is not saved as its own file on the phone. Closing the app can discard an unsaved draft. A finished check-in is stored on the server.

Invitations

LoHi stores an invite code, a longer invite token, the expiration time, and the status (pending, accepted, or revoked). Codes are meant to expire 14 days after they are created. A counselor can copy the code, share it through the phone’s share sheet, or send it by email.

Email invites are sent by a server function through Resend. The message includes the client’s name if the counselor entered one, the invite code, a download link if one is configured, and a note that the invite expires in 14 days. It does not include check-in text. The database stores whether the email was sent, when, and a short error message if sending failed. That error message does not include the code.

Counselor professional details

Counselor signup asks for full legal name, practice legal name, license type, license number, state or states of licensure, practice address, professional email, a checkbox that the person is a licensed counselor or an ordained minister providing care under their own credentials, and a checkbox that they are 18 or older. Client invite signup asks for the same age checkbox. The app does not ask for a date of birth. License choices in the app include LPC, PLPC, LMFT, LCSW, Psychologist, Ordained minister, and Other.

Those details are saved with the Supabase Auth account, on the counselor profile (name, email, license type, license number, state, and the time they attested), and in a practice record (legal name, address, and which agreement versions were signed). A copy of the practice details is also cached on the phone in ordinary app storage so the counselor screens can reopen. That cache is not the encrypted sign-in store.

Agreements you accept

When a counselor accepts the Terms of Service and the Business Associate Agreement, LoHi stores the document name, version, a hash of the text, the time, the practice name, the representative’s name and title, which boxes were checked, a device label, and a user-agent string.

When a client accepts the Client Disclaimer, LoHi stores the document name, version, hash, time, the client’s name, that they confirmed and scrolled the document, the same kind of device label, and a user-agent string.

The device label is stored in a column named ip_address. The app writes a coarse label such as “ios-device,” “android-device,” or “web-client.” It does not look up your network IP address. On the web, the user-agent is the browser’s user-agent. On a phone, it is a string like “LoHi-App/ios/” plus the system version. After a counselor signs, the app asks a server function to email that counselor a copy of the signed agreements. The message goes only to the email on their account. If sending fails, the confirmation screen says the agreements are saved and the email could not be sent. The app does not attach a PDF.

Activity log

The server records counselor activity such as creating, replacing, revoking, or accepting an invite, sending an invite email, removing a client, and signing an agreement. A counselor can read their own recent rows in Activity Log. Those rows describe the action. They do not include check-in text or the invite code. Clients do not have this screen.

The phone can also keep a local activity note in app storage, including a line that contains the license number when agreements are signed. Sign-out clears the cached counselor profile. It does not, by itself, clear that local activity note. Deleting the account clears LoHi’s on-device keys, including that note.

Crash reports

In production builds, the app uses Sentry (organization “align-counseling”) to report crashes. The app is set so default personal data is off, performance tracing is off, and navigation breadcrumbs are not sent. Before a report goes out, the app drops user, request, and extra fields, replaces the error text with “An unexpected app error occurred,” and keeps a stack trace, platform, release, and similar diagnostic fields. Check-in text is not intentionally included. [KEVIN TO CONFIRM: the Sentry retention period, and whether Sentry still stores an IP address from the connection even with default personal data turned off.]

What stays on the device

• The sign-in session is stored in the iOS Keychain or Android Keystore through Expo SecureStore, limited to this device. On the web, the session uses browser storage, which is not that same protected store.
• Optional app lock uses the device’s Face ID, Touch ID, or passcode. LoHi stores only whether app lock is on. It does not receive a fingerprint or face template.
• Daily and appointment reminders are scheduled on the phone with local notifications. There is no push-token registration and no remote push server in this app. The daily reminder says it is time to check in. The appointment reminder includes the appointment time you set. Either can appear on the lock screen.
• The app may cache the client id and name, or the counselor’s practice details, in app storage on the device.

What we do not collect through the app

The source reviewed here does not collect phone contacts, photos, video, audio, precise location, payment card numbers, advertising identifiers, or a fitness feed from Apple Health. There is no social sign-in. There is no in-app purchase. The app does not read your email inbox or your text messages. Crisis buttons open the phone or messages app. They do not send the conversation to LoHi.

Supabase, Resend, Sentry, Apple, and the device maker can still process connection or delivery data under their own systems. [KEVIN TO CONFIRM: the provider contracts, regions, and whether any of them use LoHi data for their own advertising. Nothing in the app asks them to.]

Why we use this information

• to create and protect accounts, reset passwords, and keep a client linked to one active counselor relationship
• to store check-ins and show them to the client and to the assigned counselor, including weekly and monthly summaries
• to send or share invitations and to keep pending counselors from seeing client data until they are approved
• to keep a record that the Terms, Business Associate Agreement, or Client Disclaimer was accepted
• to record counselor activity such as invites and removals
• to diagnose crashes, without intentionally attaching the check-in
• to schedule optional reminders and optional app lock on the device

LoHi is not intended to sell client health information, use it for advertising, or use it for a purpose unrelated to the service. The in-app terms say the same thing.

Who can see it

• You can see your own account and, if you are an active client, your own check-ins.
• Your assigned counselor can see your client record and check-ins while the relationship is active, including the words you wrote. Other counselors cannot. A counselor whose account is still pending cannot see clients, check-ins, or invites.
• Align Christian Counseling, as the operator, can access the Supabase project in order to run the service, approve counselors, and investigate a problem. That access is outside the normal app screens. [KEVIN TO CONFIRM: the people, besides you, who can sign in to Supabase, Resend, Sentry, or Apple developer accounts.]
• Resend processes invite email: the recipient address, the name in the greeting, and the invite code.
• Sentry processes the reduced crash report described above.
• Supabase hosts the account system, the database, and the server functions that send invites and delete accounts.
• Apple distributes the iOS app and provides device features such as Keychain, Face ID, and local notifications. Expo Application Services is used to build the app. The app does not send check-ins to Expo as a separate product.

A counselor who copies or shares an invite also places the code on the clipboard or in whatever app they share it to. That copy is no longer only inside LoHi.

Your counselor may keep their own counseling record outside LoHi. They decide, under their professional duties, whether something you submit becomes part of that record. LoHi does not control those copies.

Where it is stored

Account data, profiles, client records, check-ins, invites, practice details, agreement records, and the activity log are stored in a Supabase Postgres database. Server functions run on Supabase. The app talks to Supabase with the public project URL and a public client key. The service secret stays on the server.

Hosting region: [KEVIN TO CONFIRM: the Supabase region. An internal draft said US West. The app source does not record the region.]

The private deletion archive, described below, is in a database schema the app is not allowed to read.

Counselors are asked to accept an in-app Business Associate Agreement if they are a covered entity. That screen is not, by itself, proof that Supabase, Resend, or Sentry are under a signed business-associate agreement. [KEVIN TO CONFIRM: whether a HIPAA business-associate agreement is in place with each provider that can handle client information, and whether the Supabase HIPAA add-on is enabled.]

How long it is kept

The app does not run an automatic purge that deletes check-ins after a set number of days. A check-in stays until a counselor removes that client relationship or an account deletion removes it.

• Removing a client. The counselor’s removal action deletes that relationship’s check-ins, revokes pending invites, and unlinks the client’s login from that relationship. The client’s own login remains. The client row is marked removed and is hidden from normal app access. The client can still manage or delete their account, or accept a new invite into a new relationship.
• Invite codes. A pending code stops working after its expiration, normally 14 days, or sooner if it is revoked or replaced. The database row is removed when the related account is deleted, or when a counselor deletion removes that counselor’s invites. Removal of a client revokes pending invites rather than always deleting every old invite row. Account deletion deletes the invite rows tied to the deleted account.
• Signed agreements, disclaimers, and a deletion receipt. When an account is deleted, the public copies of that person’s signed records are removed, and a copy is kept in the private archive together with the user ID, role, time, and counts of deleted client rows and check-ins. The receipt does not include check-in text or invite tokens. There is no automatic deletion date for this archive. [KEVIN TO CONFIRM: how long these restricted records should be kept, the reason, who may open them, and the purge process. Do not publish a specific period until you have chosen one.]
• Backups and provider logs. Account deletion does not include a documented job that hunts through provider backups. An internal note from October 26, 2026 said the project’s backup list was empty and point-in-time recovery was off. That was not rechecked for this draft. [KEVIN TO CONFIRM: whether backups or point-in-time recovery are enabled, how long any backup or log copy can remain after deletion, and how a restored backup would be reconciled.]
• On the device. Sign-out clears the cached profile used by the app. Account deletion also clears LoHi’s local keys and the reminders on that device. Keychain items can survive an app reinstall on the same iPhone. Uninstalling the app does not delete the server account.

Your counselor’s own files, exports they saved, and emails already sent are not erased by a LoHi deletion.

Deleting your account

Clients open Account, Privacy and Support from the check-in page. Counselors open Settings, then Manage My Account. Deletion asks for the current password and the word DELETE. The server checks that password, then deletes that signed-in user only. The app cannot delete a different person’s account by sending another user ID.

For a client, this deletes the login, profile, linked LoHi relationship, check-ins, and related invites, including an unlinked invite row that matches their confirmed email. For a counselor, this also deletes that counselor’s LoHi client relationships, those clients’ check-ins, and that counselor’s invites and practice record. The clients’ separate logins are not deleted.

The same cleanup runs if the login is deleted from the Supabase authentication dashboard, because it is tied to deletion of the auth user.

Steps and a few extra questions are on the Support page.

Your choices

• You can skip optional reminders and leave app lock off. Both are off until you turn them on. Notifications still require the phone’s permission.
• You can edit today’s check-in by saving again for the same date. The save replaces that day’s row.
• You can delete your LoHi account as described above, even if you do not currently have an active counselor in the app.
• You can ask your counselor to remove the LoHi relationship. That deletes the check-ins for that relationship and leaves your login in place.
• You can read your check-ins in the app. A copy, or a correction, is requested by email, as described in the next section. There is no export button.

Access, export, and correction

LoHi does not have a button that downloads your records. You can read your own check-ins in the app.

To ask for a copy of your check-in data, or to ask for a correction, email [email protected]. We verify that the request comes from you, and we send a copy of your check-in data within 30 days. If something in a check-in is wrong, name the date and what should change. Do not include your password or an invite code.

The copy is the check-in data stored in LoHi. It does not include records your counselor keeps in their own files, and it does not delete your account. The in-app Terms of Service describe this same email request. They do not describe an in-app export feature.

Age

You must be 18 or older to use LoHi. LoHi is not for minors, and it is not directed to children. The app does not ask for a date of birth. The Terms of Service require counselors to invite and use LoHi only with people who are 18 or older.

Where LoHi is offered

LoHi is offered to people in the United States. This policy is written for those users and for applicable United States law. Crisis numbers on this page and in the app are United States numbers: 911, 988, and 741741.

Changes to this policy

If this policy changes, the effective date at the top will change. The app already asks counselors and clients to accept a new version of the Terms, Business Associate Agreement, or Client Disclaimer when those document versions change. It does not have a separate acceptance step for this privacy policy. [KEVIN TO CONFIRM: how you will tell users when this policy changes, for example by email or an in-app notice.]

Where this differs from text in the app

This policy follows the code when the two disagree.

• The confirmation screen reports whether the agreement email was actually accepted by the email provider. Saving the signature does not depend on that email. There is no PDF attachment.
• Agreement and disclaimer records use a field named IP address. The value written by the app is a device label, not a network IP address, plus a user-agent string.
• The Client Disclaimer describes “mood and stress tracking.” The check-in also saves energy, sleep, and the written answers listed above. The shorter Privacy and Data screen is consistent with the code on the points it states: account and relationship details, ratings, written reflections, accepted agreements, Supabase, Resend, Sentry, on-device reminders, and what deletion removes or keeps. It does not yet mention the on-device counselor cache, the reduced Sentry payload, or the private deletion archive in this much detail.
• The Terms of Service now say there is no in-app export button, and that a copy of check-in data is requested by email to [email protected]. The activity log still has a label for a data-export event, and no code records that event. The agreements screen can still offer a download that only shows a message. It does not create a file.

Open items before publication

Replace each of these, then have a lawyer review the page.

1. [KEVIN TO CONFIRM: the From address and wording of those Auth emails.]
2. [KEVIN TO CONFIRM: the Sentry retention period, and whether Sentry still stores an IP address from the connection even with default personal data turned off.]
3. [KEVIN TO CONFIRM: the provider contracts, regions, and whether any of them use LoHi data for their own advertising. Nothing in the app asks them to.]
4. [KEVIN TO CONFIRM: the people, besides you, who can sign in to Supabase, Resend, Sentry, or Apple developer accounts.]
5. [KEVIN TO CONFIRM: the Supabase region. An internal draft said US West. The app source does not record the region.]
6. [KEVIN TO CONFIRM: whether a HIPAA business-associate agreement is in place with each provider that can handle client information, and whether the Supabase HIPAA add-on is enabled.]
7. [KEVIN TO CONFIRM: how long these restricted records should be kept, the reason, who may open them, and the purge process. Do not publish a specific period until you have chosen one.]
8. [KEVIN TO CONFIRM: whether backups or point-in-time recovery are enabled, how long any backup or log copy can remain after deletion, and how a restored backup would be reconciled.]
9. [KEVIN TO CONFIRM: how you will tell users when this policy changes, for example by email or an in-app notice.]
10. [KEVIN TO CONFIRM: that the live Resend setting INVITE_EMAIL_FROM is [email protected]. If that setting is empty, the code falls back to LoHi <[email protected]>.] This item is also on the Support page.
11. [KEVIN TO CONFIRM: anything else you want a new counselor to send, such as a copy of a license.] This item is on the Support page.