Privacy · plain language
What's shared, and what's not.
NextChapter gives you a phone, a line, and a Companion. Here is exactly what we keep, who can see it, and what you control — in the words we would use face to face. The same page is the reference for every city and state that reviews the program.
Foster & Adoption Support · version 0.2 · effective September 4, 2026
Five promises
In plain wordsWe keep the least we can, your words belong to you, only the right people can see anything, cities get numbers not names, and nobody sells your data or trains an AI on it.
- Least data. We collect what it takes to keep you connected — not a case file.
- You own your story. What you say to the Companion is yours. Sharing anything beyond safety is opt-in, and you can turn it off.
- Role-limited access, enforced in the database. A Navigator's query physically cannot return another Navigator's youth. Partners cannot query rows at all.
- Aggregates for partners, never rows. Cities, agencies, and funders see program-level numbers, and nothing at all when fewer than 5 people are behind a number.
- No selling, no advertising, no model training. Ever.
What we collect, and who can see it
In plain wordsYour name, how to reach you, your check-in answers, your goals, and what happens when someone helps you. Your Navigator sees those. Your chats stay with you.
| What | Why | Who can see it |
|---|---|---|
| Preferred name, pronouns, date of birth, phone, email, county | Enrollment, age-based eligibility, staying in touch | You, your Navigator, the program admin |
| When and how you left care, your referring worker | Eligibility for state programs, a warm handoff at exit | Your Navigator, the program admin |
| Check-in answers and pillar scores (Healthy · Safe · Happy & Successful) | Knowing how you're doing, routing help | You, your Navigator, the program admin; aggregated for partners |
| Companion conversations | The service itself | You only. A short excerpt is shown to your Navigator if a crisis is flagged. |
| “Voice” answers (anything you want your state to know) | Policy feedback | You; aggregated themes for partners only if you opted in |
| Flags and contact notes | Escalation and follow-up | Your Navigator, on-call Navigators (crisis), the program admin |
| Device, line, service status | Running the program | Navigator, program admin |
| Notifications we sent you | Delivery and dispute resolution | You, the program admin |
| Audit log | Accountability | Program admin, operator |
We do not collect location history, contacts, photos, browsing, or app usage beyond what is listed.
Your chats with the Companion
In plain wordsChats are private except when safety is at risk or a crisis is flagged. Then a real person steps in, because your safety matters most.
Every message you send is checked on our servers for crisis language before any AI is involved. If it matches, the AI is not called; you see a fixed, human-written message with 988 and your state's lines, and a Navigator is paged. The Navigator sees only a short excerpt of the sentence that triggered it — never the conversation.
Outside of that, no staff member can read your conversations. Not your Navigator, not the program admin, not us. The database enforces it, not a policy document.
The selected AI provider — Meta by default, or Anthropic only when we explicitly configure it — receives the conversation, verified resource directory, your preferred name, optional pronouns and city or county, and current date and resource-availability context for each reply. NextChapter does not use your information to train AI models. Read more in how we keep you safe.
What you control
In plain wordsWhen you enroll you agree to three things. Everything else is a switch in the app you can flip any time.
Required to join: the terms of use, this privacy notice, and that your Navigator can see your check-ins. NextChapter cannot run without those three. You can request account deletion in the iOS app at Settings > Data & Privacy > Request Account Deletion, through your Navigator, or by contacting us.
Optional, in Settings and the privacy screen: share your de-identified “Voice” answers with your state · let your de-identified check-in data improve services · texts · push notifications. Every change is recorded with a timestamp, so there is always a clear record of what you chose and when. We ask you to confirm your choices once a year and whenever the terms change.
Reporting a Companion response
In plain wordsYou can choose to report an AI response from inside the Android app.
When you send a report, we store the response you selected and your explanation with your account identifier in our audit log. NextChapter developers and authorized program administrators can review this information to investigate harmful content and improve Companion. Reporting does not share your whole conversation and is not a request for urgent help.
What cities and states see
In plain wordsCounts and percentages. How many people enrolled, how many checked in, how many got connected, how many escalations were resolved. Never a name, never free text.
Partner scorecards contain program-level numbers only: enrollment, check-in completion, connections made, escalations opened and resolved, pillar trends, and the opt-in Voice themes. Any cell with fewer than 5 participants behind it is suppressed. Partners receive a methodology page describing every metric, and CSV exports carry the same suppression.
How it's protected
In plain wordsLocked at the database level, encrypted, invitation-only for staff, and every staff look at youth data is written down.
- Postgres with row-level security on every table; service credentials only in trusted server code.
- Encryption in transit (TLS) and at rest; secrets live in the hosting platform, never in the code.
- Staff sign in by invitation only, with roles per program; crisis pages go only to on-call Navigators.
- Every staff read or export of youth data is written to an append-only audit log.
- Companion requests include the current conversation, verified resource directory, your preferred name, optional pronouns and city or county, and current date and resource-availability context.
How long we keep it
In plain wordsWhile you're in the program, then two years for outcomes reporting, then it's deleted. Your chats can be deleted whenever you ask.
- Active enrollment: kept for the length of the program relationship.
- After exit or graduation: identifying data kept 24 months for the outcomes follow-up agreed with the state, then deleted; aggregates are kept.
- Companion conversations: kept while you are enrolled; you can ask for them to be deleted at any time; deleted within 30 days of exit unless you ask to keep an export.
- Audit logs: 7 years.
You (or your legal representative) can request an export or deletion in the app, through your Navigator, or at privacy@fostersupport.org. See the public account deletion instructions. We fulfil requests within 30 days unless a safety hold, law, audit requirement, or program obligation requires us to retain particular records.
Who else touches it
In plain wordsA hosting company, a database company, the AI provider, the messaging providers, and the phone carrier — each only sees the slice it needs.
| Provider | Purpose | Data |
|---|---|---|
| Vercel | Hosting | Request logs |
| Supabase | Database and sign-in | All application data |
| Selected AI provider — Meta by default; Anthropic only when configured | Companion AI and safety classification | Conversation text, verified resource directory, preferred name, optional pronouns and city or county, and current date and resource-availability context |
| Resend · Twilio · Apple Push (when enabled) | Email, SMS, push | Contact address and message text |
| Carrier partner | Device and line | Line number, device identifiers, service status — no app content |
Questions
In plain wordsAsk your Navigator, or write to us directly.
privacy@fostersupport.org · Foster & Adoption Support, Dallas, Texas. Program staff and reviewers can request the full engineering framework and the safety protocol at the same address.