CRYSTAL METH ANONYMOUS
Effective Date: November 9, 2026
This policy explains how Crystal Meth Anonymous (“CMA”, “we”, “us”) uses the personal data that we collect from you when you use the CMA App (the “App”). CMA is a nonprofit corporation organized under the laws of the State of California, with its mailing address at CMA General Services, 1920 Hillhurst Ave #1315, Los Angeles, CA 90027. For users in the European Economic Area (“EEA”) and the United Kingdom (“UK”), CMA is the data controller responsible for your personal data under the EU General Data Protection Regulation (“GDPR”) and the UK GDPR, respectively.
What Data We Collect
CMA collects information you provide when registering for and using the App, including a username; either an email address or mobile telephone number, depending on your selected sign-in method; and your recovery or sobriety date, including subsequent changes to that date. Your recovery or sobriety date is required during registration. You may also provide an optional profile image and create content through the Circles feature, including posts, comments, images, and other interactions. The App also maintains information about your Circle memberships, saved meetings, selected subscription plan and subscription period, and gift-code redemptions. If you sign in using your mobile number, the App generates a placeholder email address for account-management purposes; you are not required to provide a personal email address through that sign-in method.
Optional subscriptions are processed through Apple In-App Purchase or Google Play Billing, as applicable. CMA does not receive your payment card information. Subscription payments, cancellations, renewals, and refunds are handled through the applicable app store.
Because CMA is a fellowship for people recovering from addiction, certain information collected through the App, including recovery or sobriety dates and Circles communications, may reveal information about a user’s health or recovery. A recovery or sobriety date is required to register for the App, while posting or commenting in Circles is optional. CMA uses this information to provide the App’s recovery-related features and related services. Service providers assisting with the operation of the App may process this information on CMA’s behalf. CMA does not use recovery-related information for third-party advertising.
The App includes a Circles feature through which users may participate in groups and share posts, comments, images, and other content. Users are automatically enrolled in CMA’s default Circle for general announcements and updates and may leave that Circle. Content shared within a Circle is intended to be accessible to its authorized members. Users should exercise care when sharing personal or recovery-related information because other members may retain or disclose information they receive.
Technical and Usage Information
When you use the App, CMA and its service providers may process technical information, including IP addresses, app-instance identifiers, device platform information, push-notification tokens, and information about your interactions with the App. Firebase Analytics collects usage events relating to features such as registration, verification, subscriptions, meetings, recovery milestones, readings, and Circles activity. Technical information may also be processed by the third-party services supporting authentication, hosting, notifications, maps, meeting information, and other App functionality. Certain notification-related information, including notification content, Circle identifiers, and associated contact or device information, may also be recorded in AWS CloudWatch logs.
How Do We Collect Your Data?
CMA collects information directly from users when they register, update their recovery or sobriety dates, participate in Circles, save meetings, select subscription options, or otherwise interact with the App. CMA and its service providers also automatically collect or process certain technical and usage information, as described above. If you permit the App to access your device’s location, that information is used during your session to identify nearby meetings and may be transmitted to mapping or geocoding services. Your device coordinates are not stored in your user profile.
How Will We Use Your Data?
CMA stores your data so that we can manage your account and keep your preferences and communications available for you when you use the App. We use your selected email address or mobile telephone number to send account verification codes and other authentication-related communications. CMA uses third-party service providers to operate and support the App, including Amazon Web Services for authentication, hosting, storage, and SMS verification; Firebase for analytics and push notifications; and mapping, geocoding, meeting-information, and media services to provide applicable features. These providers may process information necessary to deliver their respective services. CMA does not sell users’ personal information or share it for third-party advertising purposes.
Legal Bases for Processing (EEA and UK Users)
- To register users, maintain their accounts, provide authentication, and deliver the App’s requested features.
- For processing activities for which consent is required, including certain optional functions and the processing of recovery-related health information where CMA relies on explicit consent.
- To maintain security, prevent misuse, respond to support requests, and operate and improve the App, where those interests are not overridden by users’ rights and freedoms.
- Where information must be processed or retained to comply with applicable law.
Recovery-related information may constitute special-category personal data under applicable European or UK privacy law. Where CMA relies on explicit consent to process that information, users may withdraw their consent by contacting CMA at app@cmagso.net, without affecting processing that occurred before withdrawal.
How Do We Store Your Data?
CMA uses Amazon Web Services, including servers in the Northern Virginia region of the United States, to host and store account information and other data associated with the App. Certain information is also processed by other service providers, including Firebase. CMA retains account information while an account remains active. CMA does not currently apply a fixed retention period to all categories of information. Certain records, including user-generated content, recovery history, technical logs, and backup information, may be retained for extended periods, including after an account is closed. Users may initiate account deletion through the Delete Account option in the App’s profile menu. This process removes the user’s sign-in account, but certain associated records may remain in CMA’s systems without their former account association. Some retained records may continue to contain information that identifies or could reasonably be associated with a user. Users may contact CMA at app@cmagso.net to request deletion of additional personal information, subject to applicable law and any legitimate retention requirements.
International transfers. CMA is based in the United States, and its primary application data is hosted in the United States. Service providers may process personal information in other countries. Where applicable law requires additional safeguards for international transfers of personal information, CMA will use a legally recognized transfer mechanism appropriate to the processing arrangement.
Mobile Information & SMS/Text Messaging
This section describes how CMA uses your mobile phone number and applies specifically to the OTP sign-in and verification feature of the App.
- Purpose. Your mobile number is used to send one-time verification codes for signing in to the App and related authentication purposes. CMA does not use SMS verification messages for marketing or promotional communications.
- Consent. If you select SMS verification and enter your mobile number, CMA will send a one-time verification code by text message to the number you provide. You may choose email verification instead.
- Message frequency. Message frequency varies and is generally limited to one message per sign-in or verification attempt.
- Message and data rates. Message and data rates may apply, as charged by your mobile carrier.
- Opt-out. Users may choose email verification instead of SMS verification during registration. Users who wish to discontinue SMS verification or change their authentication method may contact CMA at app@cmagso.net for assistance.
- Help. For assistance with SMS verification, please contact CMA at app@cmagso.net.
- Carriers. Carriers are not liable for delayed or undelivered messages. CMA does not guarantee delivery of any SMS message.
- No sharing for marketing. Your mobile number and SMS opt-in status will not be shared or sold to any third party or affiliate for marketing or promotional purposes.
- Storage. If you choose SMS verification, your mobile number is processed through CMA’s AWS authentication services and retained in accordance with the data retention practices described above.
Marketing
We will never send you any information about products or services other than those directly related to the functioning of the App (updates, new features, etc.), and, where you have opted in, SMS verification codes as described above. CMA may send operational communications necessary to provide the App, including account verification messages through the contact method you select and notices concerning App functionality.
What Are Your Data Protection Rights?
CMA wants to make sure that you are fully aware of all of your data protection rights. Depending on your location and applicable law, you may have some or all of the following rights concerning your personal information:
- You have the right to request CMA for copies of your personal data. We will provide the first copy free of charge; we may charge a reasonable fee for additional copies only where permitted by applicable law.
- You have the right to request that CMA correct any information that you believe is inaccurate. You also have the right to request that CMA provide you with complete information you believe is incomplete.
- You have the right to request that CMA erase your personal data, under certain conditions.
- You have the right to request that CMA restrict the processing of your personal data, under certain conditions.
- You have the right to object to CMA’s processing of your personal data, under certain conditions.
- You have the right to request that CMA transfer the data that we have collected to another organization, or directly to you, under certain conditions.
- Where we process your data on the basis of consent, you may withdraw that consent at any time.
- If you are in the EEA, you have the right to lodge a complaint with your local data protection supervisory authority; if you are in the UK, with the Information Commissioner’s Office (ico.org.uk).
If you make a request, we will endeavor to respond promptly, but for some users it may take up to 30 days (or one month for EEA/UK requests; where applicable law permits an extension, we will notify you before the original deadline expires). If you would like to exercise any of these rights, please contact us at our email: app@cmagso.net Or write to us at: CMA General Services, 1920 Hillhurst Ave #1315, Los Angeles, CA 90027
Users in the EEA and the United Kingdom
CMA offers the App to users in the European Economic Area, including Germany and France, and the United Kingdom. Where the GDPR or UK GDPR applies, users have the rights described above, subject to applicable conditions and exceptions.
Children and Eligibility
The App is intended for adults age eighteen (18) and older. Users must be at least eighteen (18) years old to register for or use the App. CMA does not knowingly collect personal information from children under eighteen. If you believe that a minor has provided personal information through the App, please contact app@cmagso.net.
Changes to Privacy Policy
CMA keeps its privacy policy under regular review and places any updates in the App and on a similar web page. This privacy policy is effective as of November 9, 2026. If you have any questions about CMA’s privacy policy, the data we store for you, or you would like to exercise one of your data protection rights, please do not hesitate to contact us.
Email us at: app@cmagso.net
Or write to us at: CMA General Services, 1920 Hillhurst Ave #1315 Los Angeles, CA 90027