Privacy policy

This policy describes the current development implementation. Production configuration and external provider verification remain pending; do not rely on an unverified development deployment for emergencies.

Data we process

Accounts store an email address and a password hash. Safety sessions store activity, expected-safe time, check-ins, resolution state and optional destination, battery and location. Consented Guardian phone contacts and Safety Capsules are encrypted in server storage. Native devices also store preferences, session history and offline event queues. The web companion stores its account token and local state in your browser.

Who can see it

Authenticated owners can access their sessions. Signed Guardian links are temporary, scoped to one session and revocable. Anyone possessing a live link can use that access, so share it only with trusted people.

Status Only excludes location. Approximate mode rounds coordinates. Precise On Escalation hides coordinates until the authorized escalation state. Guardian capsule responses include only a limited allowlist of instruction, destination, battery and expiry fields; raw contact and medical notes are excluded.

Providers and billing

If configured, Twilio receives a consenting Guardian’s phone number and a generic overdue-session message. A push webhook provider receives session and account identifiers, stage and Guardian role, but no location or capsule. RevenueCat and the relevant store process native subscription transactions. SafeCircle stores entitlement state and customer identifiers, not payment card information.

Retention and deletion

The worker checks capsule expiry every 15 seconds and clears expired server capsule content. Completed or obsolete delivery job payloads are cleared after 24 hours. Account/session/event records remain until account deletion. Signed-in users can delete their account with password confirmation in native account settings or the web companion; pending monitoring ends and old access tokens are revoked. A minimal random account identifier tombstone prevents old tokens from recreating deleted data. Encrypted backups may retain data until their operator-defined retention period ends.

For provider-held data or backup deletion requests, open a support issue asking for a private contact channel. Do not post the data itself. Clear browser site data or uninstall the app to remove local data. Production operators must use persistent storage, independent secrets and backup access controls.

Your choices

Location sharing and Guardian SMS consent are optional. You can revoke Guardian links, change privacy settings, extend a session or mark it safe. Resolution cancels pending alerts, but an already accepted message cannot be recalled. Core safety functionality is free.

Demo data and children

The public simulated demo uses fictional data and sends no alerts. SafeCircle has not established a production process for children’s accounts or parental consent. Use consenting adult test participants until appropriate controls are implemented.

Contact

Use SafeCircle GitHub Issues to request a private support channel. This is a public issue tracker, not a private inbox.