GUARDIAN
Guardian Privacy Policy
Effective date: [FILL]
Guardian is a personal-safety app made by [FILL: your LLC's legal name, or "Jared Reiter" until it exists] ("we", "us"). This policy explains what Guardian collects, why, who sees it, how long we keep it, and how to delete it. The short version:
- We collect what Guardian needs to get you home and to alert the people you chose. Nothing else.
- We never sell your data, show ads, or track you across other apps and websites.
- Walk routes, SOS locations and safety events are deleted automatically after 30 days.
- You can download or delete everything from the app: Settings › Your data.
1. What we collect
Your account. When you sign in with Google we receive your name, email address and Google account ID. We don't get your Google password or anything else in your Google account.
Your circle. The names, phone numbers and relationship labels of the people you add as safety contacts, and whether each of them has accepted (replied YES) or opted out (replied STOP). These are other people's details: only add people who expect to hear from you (see section 4).
Location, only when it does a job:
- During a Walk Me Home walk: your location every few seconds, including when your phone is locked, so your circle can follow along. This stops when the walk ends.
- When you send an SOS: your location at that moment.
- When you contribute to the map (mark a streetlight, report a hazard, add a photo): where you were standing, so others can trust it was checked in person.
- While the app is open: to draw the map around you. This stays on your phone except for the map requests described in section 3.
Safety events. Check-ins, missed check-ins, alerts, "are you OK?" prompts that you answered or didn't, and whether a duress code was used. Phone battery level when it's nearly empty during a walk.
Texts and calls we send for you. Who we tried to reach, when, for what (for example "walk started", "SOS") and whether it worked. We do not store the text of those messages or your contacts' phone numbers in these logs.
Photos you choose to attach to a map report or tree edit, with the location they were taken.
Your conversation with Solara, Guardian's built-in companion: everything you and Solara say to each other, kept as one ongoing conversation so she remembers it, plus a short summary of the older part. Solara can only propose remembering a fact about you; it's saved only if you tap Yes. [DECIDE: keep the conversation until you delete your account (current behavior), or expire it like walks?]
Settings, such as your home address if you save one for Walk Me Home, your check-in timer, and points (XP) you've earned.
Camp Solara (the Moon Base) and bunks [NEW 2026-10-10: check against the build you ship]. If you use them: your camp progress (coins, badges, scores) so it follows your account; your camper's look; the name you use in each bunk; bunk chat messages and reactions; where your camper is inside the game (never your real location); beds, cubbies and decorations you place; marker tags you draw; game and fitness results you choose to share with a bunk (fitness shows age groups, never weight); people you block; and reports you send. In the Clubhouse and Gallery: the display name you choose, projects, updates and posts. Reports about content are kept, with a copy of what was reported, so a person can review them.
The camera, in the HUD. When you open the HUD, Guardian shows your camera's live view on screen with labels on top. Those images are never recorded, stored or sent anywhere, by us or anyone else.
On your phone only (never sent to us): your end-walk PIN and duress PIN (stored as a one-way hash in the iPhone Keychain), a cached copy of your circle so SOS works without signal, and map caches.
We do not collect your contacts list, health data, financial data, browsing history or advertising identifiers. We don't use analytics or crash-reporting services today [update if Sentry or similar is added].
2. How we use it
Only to run Guardian: show your walk to your circle, alert them if you don't check in or send an SOS, text the "Reply YES" confirmation to new contacts, keep the map accurate, stop abuse (rate limits, fraud prevention), and fix things that break. We don't use your data to train AI models, build advertising profiles, or for any purpose unrelated to keeping you safe.
3. Who sees it
Your circle. When you start a walk, your confirmed contacts get a text with a private link. Anyone with that link sees your live position, destination and walk status. The link stops working 24 hours after the walk ends, or 48 hours after an alert. If you don't check in or you send an SOS, every contact you listed (even ones who haven't replied YES yet) gets a text and/or phone call with your location and the link.
Service providers who process data for us, under contract, only to provide their service:
| Provider | What they get | Why |
|---|---|---|
| Twilio | Your contacts' phone numbers and the text of alerts | Sending texts and calls |
| Vercel | Everything, encrypted in transit | Hosting the Guardian server |
| Turso | Everything, encrypted at rest | Database |
| Your sign-in | Sign in with Google | |
| Resend | Your account ID and a walk link, only if an alert failed to reach anyone | Paging our on-call person |
| OpenFreeMap, AWS terrain tiles | The map area you're looking at (tile-level, not exact) | Drawing the map |
| Open-Meteo | Your location rounded to ~100 m (weather) or ~1 km (air quality) | Weather and air quality |
| Anthropic | What you say to Solara, her recent replies, a summary of older ones, and memories you approved (only the non-sensitive ones) | Solara's replies (Anthropic doesn't train on this data) |
| Mapillary | The map area you're looking at, only if you added your own Mapillary token | Streetlight detections |
Map data services that never see you. Walking routes (Valhalla), streetlights, trees and safe places (OpenStreetMap's Overpass), nearby landmarks (Wikipedia) and official weather alerts (the US National Weather Service) are requested by our server on your behalf, so those services see our server, not your phone, and get your position rounded (about 10 m for routes, 100 m for safe places, 1 km for landmarks and weather alerts). One exception: if our server can't be reached when you ask for safe places nearby, the app asks OpenStreetMap directly (rounded to ~100 m), because finding help matters more.
Our on-call person. If an alert reaches nobody (for example every text failed), we're notified with your account ID and your walk link so a human can try to help. [DECIDE: who is on call, and what they do — "we may contact emergency services on your behalf" needs to be true if you say it.]
Law enforcement. Only when legally required (a valid subpoena, court order or warrant), or when we believe in good faith that disclosing is necessary to prevent imminent death or serious harm. We'll tell you about a legal request unless we're prohibited or it would put someone in danger.
If the company changes hands, this policy (or a stricter one) keeps applying to data collected under it.
We never sell or "share" (as California law defines it) personal information.
4. Your circle's information
People you add to your circle didn't sign up for Guardian. To respect that:
- The first text they get explains who added them and asks them to reply YES. Until they do, they only get emergency alerts, not routine walk updates.
- Replying STOP at any time stops all messages from Guardian. START turns them back on.
- A contact can ask us to delete their number at [FILL: privacy email]; we'll remove it from every circle.
- You promise that you have a reason to list each person and that the number is theirs.
5. How long we keep it
| Data | Kept |
|---|---|
| Walk location trail, walk records | 30 days after the walk ends |
| SOS records, safety events, text/call logs | 30 days |
| Map votes and photo locations | Exact for 30 days, then blurred (votes to ~1 km, photos to ~100 m) |
| Streetlights, reports and tree edits you added | While useful to the map; anonymized if you delete your account |
| Account, circle, settings, XP | Until you delete your account |
| Camp progress, bunk memberships, messages, tags, blocks | Until you delete them or your account [DECIDE: expire old bunk chat?] |
| Reports about content | Until reviewed [DECIDE: how long after review]; the copy of a deleted account's content is removed |
| Backups | Up to [FILL: Turso backup retention, e.g. 7 days], then overwritten |
| Security logs (sign-in failures, rate-limit hits) | [FILL: e.g. 90 days] |
6. Your choices and rights
- Download your data: Settings › Your data › Download my data (a JSON file of everything we hold about you).
- Delete your account: Settings › Your data › Delete my account and data. It's immediate and permanent (backups age out per section 5). Map contributions stay without your name.
- Location: iOS Settings › Guardian › Location. Walk Me Home needs "Always" to keep working with the phone locked; everything else works with "While Using".
- Sign out everywhere: [FILL: add a button, or "email us"]. The server supports revoking all sessions.
- Depending on where you live (for example California, Colorado, Virginia, the EU or UK), you may have rights to access, correct, delete or port your data, and to object to or restrict processing. Email [FILL: privacy email]; we'll answer within 30 days. We won't treat you differently for using these rights.
- EU/UK: our legal bases are performing our contract with you (running Guardian), our legitimate interest in preventing abuse, and protecting someone's vital interests when an alert goes out. [DECIDE: do you offer Guardian outside the US at all? Texts only go to US/Canadian numbers today.]
7. Children
Guardian is for people [DECIDE: 13+ with a parent's permission / 16+ / 18+]. We don't knowingly collect data from children under 13. If you believe a child under 13 is using Guardian, email us and we'll delete the account.
8. Security
Encryption in transit (HTTPS) and at rest; sign-in tokens stored in the iPhone Keychain; PINs never leave the phone; strict per-account limits on texts and calls; access to production data limited to [FILL: who], with two-factor authentication. No system is perfectly secure: if a breach affects you, we'll tell you as the law requires.
9. Changes
If we change this policy in a way that matters, we'll tell you in the app before it takes effect.
10. Contact
[FILL: legal name, postal address, privacy email]
Questions: support@guardianwalk.com