Privacy Policy

1. Who we are

Safely is a family location app built and operated by the Safely team. Contact: privacy@safelyapp.vercel.app.

2. Data we collect

We collect only what is required to make Safely work:

• Precise location — so we can show your family your position on the map and send arrival alerts. Linked to your user identifier.
• User identifier — a Supabase-generated UUID linked to your Apple Sign In, used to route data between family members.
• Email (via Apple Sign In) — we only receive the relay email Apple gives us, unless you choose to share your real one.
• Purchase history — managed by Apple's StoreKit; we see subscription status, never card numbers.
• Product interaction — anonymous, aggregate usage counters (e.g. how many times the map was opened this week) to improve the app. Not linked to your identity.
• Crash diagnostics — standard Apple-provided crash reports, opt-in at the OS level.

3. What we do not collect

We do not collect your contacts, photos, microphone, advertising identifier, browsing history, or any data outside the app. We have never collected these, and we commit never to.

4. How we use your data

• Show your family your location on the map.
• Send arrival and departure alerts to your family when you enter or leave a saved place.
• Authenticate your session via Apple Sign In.
• Process your subscription through Apple.
• Diagnose crashes and improve the app.

5. Who we share it with

We share data only with infrastructure providers who process it on our behalf under strict confidentiality contracts. These are:

• Supabase (our backend host) — stores encrypted location data and family membership data in the EU or US region closest to you.
• Apple — processes Sign in with Apple and your subscription payment.
• Vercel — hosts this website (not the app).

We do not sell data. We do not share with advertisers, data brokers, or analytics companies. Period.

6. How long we keep it

• Real-time location: the latest position only.
• Location history: 30 days rolling window, then auto-deleted.
• Account data: until you delete your account, then removed within 30 days.
• Purchase records: retained as required by tax and audit law (typically 7 years).

7. End-to-end encryption

Location payloads are encrypted on your device before they leave it, and decrypted only on the devices of your family members. Safely's servers cannot read your locations.

8. Your rights

You have the right to:

• Access — request a copy of your data.
• Correct — update anything that's wrong.
• Delete — remove your account and all associated data.
• Export — receive your data in a portable format.
• Withdraw consent — at any time, with no penalty.

Under GDPR (EU/UK) and CCPA (California), you have additional rights including the right to know, the right to opt out of any sale (not applicable — we don't sell), and the right to non-discrimination.

9. Children under 13 (COPPA)

Safely is designed to be used by families, including minors. Accounts for children under 13 must be created and managed by a parent or guardian. We do not knowingly collect personal data from children under 13 except what is necessary to run the service, and only with verifiable parental consent. Parents can review, delete, or refuse further collection at any time by contacting privacy@safelyapp.vercel.app.

10. International transfers

If you are outside the country where our servers are located, your data will be transferred, stored, and processed in that country. We use standard contractual clauses and host on providers with SOC 2 Type II certifications.

11. Security

We use end-to-end encryption in transit, AES-256 at rest, TLS 1.3 for all network calls, and Supabase Row Level Security. No system is perfect, but we design as if yours wasn't either.

12. Changes to this policy

If we change this policy, we will notify you in the app and by updating the date at the top. Material changes require your continued use after a clear in-app notice.

13. Contact

Privacy questions: privacy@safelyapp.vercel.app. We respond within 48 hours. For data requests, include the email linked to your Apple ID so we can verify identity.