Draft privacy notice

What this test application handles

Account details, optional emergency-contact information, consent records, time-limited or until-stopped location-sharing sessions, check-ins, incidents, text messages and audio-session metadata. Demonstration records are fictional.

Invitations and policy records

Only invited accounts can access the service. Your name and personal invitation link can be sent to your email address using Resend. We record the version and server time of your use-terms acceptance and privacy-notice acknowledgement. These records do not grant microphone or location permission.

Your choices

Location and microphone sharing are off by default. Sending SOS requests location sharing subject to device permission; you can stop it. In Sharing choices you can choose manual location sessions, location during an open SOS incident, or location whenever the app is open. You can separately agree to start live microphone sharing after an SOS is received. Browser permission is still required. You can change these choices or stop sharing at any time. Stopping location switches its automatic setting back to manual. Withdrawing microphone consent disables future automatic SOS audio. Live audio sessions last up to 15 minutes. Live listening is not saved. Optional SOS audio clips require separate consent: up to 60 seconds per clip, sent as private incident messages, retained for 30 days, then deleted. Assigned operators and administrators can listen; your own account can also access its recordings. No transcription is made. Recording stops when you stop it, after 60 seconds, or when the device interrupts it. An upload failure does not cancel your SOS.

Automatic location sessions renew while your chosen conditions apply. Resolving an incident ends location started for that incident, but does not end a separate manual or whenever-open location session. Phone screen lock and browser suspension can interrupt updates and audio. Operations sees the time and accuracy of the last received position.

Travel check-ins

Checking in at an approved location sends a fresh device position, its accuracy, the selected place and a timestamp to authorised operations. You can opt into departure checks for up to four hours, or until your existing sharing session ends. Two fresh positions clearly outside the boundary are required for an automatic departure alert. Keep the app open and your phone awake; otherwise check out manually. Stopping monitoring or losing updates does not prove you have left or remained safe.

Suggested locations remain unapproved until an operator reviews them. Approved location names, addresses and boundaries are visible to authorised operations and the users assigned to them, or all users if operations chooses organisation-wide access. Assignment changes do not erase your own past check-in records. Arrival and departure records, including the position attached to an event, follow the check-in history retention period. Unclosed check-ins and pending suggestions remain until reviewed or ended; related history is retained together.

Who can see information

Your own records and authorised operations personnel within your assigned organisation. Internal operator notes are restricted to operations. Configured service providers may process authentication, hosting, location map requests and audio transport.

Operational email alerts

When configured, Resend sends generic arrival/departure notifications to the organisation’s operations contact. Emails contain the event type, time, an event reference and a protected dashboard link, without the user’s name or precise location. The sending region is Ireland; Resend stores email content and service records in the United States. Provider acceptance does not confirm inbox delivery or operator acknowledgement. Email sending can be delayed by connection failures or provider limits.

Phone sharing and notification previews

In the native app, you can share for one hour or until you stop. With Always location permission the app requests background updates, including with the screen locked. Operating-system restrictions, loss of connectivity and force quitting can interrupt collection. The target is approximately one update every 30 seconds, not guaranteed. No offline trail is stored for later upload.

When you enable notifications, Operations messages and group messages queue phone notifications. Event and flight notifications can show a brief overview on your lock screen. Private incident conversation text stays inside the signed-in app. Notification previews are processed by the push provider and Apple or Google; you can hide lock-screen previews in phone settings.

Trips, alerts and optional notifications

The travel feature stores itineraries, accommodation and transfers, planned movements, alert relevance, safety responses and notification preferences. Your itinerary does not turn on location tracking or prove that you travelled. Current-country confirmation expires after 24 hours. Private operations notes are not shared with travellers. An assistance response uses the existing incident process; an “I am safe” response does not close an incident.

Flight data and push connections are awaiting activation. When enabled, flight lookup sends flight identifiers and dates to the configured supplier. Optional push uses Expo and Apple or Google delivery services, or your browser’s push provider. Device tokens and subscription endpoints are stored privately. Incident-message notifications and operations emails use generic text and an authenticated link. Flight and event previews may identify the flight or affected area and describe the update. They do not include private incident messages, medical details or precise GPS coordinates. You can disable notifications in Account or device settings and still read the Inbox.

The proposed travel retention setting is 30 days after trip archival or alert expiry, with linked assistance records retained for case review. Active itineraries and unresolved cases are not automatically erased by this setting. This new retention decision and supplier storage terms require review before activation. Protected travel records are kept in memory on the device while signed in, not in the public offline cache.

Maps

Address search sends the text you type to Google Maps to suggest matching places. Choosing a result fills its address and coordinates; you can adjust the map pin before submitting it to Cambrai. Searching for an address does not request your device’s current location.

When Google Maps is configured, loading a map sends map-area requests and normal browser connection information to Google. Map pins use positions already received under your sharing choices. Opening a map does not start a new location-sharing session. If Google Maps cannot load, the app may show OpenStreetMap instead. These providers have their own Google privacy policy and OpenStreetMap privacy policy.

Retention and deletion

The development assumptions are one day for location samples and 30 days after resolution for incident records. Administrators can change these periods and run retention. An attached incident position can remain until the incident is removed. Deletion requests require review and are not automatic deletion confirmations.

Review before real use

The responsible legal entity, purposes and lawful bases, provider agreements, international transfers, individual rights, approved retention, complaint route and contact details all require confirmation before real personal data is collected. No compliance certification or guarantee is claimed.

Notice version: privacy-2026-09-18-draft. No advertising or behavioural analytics are included.