Privacy Policy

Who we are

Stephen Muzzeroll, carrying on business as Guardian Pin, provides Guardian Pin. Contact privacy@guardianpin.app. Governing law: Alberta and the federal laws of Canada applicable there.

Account

Account. You sign in with your Apple or Google account; we receive your name and email (or Apple's private relay email). The PIN that locks this device stays on the phone and is not uploaded. The app generates a random device identifier (a UUID) and sends it to the Guardian Pin API so this install can be recognized.

That identifier is cleared when you sign out and when the account is deleted. Guardian Pin is for people who are old enough to use it where they live: 13 or older in the United States and Canada, 14 or older in Quebec, and 16 or older everywhere else. It isn't designed for children, and we don't knowingly collect information from anyone younger.

If you think a younger child has signed up, please contact us and we'll delete the account.

Contacts

Contacts. You may add people by phone number and email. If you allow it, Guardian Pin reads your phone address book so you can import the people you choose. The app never writes to or deletes the phone’s contacts. Only contacts you save in Guardian Pin are sent to the Guardian Pin API. The rest of the address book is not uploaded. There are no invites.

Alerts

Alerts. Alerts go only to your primary circle. Contacts are notified only by email. Each contact gets their own alert link. There is no login, so anyone who has the link can open it. The link stops working when the alert ends, or 26 hours after it was sent, whichever comes first. After the alert ends, the page shows only that the alert has ended, with no name, location or map. Guardian Pin does not send push notifications to contacts, SMS, or WhatsApp.

Maps

The alert email includes a still map of where you were when it was sent. That picture is drawn on our own servers by Guardian Pin's own OpenStreetMap renderer, and it is credited © OpenStreetMap contributors. No location is sent to an outside map provider to create that email image.

The email and the private alert page also offer plain Open in Maps links to Google Maps, and a link to Apple Maps. These are ordinary links. Nothing is sent to Google or Apple unless a contact taps a link, and then that company's own privacy terms apply. The map in the app on your phone may still load tiles from tile.openstreetmap.org.

That sends the OpenStreetMap Foundation the map area being viewed and this device's IP address. The tile servers see the approximate map area and the IP address. There is no satellite map and no satellite call.

Alert email

Alert email. When you start an alert, Guardian Pin emails the contacts you chose in your primary circle, and no one else. The email contains your name, the local time of the alert, the circle name, your last known location when the email is sent, with an Open in Maps link to Google Maps and a link to Apple Maps, the Medical ID sections you shared with that circle, and a private link to the alert page.

The email is a one-time snapshot. It is not updated after it is sent. While the alert is active, the alert page shows live location.

It also includes a map image drawn on our own servers from OpenStreetMap data and embedded in the email. Any Near address in the email is produced on our own servers too. No location is sent to an outside map provider to create that email image. © OpenStreetMap contributors.

If no map can be drawn, the email is sent without the image. Location and Medical ID are included only in emails sent while an alert is active, and Medical ID only if you shared it with that circle. When the alert ends, your contacts get an alert ended email.

It contains no link and does not include your location or Medical ID. Test alert emails do not include your location or Medical ID either. The alert email has no third-party tracking.

Location

Location. Location is optional. If you allow it, Guardian Pin uses your phone's location during an alert you start. Share live location during alerts is on by default.

While that setting is on and the alert is active, the app takes your location about every 15 seconds and sends it to Guardian Pin whenever your phone can reach the service. Samples taken while the phone is offline stay on the phone and are sent if it reconnects while the alert is active. Any still waiting when the alert ends are deleted from the phone.

Each location includes latitude, longitude, the accuracy your phone reports, and the time. Accuracy depends on your phone, its settings and the signal, and a location can be wrong by a large distance. Your live location is shared only with the contacts in the circle you alerted, through the private alert page.

The page updates about every 15 seconds. It shows a warning when there has been no update for 2 minutes. Anyone who has the alert link can see it during that time.

Live location stops when you end the alert with your PIN. If the alert is still active after 12 hours, live location stops automatically and the alert stays open. The page then shows Live location stopped at HH:MM.

Live location can also stop sooner, for example if your phone is off or loses battery or signal, if you turn location off, or if the phone's system closes the app. Location may be inaccurate, delayed, stopped early, or not reach your contacts. Guardian Pin cannot guarantee that your contacts will see your location, or act on it, in time. Test alerts never include location.

If you turn Share live location during alerts off, only the single starting location is sent. Some early test versions send only your starting location. Guardian Pin asks only for While Using the App location permission, never Always.

During an active alert, sharing continues if you leave the app or lock your phone, through an Android foreground service and the iOS background location mode. On Android, an ongoing Guardian Pin notification is shown while location is shared. It says Guardian Pin is running and does not mention an alert.

On iPhone, the system location indicator stays visible. Guardian Pin does not collect location when no alert is active. Live location samples are kept like other location data: they are deleted 30 days after they are captured, or earlier if you delete your account.

Email

Email. Guardian Pin uses Resend, our email provider, to deliver email, including alert email, the alert ended email, test alert email, and the confirmation from the web deletion form. Resend processes the full content of each email, including any location and Medical ID in it, and keeps a copy for up to 30 days. Resend stores this data in the United States.

Open and click tracking are turned off. Email is sent to our email provider over an encrypted connection and is delivered encrypted where the recipient's mail server supports it. It is not end-to-end encrypted. Once an email is delivered, your contact's email provider holds a copy.

Anyone who can read that mailbox, or who is forwarded the email, can see it. Guardian Pin cannot delete an email after it is delivered.

Hosting

Hosting. Guardian Pin is hosted on Fly.io in Toronto, Canada. The host processes IP addresses. The OpenStreetMap Foundation also receives the map area being viewed and this device's IP address when the in-app map loads tiles from tile.openstreetmap.org. The Foundation is not a processor under a contract with Guardian Pin.

Recordings

Recordings. If you allow the camera and microphone, Guardian Pin records short video clips with sound on your phone during an alert you start. A Recording indicator stays on the live alert screen the whole time, so it is never secret. Your phone uploads each clip to Guardian Pin's own server, hosted on Fly.io in Toronto, Canada, as soon as it has a connection.

While a clip waits on your phone, it is kept inside the app and encrypted with AES-256-GCM. Guardian Pin decrypts it before upload and sends it over HTTPS. That is not end-to-end encryption, and the copy stored on our server is not encrypted by the app.

After a successful upload, or if the clip is deleted, the file is removed from your phone.

Who can see your clips

Who can see your clips. Your clips are private to you. Only you can watch them, in the Guardian Pin app when you're signed in. They aren't shown to your circle, aren't on the alert page, and aren't attached to or linked from the alert email.

They are never a public feed. We don't sell them, use them for ads, or share them with anyone, except where the law requires it. You can save or share a clip yourself, for example with the police, using your phone's share options.

Once you share a copy, whoever receives it controls that copy, and Guardian Pin can't delete it.

Who can access your clips

Who can access your clips. On our server, access to clips is limited to Guardian Pin's operator (named at the top of this policy). We never open, watch, or listen to your clips for any other reason. The only exception is a valid court order or another legally binding request, and even then we hand over only the clips that still exist.

Clips are deleted after 30 days, so older ones are already gone. Our hosting provider stores the files on its servers in Canada but does not view them.

Keeping and deleting clips

Keeping and deleting clips. Clips are deleted from our server 30 days after they are uploaded. If you delete your account, your clips are deleted right away.

Medical ID

Medical ID. A section is shared only when its toggle is on, only after you consent, and only during an alert, with primary circle contacts. Shared sections are included in the alert email and shown on the alert page. The alert ended email and test alert emails do not include Medical ID. A delivered alert email stays in each contact's mailbox after the alert ends. Gender identity is not shared with alerts by default.

Subscription

Subscription. A purchase receipt or token is sent to the Guardian Pin API to confirm a subscription. The emergency call does not require a subscription. Deleting the account does not cancel an App Store or Google Play subscription. Cancel it in the App Store or Google Play.

Your choices

Your choices. Settings can download a copy of your data, including live location samples, or delete this account. Deletion removes the Guardian Pin account, including saved circle contacts, Medical ID, alerts, location shared during alerts (including live location samples), and uploaded recordings. It does not remove alert emails already delivered to your contacts. Those copies stay with their email providers. It does not change the phone address book.

Retention

Retention. While the account exists, location data (including live location samples) and recordings (audio and video clips) are purged after 30 days, and alerts are purged after 90 days. After the account is deleted, an anonymised delivery log is kept for 90 days, a deletion receipt is kept for 7 days, and the email confirmation from the web deletion form is kept for 7 days.

A store purchase record is kept after deletion with the user id removed. It remains linkable by the Apple transaction ID or the Google purchase token, so it is pseudonymous, not anonymous. That record is kept for six years from the end of the tax year the purchase relates to, as required by Canadian tax law, after which it is deleted.

Apple keeps App Store purchase records under Apple's own rules. Google keeps Play purchase records under Google's own rules. Our email provider, Resend, keeps a copy of each email for up to 30 days.

Alert emails delivered to your contacts stay with their email providers and are not deleted by Guardian Pin.

Subscription and billing

If you subscribe, Guardian Pin sends a purchase receipt or purchase token to the Guardian Pin API to confirm your subscription and link it to your account. On Apple devices the purchase is tied to your account identifier. On Google Play the purchase is tied to your account identifier.

Apple or Google processes the payment. Guardian Pin does not receive your full card number. Subscription status, renewal date, and the store you used are stored so the app can show them in Settings.

Cancel through the App Store or Google Play. Refunds are handled by Apple or Google.