Privacy Policy

Who we are

Stephen Muzzeroll, carrying on business as Guardian Pin, provides Guardian Pin. Contact privacy@guardianpin.app. Governing law: Alberta and the federal laws of Canada applicable there.

Account

Account. You sign in with Apple on iPhone or with Google on Android; we receive your name and email (or Apple's private relay email). The PIN that locks this device stays on the phone and is not uploaded. The app generates a random device identifier (a UUID) and sends it to the Guardian Pin API so this install can be recognized.

That identifier is cleared when you sign out and when the account is deleted. Guardian Pin is for people who are old enough to use it where they live: 13 or older in the United States and Canada, 14 or older in Quebec, and 16 or older everywhere else. It isn't designed for children, and we don't knowingly collect information from anyone younger.

If you think a younger child has signed up, please contact us and we'll delete the account.

Contacts

Contacts. You may add people by email, phone, or both. An email address is required to alert them. If you allow it, Guardian Pin reads your phone address book so you can import the people you choose. The app never writes to or deletes the phone’s contacts. Only contacts you save in Guardian Pin are sent to the Guardian Pin API. The rest of the address book is not uploaded. There are no invites.

Alerts

Alerts. Alerts go to each circle that has Alert this circle turned on. Each contact gets their own alert link. There is no login, so anyone who has the link can open it.

The link stops working when the alert ends, or 26 hours after it was sent, whichever comes first. After the alert ends, the page shows only that the alert has ended, with no name, location or map. Guardian Pin does not send push notifications to contacts or WhatsApp.

Text my circle opens the messages app on this phone with a map link to your location. You send that text yourself, and nothing is sent unless you press Send.

Maps

Maps. The map in the app on your phone loads tiles from the Guardian Pin API. Street tiles are Google Maps roadmap images: the API fetches them from Google Maps, and Google receives the map area being viewed. The Guardian Pin server sends Google only those tile coordinates, plus Guardian Pin's own API key and session.

It does not send your name, email, account id, or device id. Satellite tiles are not from Google. The phone does not load tiles from tile.openstreetmap.org, and it does not send this device's IP address to the OpenStreetMap Foundation for those tiles.

During an alert the map can show satellite imagery. Those tiles are Copernicus Sentinel-2 cloudless images fetched from EOX while that view is open. South of 66°S, and when a Sentinel tile is missing, the map uses NASA MODIS Terra corrected reflectance from NASA GIBS.

The request identifies the map tile being viewed (its zoom and grid position), not a GPS fix, and it is not used to track you. At closer zooms a tile covers a smaller area. The phone does not send this device's IP address, name, email, account id, or device id to EOX or NASA on that path.

Satellite imagery needs a data connection and may be unavailable on some networks or in some regions; the map falls back to a street map.

Alert email

Alert email. When you start an alert, Guardian Pin emails the contacts in each circle that has Alert this circle turned on, and no one else. The email contains your name, the local time of the alert, the circle name, your last known location when the email is sent, with an Open in Maps link to Google Maps and a link to Apple Maps, a private link to the alert page, and, for primary circle contacts only, the Medical ID sections you chose to share. These are ordinary links.

Nothing is sent to Google or Apple unless a contact opens a link, and then that company's own privacy terms apply. The first email includes a map image, drawn on our own servers, when a location is already available. Otherwise that first email may be followed by one email with the map once a location is available.

When the alert is using satellite view, that image is drawn from EOX satellite tiles. If that image cannot be drawn, the email and the alert page use a street map drawn on our own servers from OpenStreetMap data, credited © OpenStreetMap contributors. Any Near address in the email is produced on our own servers too.

No location is sent to an outside map provider to create that email image. If no map can be drawn, the email is sent without the image. Location is included only in emails sent while an alert is active.

When the alert ends, your contacts get an alert ended email. The alert ended email contains no link and does not include your location or Medical ID. Test alert emails do not include your location or Medical ID either.

The alert email has no third-party tracking.

Location

Location. Location is optional. If you allow it, Guardian Pin uses your phone's location during an alert you start. Share live location during alerts is on by default.

While that setting is on and the alert is active, the app takes your location about every 5 seconds and sends it to Guardian Pin whenever your phone can reach the service. Samples taken while the phone is offline stay on the phone and are sent if it reconnects while the alert is active. Any still waiting when the alert ends are deleted from the phone.

Each location includes latitude, longitude, the accuracy your phone reports, and the time. Accuracy depends on your phone, its settings and the signal, and a location can be wrong by a large distance. Your live location is shared with the contacts in each circle you alerted, through the private alert page.

The page updates about every 5 seconds. It shows a warning when there has been no update for 2 minutes. Live location stops when you end the alert with your PIN.

If the alert is still active after 12 hours, live location stops automatically and the alert stays open. The page then shows Live location stopped at HH:MM. Live location can also stop sooner, for example if your phone is off or loses battery or signal, if you turn location off, or if the phone's system closes the app.

Guardian Pin cannot guarantee that your contacts will see your location, or act on it, in time. If you turn Share live location during alerts off, only the single starting location is sent. Guardian Pin asks only for While Using the App location permission, never Always.

During an active alert, sharing continues if you leave the app or lock your phone, through an Android foreground service and the iOS background location mode. On Android, an ongoing notification is shown while location is shared during an alert. In normal mode it says your location is being shared with your circle.

In discreet modes it shows a plain notice that Guardian Pin is running, and it does not mention an alert. On iPhone, the system location indicator is shown. We don't receive your location unless an alert is active.

The emergency number uses the country you choose, or this phone's SIM or network country, time zone, or language. During an alert, Guardian Pin may check your location on the phone. If you have not chosen a country, that can set the emergency number.

If you chose a country and this phone is somewhere else, the local number is shown first and your chosen number stays available. That check isn't sent to us. Leave location services on during an alert if you want your circle to see where you are and so the app can pick the right emergency number.

Road packs are copies of road data kept on this phone so a road check can tell whether you are near a road. They are © OpenStreetMap contributors and are available under the Open Database License (ODbL). The road check runs on this phone and does not send your location.

Email

Email. Guardian Pin uses Resend, our email provider, to deliver email, including alert email, the alert ended email, test alert email, and the confirmation from the web deletion form. Resend processes the full content of each email, including any location and Medical ID in it, and keeps a copy for up to 30 days. Resend stores this data in the United States.

Open and click tracking are turned off. Email is sent to our email provider over an encrypted connection and is delivered encrypted where the recipient's mail server supports it. It is not end-to-end encrypted. Once an email is delivered, your contact's email provider holds a copy.

Anyone who can read that mailbox, or who is forwarded the email, can see it. Guardian Pin cannot delete an email after it is delivered.

Hosting

Hosting. Guardian Pin is hosted on Fly.io in Toronto, Canada. The host processes IP addresses. The phone does not send this device's IP address to Google when the API fetches a street tile.

Recordings

Recordings. If you allow the camera and microphone, Guardian Pin records short audio and video clips on your phone during an alert you start. A Recording indicator stays on the live alert screen the whole time, so it is never secret. Your phone uploads each clip to Guardian Pin's server as soon as it has a connection.

While a clip waits on your phone, it is kept inside the app. On iPhone, iOS Data Protection keeps the clip available after the first unlock, including while the phone is locked during an alert. Guardian Pin sends it over HTTPS.

That is not end-to-end encryption, and the copy stored on our server is not encrypted by the app. After a successful upload, or if the clip is deleted, the file is removed from your phone.

Who can see your clips

Who can see your clips. Your clips are private to you. Only you can watch them, in the Guardian Pin app when you're signed in. They aren't shown to your circle, aren't on the alert page, and aren't attached to or linked from the alert email.

They are never a public feed. We don't sell them, use them for ads, or share them with anyone, except where the law requires it. You can save or share a clip yourself, for example with the police, using your phone's share options.

Once you share a copy, whoever receives it controls that copy, and Guardian Pin can't delete it.

Who can access your clips

Who can access your clips. On our server, access to clips is limited to Guardian Pin's operator (named at the top of this policy). The operator does not open, watch, or listen to your clips, except to comply with a valid court order or another legally binding request, and even then we hand over only the clips that still exist. Our hosting provider stores the files but does not view them.

Keeping and deleting clips

Keeping and deleting clips. Clips are deleted from our server 30 days after we receive them. If you delete your account, your clips are deleted right away.

Medical ID

Medical ID. A section is shared only when its toggle is on, only after you consent, and only during an alert, with primary circle contacts. Shared sections are included in the alert email and shown on the alert page. Gender identity is not shared with alerts by default.

Your choices

Your choices. Settings can download a copy of your data, including live location samples, or delete this account. Deletion removes the Guardian Pin account, including saved circle contacts, Medical ID, alerts, location shared during alerts (including live location samples), and uploaded recordings. It does not remove alert emails already delivered to your contacts. It does not change the phone address book.

Retention

Retention. While the account exists, location data (including live location samples) is purged after 30 days, and alerts are purged after 90 days. After the account is deleted, an anonymised delivery log is kept for 90 days, a deletion receipt is kept for 7 days, and the email confirmation from the web deletion form is kept for 7 days.

A store purchase record is kept after deletion with the user id removed. It remains linkable by the Apple transaction ID or the Google purchase token, so it is pseudonymous, not anonymous. That record is kept for six years from the end of the tax year the purchase relates to, as required by Canadian tax law, after which it is deleted.

Apple keeps App Store purchase records under Apple's own rules. Google keeps Play purchase records under Google's own rules.

Subscription and billing

Subscription. If you subscribe, Guardian Pin sends a purchase receipt or purchase token to the Guardian Pin API to confirm your subscription and link it to your account. On Apple devices and on Google Play, the purchase is tied to your account identifier. Apple or Google processes the payment.

Guardian Pin does not receive your full card number. Subscription status, renewal date, and the store you used are stored so the app can show them in Settings. You can cancel anytime in App Store settings on iPhone, or in Google Play settings on Android.

Refunds are handled by Apple or Google. Alerts, test alerts, Medical ID sharing, and Emergency services stay available if the subscription lapses. Deleting the account does not cancel an App Store or Google Play subscription.