Terms of Use: Guardian Pin

What Guardian Pin is

Guardian Pin is a notification tool. It emails the trusted contacts you choose. The email has a private link to the alert page. Those people are not professional responders.

They may not see an alert, or act on it, in time. Alerts and calls need signal, data, and battery, and cannot be guaranteed. Guardian Pin never calls emergency services automatically.

When you press Emergency services, Android opens the phone's dialer with your local emergency number ready, and on iPhone the system asks you to confirm a phone link before the call. In an emergency, use that dialer or call your local emergency number directly.

Who we are

Guardian Pin is operated by Stephen Muzzeroll, carrying on business as Guardian Pin. Questions: privacy@guardianpin.app. Product help: support@guardianpin.app. These terms are governed by the laws of Alberta and the federal laws of Canada applicable there.

You must be at least 13 to use Guardian Pin if you live in the United States or Canada, at least 14 if you live in Quebec, and at least 16 everywhere else. You sign in with Apple on iPhone or with Google on Android; we receive your name and email (or Apple's private relay email). A PIN you choose stays on this device and locks the app. It is not uploaded.

The app generates a random device identifier (a UUID) and sends it to the Guardian Pin API. That identifier is cleared when you sign out and when the account is deleted.

Your circle and alert emails

You add circle contacts by email, phone, or both. An email address is required to alert them. Alerts notify the people in each circle that has Alert this circle turned on.

Guardian Pin itself sends those notifications by email. The alert email contains your name; the local time; the circle name; your last known location when the email is sent, with an Open in Maps link to Google Maps and a link to Apple Maps; a private link to the alert page; and, for primary circle contacts only, the Medical ID sections you chose to share. These are ordinary links.

Nothing is sent to Google or Apple unless a contact opens a link, and then that company's own privacy terms apply. It goes only to the contacts you chose, and it is delivered through our email provider, Resend. Resend stores the content of each email, including any location and Medical ID in it, in the United States, and keeps a copy for up to 30 days.

When the alert ends, contacts get an alert ended email with no link, no location, and no Medical ID. Test alert emails also have no location and no Medical ID. Email is sent to our email provider over an encrypted connection and is delivered encrypted where the recipient's mail server supports it. It is not end-to-end encrypted.

Once delivered, a copy stays with each contact's email provider, and Guardian Pin cannot delete it. Each contact gets their own alert link. There is no login, so anyone who has the link can open it.

The link stops working when the alert ends, or 26 hours after it was sent, whichever comes first. After the alert ends, the page shows only that the alert has ended, with no name, location or map. Guardian Pin does not send invites and does not send push notifications to contacts or WhatsApp.

Text my circle opens the messages app on this phone with a map link to your location; you send that text from your own phone, and nothing is sent unless you press Send. Your carrier and messaging app handle the text, and Guardian Pin can't delete it.

Maps

The alert email includes a still map drawn on our own servers and embedded in the email. The first email may be followed by one email with the map once a location is available. When the alert is using satellite view, that image is drawn from EOX satellite tiles.

If that image cannot be drawn, the email and the alert page use a street map. A street map is drawn with Guardian Pin's own OpenStreetMap renderer, and it is credited © OpenStreetMap contributors. Any Near address in the email is produced on our own servers too.

No location is sent to an outside map provider to create the street-map image. The email has no third-party tracking. If no map can be drawn, the email is sent without the image.

The map in the app on your phone loads tiles from the Guardian Pin API. Street tiles are Google Maps roadmap images: the API fetches them from Google Maps, and Google receives the map area being viewed. The Guardian Pin server sends Google only those tile coordinates, plus Guardian Pin's own API key and session.

It does not send your name, email, account id, or device id. Satellite tiles are not from Google. The phone does not load tiles from tile.openstreetmap.org, and it does not send this device's IP address to the OpenStreetMap Foundation for those tiles.

During an alert the map can show satellite imagery. Those tiles are Copernicus Sentinel-2 cloudless images fetched from EOX while that view is open. South of 66°S, and when a Sentinel tile is missing, the map uses NASA MODIS Terra corrected reflectance from NASA GIBS.

The request identifies the map tile being viewed (its zoom and grid position), not a GPS fix, and it is not used to track you. At closer zooms a tile covers a smaller area. The phone does not send this device's IP address, name, email, account id, or device id to EOX or NASA on that path.

Satellite imagery needs a data connection and may be unavailable on some networks or in some regions; the map falls back to a street map.

Live location

If you allow location, and Share live location during alerts is on (it is on by default), Guardian Pin shares your live location during an alert you start. Your location is taken about every 5 seconds and is shown to each circle you alerted, on the private alert page, while the alert is active.

The page updates about every 5 seconds and shows a warning when there has been no update for 2 minutes. Samples taken offline stay on the phone and are sent if it reconnects while the alert is active. Any still waiting when the alert ends are deleted from the phone.

Sharing stops when you end the alert with your PIN. If the alert is still open after 12 hours, live location stops automatically, the alert stays open, and the page shows Live location stopped at HH:MM. If you turn Share live location during alerts off, only the single starting location is sent.

Guardian Pin uses While Using the App location permission only, never Always. During an alert it keeps sharing if you leave the app or lock your phone, through an Android foreground service and the iOS background location mode. On Android, an ongoing notification is shown while location is shared during an alert.

In normal mode it says your location is being shared with your circle. In discreet modes it shows a plain notice that Guardian Pin is running, and it does not mention an alert. On iPhone, the system location indicator is shown.

Location comes from your phone and may be inaccurate, delayed, stopped early, or unavailable. It may not reach your contacts. Guardian Pin cannot guarantee that your contacts will see your location, or act on it, in time.

Contacts import

If you allow it, Guardian Pin can read your phone address book so you can import people you choose. The app never writes to or deletes the phone’s contacts.

Recordings

When you start an alert, Guardian Pin may record audio and video on this device if you grant camera and microphone permission. Recording is visible on the live alert screen. While a clip is waiting on this device before upload, it is stored only inside the app.

On iPhone, iOS Data Protection keeps the clip available after the first unlock, including while the phone is locked during an alert. Guardian Pin sends the clip over HTTPS to Guardian Pin's server in Canada. It is not end-to-end encrypted, and this app does not encrypt the copy stored on the server.

Only you can watch your clips, in the Guardian Pin app when you are signed in. They are not shown to your circle, and they are not a public feed. Clips are deleted from our server 30 days after we receive them.

Please use recordings with care. A clip can pick up other people's faces and voices, not just yours. Use recording only to help you get help, and follow the laws where you are about recording other people. Guardian Pin always shows that it is recording and is never meant for recording anyone in secret.

If you choose to save a clip or share it with someone else, you are responsible for that copy. Once you share it, whoever receives it controls that copy, and Guardian Pin can't delete it.

Medical ID

Medical ID sections are shared only when their toggle is on, only after you consent, and only with primary circle contacts, in the alert email and on the alert page, while an alert is active. Gender identity is not shared with alerts by default.

Your data and deletion

You can export a copy of your data and delete your account in the app. Deleting the account does not cancel an App Store or Google Play subscription.

Retention

Retention. While the account exists, location data (including live location samples) is purged after 30 days, and alerts are purged after 90 days. After the account is deleted, an anonymised delivery log is kept for 90 days, a deletion receipt is kept for 7 days, and the email confirmation from the web deletion form is kept for 7 days.

A store purchase record is kept after deletion with the user id removed. It remains linkable by the Apple transaction ID or the Google purchase token, so it is pseudonymous, not anonymous. That record is kept for six years from the end of the tax year the purchase relates to, as required by Canadian tax law, after which it is deleted.

Apple keeps App Store purchase records under Apple's own rules. Google keeps Play purchase records under Google's own rules.

Subscription and billing

Guardian Pin offers one auto-renewing monthly subscription. The price is shown in the app from the App Store or Google Play before you confirm, and it is billed each month until you cancel. The subscription renews automatically unless you cancel at least 24 hours before the end of the current period.

You can cancel anytime in App Store settings on iPhone, or in Google Play settings on Android. Guardian Pin cannot cancel a store subscription for you. Refunds are handled by Apple or Google, not by Guardian Pin.

Alerts, test alerts, Medical ID sharing, and Emergency services stay available if the subscription lapses.