Terms of Use — Guardian Pin

What Guardian Pin is

Guardian Pin is a notification tool. It alerts the trusted contacts you choose by email. Those people are not professional responders. They may not see an alert, or act on it, in time.

Alerts and calls need signal, data, and battery, and cannot be guaranteed. Guardian Pin never calls emergency services automatically. When you tap the call button, Android opens the phone's dialer with your local emergency number ready, and on iPhone the system asks you to confirm a phone link before the call.

In an emergency, use that dialer or call your local emergency number directly.

Who we are

Guardian Pin is operated by Stephen Muzzeroll, carrying on business as Guardian Pin. Questions: privacy@guardianpin.app. These terms are governed by the laws of Alberta and the federal laws of Canada applicable there.

You must be at least 13 to use Guardian Pin if you live in the United States or Canada, at least 14 if you live in Quebec, and at least 16 everywhere else. You sign in with your Apple or Google account; we receive your name and email (or Apple's private relay email). A PIN you choose stays on this device and locks the app. It is not uploaded.

The app generates a random device identifier (a UUID) and sends it to the Guardian Pin API. That identifier is cleared when you sign out and when the account is deleted.

Your circle and alert emails

You add circle contacts by phone number, email, or both. Alerts notify people you designate in your primary circle only. Each contact is alerted only by email.

The alert email contains your name; the local time; the circle name; your last known location when the email is sent, with an Open in Maps link to Google Maps, a link to Apple Maps, and a map image drawn on our own servers from OpenStreetMap data and embedded in the email; the Medical ID sections you shared with that circle; and a private link to the alert page, where live location is shown while the alert is active. The email is a one-time snapshot and is not updated after it is sent.

It goes only to the contacts you chose, and it is delivered through our email provider, Resend. When the alert ends, contacts get an alert ended email with no link, no location, and no Medical ID. Test alert emails also have no location and no Medical ID.

Email is sent to our email provider over an encrypted connection and is delivered encrypted where the recipient's mail server supports it. It is not end-to-end encrypted. Once delivered, a copy stays with each contact's email provider, and Guardian Pin cannot delete it. Each contact gets their own alert link.

There is no login, so anyone who has the link can open it. The link stops working when the alert ends, or 26 hours after it was sent, whichever comes first. After the alert ends, the page shows only that the alert has ended, with no name, location or map.

Guardian Pin does not send invites, does not send push notifications to contacts, and does not send SMS or WhatsApp.

Maps

The alert email includes a still map drawn on our own servers from OpenStreetMap data and embedded in the email. Guardian Pin draws it with its own OpenStreetMap renderer, and it is credited © OpenStreetMap contributors. Any Near address in the email is produced on our own servers too.

No location is sent to an outside map provider to create that email image. The email has no third-party tracking. If no map can be drawn, the email is sent without the image.

The email and the private alert page also offer plain Open in Maps links to Google Maps, and a link to Apple Maps. These are ordinary links. Nothing is sent to Google or Apple unless a contact taps a link, and then that company's own privacy terms apply. The map in the app on your phone may still load tiles directly from tile.openstreetmap.org.

That sends the OpenStreetMap Foundation the map area being viewed and this device's IP address. The tile servers see the approximate map area and the IP address. There is no satellite map and no satellite call.

Live location

If you allow location, and Share live location during alerts is on (it is on by default), Guardian Pin shares your live location during an alert you start. Your location is taken about every 15 seconds and is shown only to the circle you alerted, on the private alert page, while the alert is active.

The page updates about every 15 seconds and shows a warning when there has been no update for 2 minutes. Samples taken offline stay on the phone and are sent if it reconnects while the alert is active. Any still waiting when the alert ends are deleted from the phone.

Sharing stops when you end the alert with your PIN. If the alert is still open after 12 hours, live location stops automatically, the alert stays open, and the page shows Live location stopped at HH:MM. Test alerts do not share location.

If you turn Share live location during alerts off, only the single starting location is sent. Guardian Pin uses While Using the App location permission only, never Always. During an alert it keeps sharing if you leave the app or lock your phone, through an Android foreground service and the iOS background location mode.

On Android, an ongoing Guardian Pin notification is shown while location is shared. It says Guardian Pin is running and does not mention an alert. On iPhone, the system location indicator stays visible.

Location comes from your phone and may be inaccurate, delayed, stopped early, or unavailable. It may not reach your contacts. Guardian Pin cannot guarantee that your contacts will see your location, or act on it, in time.

Contacts import

If you allow it, Guardian Pin can read your phone address book so you can import people you choose. The app never writes to or deletes the phone’s contacts.

Emergency call

When you tap the call button, Android opens the phone's dialer with your local emergency number ready, and on iPhone the system asks you to confirm a phone link before the call. The emergency call works with or without a subscription.

Subscription

Guardian Pin offers a monthly subscription of CA$2.99. Billing starts when you subscribe. Circle alerts and other online features need an active subscription.

Recordings

When you start an alert, Guardian Pin may record audio and video on this device if you grant camera and microphone permission. Recording is visible on the live alert screen. While a clip is waiting on this device before upload, it is stored only inside the app and encrypted with AES-256-GCM.

That encryption applies only while the clip waits on this device. Guardian Pin decrypts the clip before upload and sends it over HTTPS to Guardian Pin's server in Canada. It is not end-to-end encrypted, and this app does not encrypt the copy stored on the server.

Only you can watch your clips, in the Guardian Pin app when you are signed in. They are not shown to your circle, and they are not a public feed.

Please use recordings with care. A clip can pick up other people's faces and voices, not just yours. Use recording to help keep yourself safe, and follow the laws where you are about recording other people. Guardian Pin always shows that it is recording and is never meant for recording anyone in secret.

If you choose to save a clip or share it with someone else, you are responsible for that copy. Once you share it, whoever receives it controls that copy, and Guardian Pin can't delete it.

Medical ID

Medical ID sections are shared only when their toggle is on, only after you consent, and only with primary circle contacts, in the alert email and on the alert page, while an alert is active. The alert ended email and test alert emails do not include Medical ID. Gender identity is not shared with alerts by default.

Your data and deletion

You can export a copy of your data and delete your account in the app. Deleting the account does not cancel an App Store or Google Play subscription. Cancel it in the App Store or Google Play.

Retention

Retention. While the account exists, location data (including live location samples) and recordings (audio and video clips) are purged after 30 days, and alerts are purged after 90 days. After the account is deleted, an anonymised delivery log is kept for 90 days, a deletion receipt is kept for 7 days, and the email confirmation from the web deletion form is kept for 7 days.

A store purchase record is kept after deletion with the user id removed. It remains linkable by the Apple transaction ID or the Google purchase token, so it is pseudonymous, not anonymous. That record is kept for six years from the end of the tax year the purchase relates to, as required by Canadian tax law, after which it is deleted.

Apple keeps App Store purchase records under Apple's own rules. Google keeps Play purchase records under Google's own rules. Our email provider, Resend, keeps a copy of each email for up to 30 days.

Alert emails delivered to your contacts stay with their email providers and are not deleted by Guardian Pin.

Subscription and billing

Guardian Pin offers one auto-renewing monthly subscription. The price is shown in the app from the App Store or Google Play before you confirm, and it is billed each month until you cancel. The subscription renews automatically unless you cancel at least 24 hours before the end of the current period.

Cancel or manage the subscription in your Apple ID or Google Play account settings. Guardian Pin cannot cancel a store subscription for you. Refunds are handled by Apple or Google, not by Guardian Pin.

Emergency calls do not require a subscription.