Mobile App: Privacy Policy

1Introduction

This notice describes data processed by My Safe Circle. The controller is Giovanni Rizzotti (section 15). Reading this notice, accepting Terms or using the app does not provide general consent. Optional location sharing and retention require specific choices.

2Information We Collect

Name, surname, nickname and email support your account and circle. We process safety messages, reminder replies and coordinates when you choose to share them. Shared positions include coordinates, the time of the fix and, when the device reports it, its estimated accuracy in meters. Live sharing updates the latest position without creating a continuous route. We process device/installation identifiers, push and authentication tokens, usage/crash data, language, timezone and country inferred from device/network/language signals. Premium involves customer/product identifiers, subscription status, renewals, refunds and promotional codes; we do not receive full payment-card details.

We record minimal evidence of retention choices: account, request identifier, activation or withdrawal, text version/hash and server date/time. This verifies consent and manages retries; the evidence contains no GPS coordinates.

For optional PostHog analytics, client 2.3.1 uses a random installation identifier and limited information about screens, features, selected options and operation outcomes. This identifier can link activity across sessions and is pseudonymous, not anonymous. PostHog event payloads exclude account identifiers, names, email addresses, contacts, message contents and GPS coordinates. They may indicate that a message or location option was used without including that content or position. The separate proposed counter mode and the version-dependent collection rules are described in section 12.

3Legal Basis and Purpose of Processing

Account services, requested communications and Premium entitlements are necessary to provide the service and perform the contract; applicable legal duties may require other processing. Optional location sharing and retention of latest data require specific consent. You can withdraw it without affecting processing lawfully performed before withdrawal. Technical data supports operation, security and diagnostics. Section 12 describes active tools: retention consent is not analytics consent.

PostHog usage analysis requires separate, prior, optional consent. Reading this notice, accepting the Terms, signing in or consenting to location or retention does not grant it. The proposed aggregate-counter mode is disabled in production until its applicable legal basis, device-access conditions and provider processing have been assessed; aggregate output alone does not establish a consent exemption. Technical diagnostics remain distinct from this optional analytics choice, as described in section 12.

4How We Use Information

We use data for accounts, circles, OK/SOS messages, reminders, notifications, support and purchases. A local emergency number may use the SOS position already obtained or the device country and operating-system geocoder. Live sharing requires confirmation of duration and approved recipients: 15 minutes Free; 1, 2, 4 or 8 hours Premium. Background updates are attempted subject to network, permissions, battery and operating-system limits. A separate confirmation is required even after SOS; Stop and expiry end updates.

5Sharing and Disclosure

Shared data is available to approved contacts according to your choices. Firebase/Google provide authentication, hosting, notifications and crash diagnostics; Firebase Analytics remains part of distributed versions up to 2.3.0 and is removed in client 2.3.1. Where enabled with your consent, PostHog receives the limited analytics described in section 12. Apple, Google and RevenueCat process purchases and Premium entitlements. Providers may process technical connection logs and use subprocessors under applicable terms. PostHog’s terms may permit the use of aggregated or de-identified customer content to develop its own products and internal models unless excluded by the applicable agreement or service settings. This notice does not certify that such exclusion has been configured; the new analytics modes remain disabled in production until applicable provider conditions have been checked. We may disclose data when required by law. We do not sell or rent data for advertising. Removing a contact revokes online access; a new invitation does not restore previously revoked data. Independent recipient screenshots or exports cannot be remotely erased by the app.

6Storage and Security

Each live session document keeps only the last received position for 7 days after ending, without a route history. Automatic physical deletion may occur later. Consent withdrawal and account deletion remain available.

Retaining the latest OK/SOS, message and position is optional, initially OFF and account-wide across devices. App versions offering “Consents and sharing” under Help and support allow activation or withdrawal. Live sharing also works without permanent retention; the final position of new sessions follows account consent, without a second choice. With consent, latest snapshots have no automatic expiry while consent, account and contact relationship remain active; newer events replace the corresponding snapshot and a positionless OK does not erase the previous point. Stop does not withdraw consent. Without retention, a live session remains accessible online for at most 7 days after ending; physical TTL deletion follows later with no guaranteed time.

Server-confirmed withdrawal blocks live sharing across devices and deletes retained snapshots and live sessions from the service. If data remains, Retry completes remaining deletion pages: an offline action or uncertain outcome does not confirm completion. On earlier app versions without the control, use the privacy contact. Safety notifications, reminder replies and local history/cache are separate and not erased by this withdrawal; server notifications have a nominal 30-day window with later cleanup. Contact us for broader erasure, including copies under our control. Contact removal and account deletion initiate their respective cleanup. Infrastructure protects data in transit and at rest; we do not use end-to-end encryption and no system guarantees absolute security.

Earlier versions may keep the last shared OK/SOS event position in the circle, separately from the new snapshots. If the account has never made a choice in the new control, this compatibility remains active. A new choice, including OFF, closes that path: older sends cannot repopulate the circle position; separate event copies remain.

Minimal choice records remain for the lifetime of the account and are removed by account-deletion cleanup; withdrawing retention does not erase those records and no separate automatic expiry is guaranteed.

7International Transfers

Providers may process data outside your country, including the United States. Service regions differ, and the Functions region does not imply that all data stays in Europe. The PostHog project uses an EU acquisition endpoint, but this does not guarantee that all processing, support, subprocessors or technical logs remain in the EU. Network connections necessarily expose an IP address to the receiving infrastructure; omitting it from analytics properties does not prove its absence from provider logs. Firebase/Google publish processing terms and transfer mechanisms, including standard contractual clauses where applicable: https://firebase.google.com/support/privacy. PostHog information is available at https://posthog.com/privacy. Ask the privacy contact for information and copies of applicable safeguards. We do not claim a completed transfer assessment or a verified consent exemption for the proposed counter mode.

8Data Breaches

We assess risks and measures following a breach. Where GDPR requires it, we notify the authority without undue delay and, where feasible, within 72 hours of becoming aware; delays are explained. We inform affected people without undue delay where risk is high, subject to legal exceptions.

9User Rights

You can exercise access, rectification, erasure, restriction, portability and objection where applicable, withdraw consent and complain to the competent authority (in Italy, the Garante). Contact us with your account and request scope, without passwords or unnecessary coordinates. Identity checks are proportionate. We normally respond within one month; permitted extensions are explained within that period. We explain exceptions and assess legally required recipient notifications. The response period does not guarantee physical erasure of every copy within 30 days.

10Children's Privacy

The service is not intended for children under 13; its stated European Union audience is at least 16. GDPR has no uniform threshold: for consent-based online services it ranges from 13 to 16 (14 in Italy). The app does not verify age or parental consent. Do not use it to monitor other people without required information, permissions and legal grounds.

11Limitations and Liability

The app is a communication tool, not a substitute for emergency services. Messages, location and notifications can be inaccurate, delayed or unavailable. Choose recipients carefully; stalking and covert surveillance are not permitted. Technical limits do not remove controller/provider duties or mandatory rights.

12Cookies and Tracking

Distributed versions up to 2.3.0 include Firebase Analytics for usage measurement and Firebase Crashlytics in release builds for diagnostics; those versions have no separate analytics enable/disable control.

Client 2.3.1 removes Firebase Analytics and offers optional PostHog usage analysis. Collection is enabled only with the required release configuration and after your explicit prior consent. A random installation identifier allows limited events to be linked across sessions: it is pseudonymous, not anonymous. We do not send account identifiers, names, email addresses, contacts, message contents or GPS coordinates to PostHog, and do not enable session replay, screen recordings, screenshots or audio capture.

The analytics choice is stored locally for this installation, not in the Firebase user profile, and is not synchronized across devices. Withdrawal stops new optional collection and discards the unsent local queue; it does not automatically erase events already transmitted. To request deletion, contact us using section 15 and include the analytics reference code shown in the app, if available, without sending passwords or unnecessary personal information.

A proposed limited-statistics mode is disabled in production until its legal basis and provider processing are verified. If made available, it sends daily counters containing a metric, day, count and an identifier shared by all installations, rather than individual usage histories. It has a separate opt-out. Refusing detailed analysis does not itself switch off an available counter mode; granting detailed analysis suspends that mode on the installation. Neither a shared identifier nor aggregate output automatically establishes that consent is unnecessary.

Firebase Crashlytics remains a separate release diagnostic tool. Refusing or withdrawing PostHog consent does not switch off crash diagnostics. We do not guarantee a maximum retention period of 12 months for technical data or claim that provider logs contain no IP addresses. The website has a separate privacy notice.

13Policy Changes

Version and date appear here. In newer app versions, updated information is shown after Home is ready, once per account and version, with the option to continue without enabling retention. Earlier versions may offer only manual viewing; an email is not guaranteed for every change. Reading an update neither grants nor withdraws consent and text changes do not enable optional features. This Remote Config update does not itself update the installed app or website.

14Legal Compliance

Applicable law, including GDPR where relevant, applies. This notice does not certify universal compliance, a completed DPIA or other assessments, or waive rights. You may seek clarification from the controller and contact the competent authority.

15Contacts

Data controller: Giovanni Rizzotti, the individual operating My Safe Circle. Privacy and rights email: [email protected]. Website: https://mysafecircle.app. Support: https://mysafecircle.app/it/contact.html.

16Specific choices

Message location, live sharing, retention and optional usage analysis are separate choices from the Terms and device permissions. Reading this notice does not activate them. Safety messages remain available without retention or PostHog analytics consent. In client 2.3.1, manage analytics and any available counter preference in Settings → Consents and sharing; older versions may expose privacy choices through Help and support. Analytics choices apply to the local installation, while the functional retention choice described in section 6 is account-wide. Withdrawing analytics does not revoke retention, and revoking retention does not change analytics preferences. The separate counter opt-out, when available, must be managed explicitly. Withdrawal of analytics does not itself delete remote analytics history; section 15 provides the contact for requests.