Privacy Policy

SafePathAppEffective August 7, 2026

SafePathApp ("we," "our," or "us") is an emergency-preparedness app. This policy explains what information SafePathApp handles, where it goes, and the controls you have over it. We wrote it to describe what the app actually does, not what we’d like it to do.

Summary

The short version, before the detail:

—Your profile, emergency contacts, household details, evacuation routes, and preparedness progress are stored on your device only.

—A small set of app preferences (notification settings, accessibility options, location-sharing toggle, and similar) syncs across your devices through Apple’s iCloud Key-Value Storage if you are signed into iCloud.

—SafePathApp operates two backend services on AWS: one that aggregates hazard data from public sources, and one that registers your device for push notifications. Both receive coarse location (zip code or latitude/longitude) but neither receives your profile, contacts, or household information.

—Some features query third-party APIs (USGS, NOAA, EPA, NASA FIRMS, FEMA, Mapbox, Apple MapKit, Google Gemini, and others) directly. We send only the data each request needs.

—A code-level audit of the app shows no third-party analytics SDKs, no crash reporting SDKs, no advertising SDKs, and no user-tracking framework. SafePathApp does not display the App Tracking Transparency prompt because it does not track you across apps or websites.

Information we collect

Information you provide or generate while using SafePathApp:

—Profile: display name, email address (provided by Sign in with Apple or entered manually), and optional phone number.

—Location data: zip codes and coordinates for the areas you monitor; your current location when you grant the relevant permission; coordinates of meeting points and evacuation route waypoints you save; optionally a home address with coordinates.

—Emergency contacts: names, phone numbers, email addresses, and relationships for the contacts you add to your plan.

—Household details: names, ages, and relationships for household members; optional accessibility and medical information you choose to enter (such as mobility assistance, oxygen or other medical equipment needs, dietary restrictions, special needs descriptions, and a free-text medications list); pet records including name, breed, weight, vaccination status, optional medications, and optional microchip number.

—Preparedness progress: the checklist items, family-plan steps, and home-safety tasks you mark complete.

—App preferences: notification settings, quiet hours, map and accessibility options, theme, alert filter selections, and feature toggles such as community alerts, location sharing, and anonymous reporting.

—Health Guidance input: the free-text questions you type into the Health Guidance feature (see below).

The accessibility, medical, and medications fields under household details are optional. You control whether to enter them, and they are not required to use the rest of the app.

How data is stored

Where each kind of data lives:

—On-device database (Core Data): your profile, emergency contacts, household members, pets, evacuation routes, meeting points, preparedness progress, and cached alert and hazard data. The Core Data store is local-only — CloudKit synchronization is disabled — and the database is removed when you uninstall the app.

—iOS Keychain: your Apple user identifier, the display name and email Apple provides at first sign-in, your APNs push notification token, your subscription entitlement record, and SafePathApp’s third-party API keys. Keychain entries persist across app reinstalls. They are removed when you sign out inside the app, or when you erase your device.

—iCloud Key-Value Storage (NSUbiquitousKeyValueStore): the preferences listed below, synced across your devices when you are signed into the same iCloud account. No personal data (profile, contacts, household, routes) is included in this sync.

—UserDefaults: non-personal app state such as onboarding completion, last-used tab, and consent flags.

The preferences synced through iCloud are: push notification toggle; SMS alert toggle; email alert toggle; emergency bypass toggle; quiet hours on/off and start/end times; preferred map type; auto-refresh toggle; data-usage mode; large text, high contrast, and reduce motion toggles; preferred theme; compact view mode; community alerts toggle; location sharing toggle; and anonymous reporting toggle.

SafePathApp backend services

We operate two backend services hosted on Amazon Web Services. They are designed to receive only the data each request needs:

—Hazard aggregation API. When the app fetches alerts, air quality, shelter, utility status, or travel advisory information, it sends a request containing your latitude/longitude, zip code, country code, or radius — depending on the feature. The backend proxies upstream public sources (USGS, NOAA, NASA FIRMS, FEMA, the U.S. State Department, and others) and returns consolidated results. It does not receive your profile, contacts, or household data.

—Push registration API. When you allow push notifications, the app registers your device so the backend can deliver alerts to you. The registration payload includes your APNs device token, your iOS vendor identifier, the APNs environment (sandbox or production), your alert preferences (such as alert types and radius), and the zip codes and coordinates of the locations you have chosen to monitor. This information is stored server-side so the backend can target alerts to your device, and is updated whenever your monitored locations change or your device receives a new APNs token.

—Retention: device registration records have a 60-day time-to-live. They are refreshed on app launch, when your monitored locations change, and when your APNs token changes, so active devices stay registered. Records not refreshed for 60 days are automatically deleted, as is any record Apple reports as having an invalid token (for example, after you uninstall the app).

—Server logs: our API Gateways do not have request access logging enabled, so per-request metadata such as your IP address is not written to our logs. Backend Lambda functions emit operational logs to AWS CloudWatch for debugging — truncated APNs token prefixes, alert counts, alert-filtering outcomes, error messages, and in rare error paths a coordinate used for a single hazard query. Those logs do not include your name, email address, contact list, household details, or profile data. CloudWatch retention currently follows the AWS default; we plan to set a bounded retention period.

If the backend is unreachable, the app falls back to calling the upstream third-party sources directly. If you would like records associated with your device removed, contact us using the address at the end of this policy.

Third-party services

SafePathApp communicates with the following services. For each, we send only the data the feature requires; these services are governed by their own privacy policies.

—USGS Earthquake Hazards API — earthquake and seismic data. Receives latitude, longitude, search radius, and minimum magnitude.

—NOAA National Weather Service API — weather alerts and forecasts. Receives latitude and longitude.

—NOAA Weather Radio — live emergency radio audio streamed from public broadcasts; no personal data is transmitted.

—EPA AirNow API — air quality data. Receives latitude, longitude, and search radius.

—NASA FIRMS — wildfire and thermal hotspot data. Receives a bounding box of coordinates.

—FEMA Disaster Declarations — historical disaster context. Receives a county or region identifier.

—U.S. State Department travel advisory data — country-level advisories. Receives a country code only. If our backend is unreachable, the app falls back to GDELT, which receives the country name and a search query.

—Mapbox — offline map tiles and routing. Receives latitude, longitude, and tile coordinates, plus standard request metadata (such as your IP address) inherent to any HTTP request.

—Apple MapKit — map display and geocoding, governed by Apple’s privacy policy.

—Google Gemini — see the Health Guidance section below.

Health Guidance feature

Health Guidance sends the free-text questions you type to Google’s Gemini API to generate informational guidance. Before you use it for the first time, the app shows a multi-step consent screen. What is sent to Google is the text of your question and the conversation context for the current session, each request wrapped with prompt-injection guardrails and a system instruction. We do not attach your name, email, profile information, location, or any SafePathApp identifier; Google receives standard request metadata such as your IP address.

Conversation history is held only in memory during your active session and discarded when it ends — it is never written to your device’s database or to any server we operate. The feature is rate-limited on your device (currently 20 requests per session and 50 per day). Health Guidance is informational and is not medical advice; you can avoid it entirely, or disable it after first use in settings. In a future release we plan to route Gemini requests through our own backend rather than calling Google directly, and will update this policy when that ships.

Sign in with Apple

SafePathApp uses Sign in with Apple for account creation. Apple shares a stable user identifier, and on first sign-in also the name and email you choose to provide. Those values are stored in the iOS Keychain and used to populate your local profile; subsequent sign-ins reuse them. We do not maintain user accounts, passwords, or session tokens on any server we operate.

A Guest Mode option is available if you prefer not to sign in — it creates a local-only profile without contacting Apple’s identity service. Because the Apple identifier, name, and email live in the Keychain, they persist across reinstalls; sign out from inside the app to remove them.

Push notifications

If you enable push notifications, alerts are delivered through Apple’s Push Notification service (APNs), fanned out by our push registration backend. To make this work, the backend stores your APNs device token, your iOS vendor identifier, the locations you have chosen to monitor, and your alert preferences. Notification content is generated from upstream hazard sources and does not include personal information from your profile.

You can disable push notifications at any time in iOS Settings. Removing your device registration from our backend is part of sign-out; for a manual record removal, contact us.

Identifiers

SafePathApp uses these identifiers:

—Apple user identifier — provided by Sign in with Apple, stored in Keychain, used to recognize you on this device.

—iOS vendor identifier (identifierForVendor) — a per-vendor device ID provided by iOS, sent to the push registration backend so APNs tokens can be associated with a device record.

—APNs device token — sent to Apple by iOS and to our push backend so notifications can be delivered.

SafePathApp does not use the IDFA (advertising identifier) and does not show the App Tracking Transparency prompt.

Subscriptions and tips

SafePathApp offers an optional Plus subscription (monthly and annual) and one-time tip purchases. All transactions are processed by Apple through StoreKit and the App Store. Receipts are verified on-device using StoreKit’s native verification — there is no third-party receipt validation service in the app — and your entitlement tier is cached in the Keychain so the app recognizes your subscription offline. Apple’s handling of payment and account information is governed by Apple’s privacy policy.

Analytics, tracking, and advertising

Based on a code-level audit, SafePathApp includes no third-party analytics SDKs (such as Firebase, Mixpanel, Amplitude, or Segment), no third-party crash reporting SDKs (such as Sentry, Crashlytics, or Bugsnag), and no advertising SDKs, and it does not use the iOS App Tracking Transparency framework because it does not track you across other companies’ apps or websites. The app records local diagnostic logs through Apple’s unified logging system; those stay on your device unless you choose to share them with us for support.

Biometric authentication

You can optionally protect access to SafePathApp with Face ID, Touch ID, or your device passcode. Authentication is handled entirely by iOS through the LocalAuthentication framework. We do not see, store, or transmit your biometric data.

Data security

Your data is protected by standard iOS platform security: app sandboxing, device encryption, and the protections you enable on your device (passcode, Face ID, Touch ID). Sensitive Keychain items are stored with the kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly attribute. SafePathApp generates an encryption key for the local Core Data store and keeps that key in the Keychain. Network requests use HTTPS.

Data sharing and sales

We do not sell, rent, or trade your personal information, and we do not share it with advertisers or data brokers. The only information that leaves your device is what is described in the backend services and third-party services sections above, used solely to deliver app functionality.

Your choices

You stay in control of everything you enter:

—View, edit, or delete any information you have entered in the app at any time.

—Export your profile, emergency contacts, and notification settings in JSON or CSV from Data Management. (The current export does not include household members, pets, or saved evacuation routes; we plan to broaden this.)

—Signing out from inside the app erases the local Core Data database and removes Apple identity, push token, and subscription items from the Keychain on this device.

—Revoke location, notification, and contacts permissions at any time in iOS Settings.

—Uninstalling removes the local Core Data database. Keychain items (Apple identifier, display name, email, push token, subscription record) persist across reinstall by design — sign out first if you want them removed.

—Clear iCloud-synced preferences from Data Management; this also removes them from your other devices signed into the same iCloud account.

Children’s privacy

SafePathApp is a general-audience app and is not directed at children under 13, and we do not knowingly collect personal information directly from them. A parent or guardian may choose to record information about a minor as a household member to support emergency planning; that information is stored locally on the parent’s device under the same controls as other household data and is not transmitted to our backend or to third parties. If you believe a child has used the app to provide information directly to us, contact us and we will take appropriate action.

Changes to this policy

We may update this Privacy Policy as the app changes. When we do, we will revise the effective date above and make the updated policy available within the app. Continued use of SafePathApp after changes constitutes acceptance of the updated policy.

Contact us

For questions about this Privacy Policy, or to request removal of records associated with your device from our backend services, contact us at tktajik@gmail.com.

Questions about this document? Email tktajik@gmail.com.