Privacy Policy

2. Information We Collect

We collect information in three ways: information you provide directly, information collected automatically during app operation, and information received from authorized third parties.

A. Information You Provide Directly

• Account Details: Full name, email address, password hash (encrypted via bcrypt), phone number (if provided for SMS verification), and profile avatar.
• Family Circle Data: Contact lists and group identifiers created when you establish a family circle or invite trusted members.
• Safety Feedback & Reports: User-submitted hazard reports, road condition notes, or customer support communications.
• Calendar Information: Optional scheduled events and trip itineraries synced to plan safe departure times.

B. Information Collected Automatically

• Precise Geolocation & Telemetry: GPS coordinates, altitude, travel bearing, speed, and timestamps recorded during active trips and background monitoring.
• Bluetooth Peripheral Data: Cryptographic advertising payloads, RSSI signal strength, and anonymized peripheral identifiers of nearby BLE tracking beacons detected during anti-stalking scans.
• Device & Technical Information: Device hardware model, operating system version, unique device identifiers, IP address, network carrier, and crash/diagnostic logs.
• App Usage & Crash Reports: Which screens you open and features you use, app sessions, and crash reports with the in-app steps leading up to a crash, collected through Google Firebase Analytics and Firebase Crashlytics and tied to your FYSA account ID. Firebase Analytics also estimates an approximate, city-level location from your IP address.
• Emergency Incident Records: When you send an SOS: when it started and ended, how it was sent, who it was sent to, who responded, and the last location your phone reported during it.
• Emergency Recordings (“black box”): A short recording of sensor readings from about 3 minutes before to 2 minutes after an SOS, a detection, or a check-in answer. It includes speed, GPS accuracy, activity changes (walking, running, still, in a vehicle), motion-sensor readings where detection is enabled, battery level, local time, and whether you were at home or work. It does not include GPS coordinates or raw heart rate. For a possible car crash, the recording instead covers raw motion-sensor readings from about 10 seconds before to 30 seconds after the impact, and speed and GPS accuracy from about 1 minute before to 2 minutes after, again without coordinates.
• Safety Detection Diagnostics: Periodic health reports about the emergency features, such as permission states, whether your watch is reachable, and how often check-ins were shown and answered. They contain no coordinates.

3. How We Use Your Information

We process your personal information strictly to operate, maintain, and enhance the safety services of FYSA:

• Dynamic Risk-Avoidance Routing: Comparing your trajectory against our real-time database of municipal crime records, police dispatch reports, and severe weather warnings via our routing engine.
• Anti-Stalking Heuristics: Running correlation algorithms on BLE beacon sightings across multiple locations to identify and alert you to suspicious tracking devices.
• Family Circle Visibility & Peer Permissions: Delivering encrypted location updates exclusively to contacts you explicitly authorize through our peer-to-peer permission model.
• Emergency SOS Dispatch: Relaying high-priority SOS alerts, your live location, and “I’m on it” and all-clear updates to the SOS contacts you chose.
• Improving Emergency Detection: Reviewing emergency recordings and diagnostics to measure how often detection catches real emergencies and how often it raises false alarms, and to tune it.
• Device Presence & Offline Monitoring: Running periodic heartbeat checks to detect disconnected or powered-down devices in high-risk zones.
• Service Improvement & Security: Monitoring platform performance, preventing fraud, verifying subscriptions, and debugging technical issues.
• Product Analytics & Crash Reporting: Understanding which features are used so we can improve them, and finding and fixing crashes. This data is never used for advertising and never combined with other companies’ data to track you across apps or websites.

4. Data Sharing & Third-Party Processors

We share data only with verified service providers who assist in operating our secure infrastructure under strict confidentiality and data-processing agreements:

Your SOS Contacts: You choose your SOS contacts from people you share a group with. Each contact is told when you add them and can decline. During an SOS they receive your name, your live location, and updates about the SOS; if you added a phone number, they also see it so they can call you. They never receive your emergency recordings or diagnostics.

Flight Watch: When you or a group member follows a flight, its flight number, date, airports, times, gates, and who is on it are visible to the groups chosen when it was added (for a Trip Planner flight, the people on the trip). The flight's positions are kept for 24 hours after it lands. If you choose "I'm picking up", the place you start from is used once to time the drive with Google Maps Platform and is stored with that flight, so FYSA can tell you when to leave, until the flight is removed.

Legal Disclosures: We may disclose information if required to do so by applicable law, regulation, valid court order, or subpoena, or to protect the vital safety of our users and the public in imminent life-threatening emergencies.

6. Children's Privacy & Family Circles

FYSA is designed to help parents and legal guardians protect their families. For users under the age of 13 (or under the applicable age of digital consent in your jurisdiction), accounts must be created with explicit parental consent or added directly by a parent or legal guardian within a family circle.

Parents and legal guardians maintain granular control over their children's accounts, including the ability to review, modify, or delete their child's location history and permissions at any time.

7. Data Retention & Security Standards

We implement rigorous defense-in-depth technical and organizational security measures:

• Encryption in Transit: All communication between the mobile client and our API servers is encrypted using modern TLS 1.3 encryption.
• Encryption at Rest: Database volumes, S3 buckets, and sensitive user fields are encrypted at rest using AES-256 standards.
• Authentication & Token Rotation: Stateless 15-minute JWT access tokens with revocable 30-day cryptographically hashed refresh tokens.
• Location History Lifecycle: High-frequency granular telemetry coordinates are automatically pruned after their analytical retention window.
• Diagnostics: Location, Bluetooth, driving and safety-detection diagnostic reports are automatically deleted after 30 days.
• Emergency Recordings: Recordings of an SOS, of a detection that alerted your SOS contacts, or that you mark as a real emergency are kept for 180 days and then automatically deleted. Real emergencies are rare, and these recordings are how we verify and improve detection. Other emergency recordings follow the 30-day diagnostics window. You can ask us to delete your recordings sooner at any time.
• FYSA Live Sessions: We do not store your voice or a transcript of what you or FYSA Live said. For each session we keep when it happened, how long it lasted, how much of the AI service it used and how many actions it took, to bill commands, prevent abuse and control costs; these records are kept while your account exists and are deleted with it. The instructions a session starts with (your first name and the names in your circle) are kept only while the session can continue and are deleted shortly after it ends.
• Emergency Incident Records: The record of each SOS (times, recipients, responses, and last reported location) is kept while your account exists so you and your contacts can refer back to it, and is deleted with your account.

Method 1: In-App Instant Deletion

If you have the mobile app installed, you can delete your account instantly:

1. Open the FYSA app.
2. Navigate to Settings (gear icon) → Account & Security.
3. Tap Delete Account and confirm your password.
4. Your account, profile, family circle memberships, and location history are immediately scheduled for permanent database purging.

Method 2: Web Deletion Request Form (No App Reinstall Needed)

If you have uninstalled the app or cannot access your mobile device, submit your deletion request below. Our team will verify and permanently delete your account and all associated telemetry within 30 days:

What Data Is Deleted Upon Request:

• Personal identifying information (name, email, password hash, avatar).
• Historical GPS coordinates, trip records, route polylines, and worry scores.
• Anti-stalking Bluetooth scan logs and diagnostics.
• Emergency incident records, SOS contacts, emergency recordings, and safety detection diagnostics.
• Private chat messages, group memberships, and peer permission grants.
• Device tokens and push notification registrations.

9. Your Privacy Rights & Choices

Depending on your geographic location (including California under CCPA/CPRA, and the European Union / UK under GDPR), you possess the following rights:

• Right to Access & Portability: Request an export of the personal data we hold about you in a structured, machine-readable format.
• Right to Rectification: Update or correct inaccurate account details.
• Right to Erasure: Request the deletion of your personal data as described above.
• Right to Restrict or Object: Limit the processing of specific telemetry data.
• Non-Discrimination: We will never discriminate against you for exercising your privacy rights.

10. International Data Transfers & Compliance

FYSA operates primary server infrastructure within the United States. If you use our Services outside the United States, your information will be transferred to and processed in the United States in accordance with Standard Contractual Clauses and this Privacy Policy.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect improvements to our app, changes in technology, or updated legal requirements. When significant revisions are made, we will notify you through a prominent in-app notification or by email prior to the changes taking effect.

12. Contact Us & Data Protection Officer

If you have questions, feedback, or concerns regarding this Privacy Policy, our data practices, or your privacy rights, please reach out to our privacy and security team: