I’M SAFE Privacy Policy

One-page summary

• Who is responsible: Free2Live Tech Solutions Private Limited in India; I’M SAFE Australia Pty Ltd for Australian and other international users.
• Location: When you enable sharing, we process precise location, including in the background, to show your position, trips, places and selected alerts. Bubble members and people holding an external share link can receive information. Going Private is a location control, not a switch for every kind of data.
• Steps and driving: Current apps automatically upload daily steps to your Bubbles when the phone’s motion permission is already available. There is no separate steps switch. Driving summaries are shared with eligible Plus Bubble members while location sharing is on. This policy is not a substitute for consent where consent is required.
• Safety: SOS attempts to notify selected eligible contacts; delivery and location accuracy are not guaranteed. I’M SAFE is not an emergency service and does not dispatch rescue. Call 112 in India or 000 in Australia in an emergency. Automated crash alerts are not currently released; some testing builds run a counts-only trial that alerts nobody.
• Private and public spaces: Chat is shared within a Bubble. Community is visible to its eligible audience and uses automated moderation. Ask for Help is an identified, India-only service for eligible women and girls aged 13 or over; authorised staff can read requests. It is separate from Bubbles and SOS.
• Vault: Both phone apps have encrypted local Vault storage and optional end-to-end encrypted backup. Keep your 12-word Recovery Key safe. We cannot retrieve your Recovery Key or decrypt an inaccessible backup for you; exports leave Vault protection.
• Providers: AWS hosts the primary backend in Mumbai. Google/Firebase, Apple, Meta and other providers process particular data, including overseas. Website cookie choices do not control app SDK collection.
• Retention and choices: Periods differ by data type. Some records currently have no automatic expiry. You can change available permissions, leave a Bubble, revoke share links and request access, correction or account deletion. Deletion does not cancel store billing or recall recipients’ copies.
• Contact: Privacy requests: support@imsafe.app. Grievances: info@imsafe.app. Country-specific rights and complaint routes are below.

1. Who we are and what this covers

This policy covers the I’M SAFE website, iOS and Android apps, Watch and Wear companions, widgets, connected Tags, support, Community, subscriptions, gifts and website purchases. It includes test versions. A standalone Personal Alarm does not transmit app data; buying it still creates order records.

2. Account, contact and technical information

We receive the name, phone number or email used for sign-in, profile information and optional photo; account, session, device and push identifiers; membership and invitation records; and settings and permission status needed to operate features. Authentication, integrity and notification providers also process data for their services.

We process network addresses, app/device/operating-system versions, language, timestamps, requests, errors and security records. Feedback can include your message and technical context; a contact preference controls follow-up access where implemented. We do not need your password, one-time sign-in code or Vault Recovery Key in a support message.

3. Bubbles, background location and places

Enabling location sharing lets us receive precise coordinates, accuracy, time, motion/activity context, speed where available, and associated phone status. Capture and upload can continue while the app is closed or in the background, subject to your permissions and device restrictions. Approved Bubble members receive information according to membership, sharing and history permissions.

While you share a drive with a Plus Bubble, your phone also counts how many times it was unlocked while the car was moving; only the count is kept with that drive, never the time or place, and nothing is counted while you are Private.

We use this information for live maps, recorded Trips, Journeys you start, destinations, route/distance/time summaries, Zones, arrival/departure events, place history and Travel Insights. Named places and repeated visits can reveal home, work and personal routines. Map display, place search, geocoding and directions can send queries or map areas to mapping providers.

Optional weather uses your approximate area while the app is open, after you turn it on and allow location access. We send that area through our server to WeatherAPI to return current weather and forecasts. We do not send WeatherAPI your name, account identifier, Bubble members or trips. You can turn weather off in Settings > Permissions or in its panel; signing out clears the choice on that device. Weather has its own opt-in and does not enable Bubble location sharing.

You can stop location sharing for a Bubble, use Go Private, leave the Bubble, end a Journey or change device permissions. These actions affect future sharing and availability; they do not erase all stored history, independent SOS/share records or copies someone already received. Private presentation must not be understood as account deletion. Read timestamps: a recent or last-known position is not proof someone is there now.

Driving insights use recorded trips to show counts, distance, duration, top speed and fast/night trips. Your own summary is available without Plus; other members’ summaries require the relevant Plus Bubble and active location-sharing permission. There is no separate driving-sharing switch. A road trip may involve a passenger, and a speed threshold is not a determination that a legal speed limit was broken.

If you are in a Plus Bubble, we prepare a monthly travel report from your own trips — totals only, never places or routes — keep those monthly totals for 13 months, and email it to the address you sign in with unless you turn it off in Settings or with the link in the email.

4. Steps, battery and phone status

Current apps use the phone’s motion/step sensor, rather than the old HealthKit/Health Connect step integration. When Motion & Fitness/activity-recognition permission is already granted, they upload daily step totals on foreground activity to all the user’s Bubbles. Members can see totals and supported rankings/history. Raw step samples are not uploaded through this feature.

There is currently no separate step-sharing control. The September change also overrides older step opt-outs. Stopping location sharing does not reliably stop this separate step flow. Removing motion permission prevents further sensor-based collection but can also affect movement detection; leaving a Bubble ends that membership. Contact us about stored steps or unwanted sharing. Accepting this policy or granting a device permission does not override an earlier opt-out or replace legally required informed consent.

Battery level, charging and supported connection information accompany relevant updates. Android additionally offers an opt-in ringer/phone-status control; it does not govern every battery or connection field. Active Journeys already support a low-battery notification to Bubble members. A general Bubble low-battery notice is planned, not promised as available. Before introducing it, we must explain its audience, threshold and controls and obtain any required consent.

5. SOS, “Possible crash” and testing

SOS processes trigger/time, initial and updated location, status, selected eligible recipients, delivery/response information and, where used, phone details for SMS. User-activated audio/photo capture with device permissions can upload media to private storage for authorised SOS access. SOS media is not Vault backup and is not described as end-to-end encrypted. Hiding an alert is not deleting it.

The system can represent a “Possible crash” alert, but automated Plus crash detection is not a released feature in the current product. Selected TestFlight/Play testing builds can run a drive-only trial using motion acceleration and existing location signals. Raw acceleration is held briefly in a rolling memory buffer; bucketed counts and drive-duration/distance bands go to analytics. These counts can remain account-associated. The trial does not send a crash alert, sound an alarm or summon help. Joining a testing programme is not a substitute for any required notice or consent.

I’M SAFE is not an emergency service. It cannot guarantee detection, accurate location, alert delivery, a contact’s response or rescue. Call 112 in India or 000 in Australia; elsewhere use the local emergency number.

6. Ask for Help: India only

Ask for Help is for eligible women and girls aged 13 or over in India seeking assistance concerning domestic violence or abuse. It is an identified private request, separate from SOS, and is not shown to Bubble members. Eligibility uses account/verified phone or recent India-location information, plus the required woman-or-girl aged 13 or over self-attestation. It is not available in Australia.

We process your request, replies, information you choose to disclose, acknowledgement records, assignment and access/audit records. Individually identified, authorised staff can read and handle requests. Any referral to a partner would require your explicit approval of the partner, information and contact arrangements; a referral would not promise acceptance or professional care. Do not assume that submitting a request automatically creates a partner referral.

Discreet mode offers quick exit, hiding the tool, optional device authentication and neutral reply notifications. Quick exit clears the current draft, not a submitted case. These controls cannot conceal all traces from someone who can unlock or control your device, see notifications or access your communications.

This is not continuous monitoring, counselling, legal advice or emergency dispatch. The configured first-human-response target is 24 hours; it is not a guarantee of resolution or partner response.

7. Chat and Community

Bubble Chat stores messages, voice notes, reactions, mentions, read markers and Saved Messages for authorised Bubble participants. Live features also transmit typing/presence and, where used, unsent draft text to other viewers. Treat a shared draft as disclosed before pressing Send. Chat is not represented as end-to-end encrypted. Notification previews may expose text on a device or through push providers, depending on settings.

Hiding a message for yourself does not erase it for everyone. Saved Messages can outlast ordinary chat expiry and remain stored when Plus access is lost.

Community is separate from private Bubbles and available to eligible signed-in users currently inside Chennai, Mumbai, Bengaluru and metropolitan Adelaide. A foreground location check establishes local eligibility; its coordinates are not published as your post or added to Bubble history by that check. We retain eligibility/account/city metadata. Posts, replies, displayed names, coarse map observations and guide contributions can be seen by the relevant audience; public guide pages may be accessible outside the app.

Automated moderation sends submitted text, titles, displayed names and relevant observation labels/categories to OpenAI. Exact device coordinates, account identifiers and Bubble data are not deliberately included in that request, but text you write can identify you. Hiding your displayed name is not anonymity: we retain authorship, reports, blocks and moderation records. Provider retention can apply despite a request not to store response state. You can report content and challenge moderation through our grievance contact.

8. Vault and encrypted backup

Vault on iOS and Android stores notes, selected files/photos and deliberate recordings in encrypted local storage. Optional backup encrypts content on your device before upload. We store encrypted objects, an encrypted manifest and recovery envelope, plus account/storage metadata. Backup is designed so we do not receive your recovery words or readable Vault content.

Keep the 12-word Recovery Key (recovery phrase) private and available somewhere safe. We cannot retrieve or reset it to decrypt an inaccessible backup. If your local Vault can still be unlocked, the app may let you replace the recovery key; if both access to the local copy and the key are lost, recovery is not possible. We cannot guarantee availability or absolute security.

Exports, screenshots, shared files and recovery cards outside Vault are controlled by their destination. Signing out preserves encrypted local records. Successful account deletion clears the signed-in device’s Vault; other offline devices, system backups and exported copies need separate attention. Deleting an individual local item and deleting the cloud backup are different actions.

9. Share links, invitations, widgets and wearables

A location share link lets someone outside the app see the information the link exposes, including your first name/photo and available position. Anyone who obtains or is forwarded the link may use it while active. Links have a selected duration and can be revoked or replaced; ending access does not recall screenshots. Invitations and Gift Plus links also contain private access capabilities. Share them only with intended recipients, and obtain permission before supplying another person’s details.

Widgets and live activities cache selected Bubble names, member status and, where supported, location/map/avatar data. Watch and Wear apps process pairing identifiers, scoped sessions, Bubble summaries, Journey and SOS data; supported SOS flows can transmit watch location. Data may be visible on home, lock or watch screens and may be stale. Device locks and available privacy settings matter.

Ring phone processes recipient permissions, trusted-person/Bubble grants, blocked senders, request identities/timestamps and acknowledgement/found status. A request expires for action after 60 seconds; this does not mean its activity records are erased then.

Tags process identifiers, pairing/connection/battery status, button events and associated phone/location information for nearby finding, separation alerts and supported SOS actions. They require a compatible phone and are not independent cellular GPS trackers. Android Fake Call is a local simulation, not an actual telephone call.

10. Payments, orders and communications

Apple processes supported iOS Plus subscriptions and Gift Plus purchases. We receive product/transaction identifiers, entitlement/renewal status, allocations and gift claim records, not full payment-card details. Android currently displays store prices and server entitlements but does not start a Google Play purchase. Google billing, cancellation and refunds apply only to an actual purchase offered through that store. Gift claim information is not permission for the giver to track the recipient.

Website orders use shopping, payment and delivery providers, including Shopify. Order/contact/address, payment status, invoices, returns and support records are distinct from app location data. We receive enquiries and guide requests you submit. Optional marketing requires an appropriate permission; you can unsubscribe without losing essential service messages. Australian commercial-message opt-outs are honoured within five working days. We do not treat an invitation or support request as unlimited marketing consent.

11. Analytics, diagnostics and providers

From the 4.0.41 backend deployment, first-party product events from people who are not known adults, including accounts whose age is unknown, are discarded. Essential operational and security records remain separate. Existing lawfully retained events and summaries are not deleted by this release.

In 4.0.41 and later apps, Firebase Analytics collection and Meta automatic initialisation/event logging are disabled at launch. They are enabled only for an account recognised as an adult with the applicable consent. Collection is disabled for teen and unknown-age accounts and on sign-out. Advertising storage, advertising user data, advertising personalisation and advertiser-ID collection remain disabled as configured. Older app versions can behave differently until updated; the new server rule still discards non-adult first-party product events. These measurement changes do not turn off essential authentication, maps, notifications, diagnostics or platform/store crash reporting.

We use internal diagnostics and platform/store crash and Android ANR reports where available. The current apps do not include Firebase Crashlytics or Sentry; software crash reporting is separate from physical-crash detection.

Website choices separately govern optional Google Analytics 4/Microsoft Clarity analytics and Google Ads/Meta Pixel marketing measurement. Necessary session, cart and security technology supports website operation. Changing website cookies does not change app analytics permissions.

12. Overseas processing and other disclosures

The primary API, database and private object storage are configured on AWS in Mumbai, India (ap-south-1). This is not a promise that all data stays in India.

Australian and Indian staff may access information according to their authorised responsibilities. We also disclose information as you direct, to advisers where necessary, under valid legal requirements, or in a protected business transfer.

We do not sell personal information or display third-party advertising inside the app. That statement does not mean no information is disclosed to measurement providers. For Australia, we take reasonable steps required by APP 8 for overseas disclosures and remain accountable where the law requires; this policy is not a waiver. Applicable Indian transfer safeguards and restrictions also apply.

13. Retention and deletion

The following describes current storage rules and their limits. Cleanup can lag; a visibility window or expired link does not necessarily erase underlying data. Some records do not currently have an automatic expiry. Contact support about retention or deletion of your information.

Request deletion in Settings → Account → Account actions → Delete account, or use the public deletion page and email support. We verify identity proportionately; in-app deletion requires recent sign-in. An owned Bubble with another member’s active SOS may temporarily prevent owner deletion; contact support for assistance. Deleting an owned Bubble can affect its other members.

Core deletion removes the account and linked records; a retrying process handles Firebase identity and object/provider cleanup. Provider outages can delay completion. Help audit, legally required records and some financial records can remain. Newer pseudonymous analytics summary tables are not currently covered by the automatic account-deletion process. Contact support to request review and deletion of these records. Copies others exported, lawful provider records and protected backups are separate. We must explain what is retained, why and for how long. Uninstalling or signing out does not delete an account; deletion does not cancel store subscriptions.

14. Your rights and complaints

Write to support@imsafe.app for access, correction, consent withdrawal or deletion, and info@imsafe.app for grievances. We use reasonable identity checks, explain a lawful refusal and provide an escalation route. Withdrawal affects future consent-based processing, not the lawfulness of prior processing; it may make the relevant feature unavailable.

India. Applicable IT Act 2000 and SPDI Rules 2011 rights include reviewing/correcting information and withdrawing relevant consent. The SPDI grievance period is no more than one month. The DPDP Act 2023 and Rules 2025 have phased commencement: substantive notice/consent, access-summary, correction/erasure, nomination, grievance and child-data duties were not yet generally effective on 26 September 2026. We will implement applicable duties by their effective dates. A registered Consent Manager, when available under that framework, can manage your consent on your behalf; our app settings are not a registered Consent Manager. Once applicable, you may approach the Data Protection Board of India after using the required internal grievance process.

For applicable user-content complaints under the amended IT Intermediary Rules, we acknowledge within 24 hours and resolve within seven days; specified removal complaints within 36 hours, qualifying intimate/private/sexual or impersonation imagery within two hours, and qualifying court/government orders within three hours. Applicable appeal rights include the Grievance Appellate Committee. These shorter duties are not replaced by a general privacy-response target.

Australia. Where the Privacy Act 1988 applies, the Australian Privacy Principles govern collection, use/disclosure, security, overseas disclosures, access and correction. We aim to respond to access/correction requests and complaints within 30 days, with explanations where more time is reasonably required. This is a service target, not a universal statutory deadline. There is no unrestricted right to immediate erasure of every record. If dissatisfied, you may complain to the Office of the Australian Information Commissioner.

15. Children, security and policy changes

Accounts are available from age 13. Registration records an age band and the applicable consent version; it does not collect a date of birth or verify age. People aged 13 to 17 use their own declaration and consent; people under 13 cannot register. Community is available to eligible users from 13, and Ask for Help to eligible women and girls from 13 in India. Existing accounts that have never answered the age question must confirm they are 13 or over before Community.

We do not currently offer verified parental consent. We will introduce parental or guardian consent where law requires it, including preparing for India’s relevant child-data requirements by May 2027. This policy does not claim that an age declaration supplies every consent required by local law.

Help reports from people under 18 are treated as reports from minors. Access is restricted to authorised staff. Staff assess a safe contact method and safeguarding or legal reporting duties; reports are not automatically shown to Bubble members or family. We limit any necessary disclosure and cannot promise secrecy against legal requirements or someone controlling the person’s device.

When applicable, India’s DPDP framework treats people under 18 as children and generally requires verifiable parental consent and restricts detrimental processing, behavioural monitoring/tracking and targeted advertising. A child-safety location exemption does not provide general permission for unrestricted history, steps or SDK profiling. Australian consent depends on capacity and circumstances, alongside other child-safety laws.

We use access controls and encryption appropriate to the feature; only the described Vault backup has the stated end-to-end encryption design. No device or service is perfectly secure. We assess incidents and notify people and regulators when required, including Australia’s Notifiable Data Breaches scheme and applicable Indian requirements.

We will date approved updates, explain material changes and obtain fresh consent where required before new processing. A policy update alone is not consent to new purposes. See the changes listed below.

16. Change log

### What changed on 13 October 2026

• Added the optional weather disclosure: its own opt-in and off switch, the WeatherAPI provider row and what is not sent to that provider.

### What changed on 8 October 2026

• Updated age eligibility, age-band and consent records, Community confirmation and applicable parental-consent caveats.
• Explained the 4.0.41 adult-only first-party product events and consent-controlled app measurement, preserving essential operational records and diagnostics.
• Updated India-only Ask for Help eligibility and explained restricted minor-report access, safe contact and limits on disclosure and confidentiality.

### What changed on 26 September 2026

• Expanded location, steps, driving, battery, SOS, testing, Help, Chat, Community, wearables and sharing disclosures to reflect the current product.
• Updated Vault for encrypted backup on both platforms and explained recovery responsibilities.
• Added current SDKs, providers, overseas processing and data-specific retention and deletion limitations.
• Expanded Indian and Australian rights, complaint routes, children’s information and emergency-service limitations.