SafeOn is a personal safety app. You add people you trust as contacts, and when you press SOS, or miss the check-in of a safety check (for example a walk-home timer), SafeOn alerts them and shows them where you are.
This policy explains what personal data SafeOn uses, why, who else handles it, how long we keep it, and what your rights are. It covers the SafeOn mobile app, its web version and the SafeOn server. Our Terms of Service are separate and are shown in the app.
2. Who is responsible for your data
The data controller is Vinod, a private individual in Vaasa, Finland, who develops and runs SafeOn. If a company is set up to run SafeOn, this policy will be updated to name it.
We have not appointed a Data Protection Officer. Please contact the controller directly at the address above.
3. What we collect
Your account
Email address, name and password. Your password is handled by Google Firebase Authentication; the SafeOn server never sees or stores it.
Phone number, if you add one.
Your avatar choice. Avatars are preset icons; SafeOn does not ask for or store a photo of you.
The time you confirmed that you are 18 or older.
Your contacts
Trusted contacts: other SafeOn users you have invited, or who invited you, and accepted. We store the invitation, its status and the relationship labels you each choose (for example "sister").
Invitations you send: to invite someone you type their email address or phone number. The server uses it only to look for a SafeOn account with that address or number. If there is none, nothing is created, and the address or number is not stored or logged. Your own phone keeps a list of the addresses and numbers you invited, so you can see and withdraw your invitations; that list stays on the phone and is cleared when you sign out.
Emergency contacts: names, phone numbers and relationships of people you add for the text-message backup (see section 5). They do not need a SafeOn account.
SOS alerts and safety checks
Each SOS alert: when it started and ended, whether it was silent, which trusted contacts it went to, and a timeline of what happened (for example "SOS seen", "Help is coming").
When you respond to someone else's alert: your response, and, if your app can work it out, your rough distance and travel time to them. Your own position is not sent.
Safety checks: type, title, destination, note, duration, start and end times, and their outcome. Recurring safety check schedules: title, destination, days of the week, time zone and duration.
Your location
Your precise position (latitude and longitude) is sent to the SafeOn server only while an SOS alert or a safety check of yours is running. During an SOS the server keeps a trail of positions; during a safety check it keeps your last known position.
If you allow location "all the time", the app can keep sending your position while it is in the background or closed, but still only during a running SOS or safety check. The app explains this before it asks.
Your phone may also use your position on the device itself, for example to show you a map or the street address on the emergency-call screen. Turning a position into an address uses your phone's built-in service (Google on Android, Apple on iOS), not the SafeOn server.
You can change or withdraw location permission at any time in your phone's settings. Without it, SOS alerts still go out, but without your position.
Medical profile (optional)
If you choose to fill it in: date of birth, allergies, medications, medical conditions, emergency notes and preferred language, plus whether to share it during an SOS.
This is health data. We store it only with your explicit consent, and we record when you gave consent and which version of the consent text you agreed to. See section 6.
Notifications
Your device's push token, platform (Android or iOS), app language, when the device last checked in, and whether notifications and emergency alerts are switched on. This is how alerts reach you, and how the app can warn your contacts if your phone would not receive them.
Feedback
If you send feedback in the app: its type (bug, feature or support), your message, your platform and the app version. If you email us, we receive your email address and whatever you write.
Technical data
IP address: your device's IP address reaches our server with every request. We use it for rate limiting (to stop abuse), held in the server's memory for at most 24 hours. Our hosting provider also handles it to deliver the request.
Server logs: our own server logs record internal account IDs and errors. They do not record names, email addresses, positions or health data.
App Check: the app asks Google Firebase App Check to confirm that a request comes from a genuine copy of SafeOn on a genuine device. We keep only daily counts of how many requests passed or failed, per app platform and version. Those counts do not identify anyone.
This web page loads its font from Google Fonts, so your browser sends your IP address to Google when you open it.
What we do not do
No advertising, no analytics or tracking tools, no crash-reporting service.
We do not sell, rent or trade your data.
No profiling and no automated decisions about you.
The "AI help" screen works entirely on your phone. Nothing you type there is sent to us or to any AI provider.
4. Why we use it, and our legal basis
The GDPR requires a legal basis for each use of personal data. Ours are:
Providing SafeOn (your account, contacts, SOS alerts, sharing your location during an SOS or safety check, safety check reminders and escalation, push notifications): necessary to perform our agreement with you, GDPR Art. 6(1)(b).
Security and abuse prevention (App Check, rate limiting, server logs, finding and fixing faults): our legitimate interest in keeping SafeOn secure and working, Art. 6(1)(f).
Your medical profile: your explicit consent, Art. 9(2)(a) and Art. 6(1)(a).
Feedback you send us: our legitimate interest in answering you and improving the app, Art. 6(1)(f). Sending feedback is always your choice.
Keeping data when the law requires it: legal obligation, Art. 6(1)(c).
In a real emergency, where someone's life or health is at risk, processing may also be necessary to protect vital interests, Art. 6(1)(d).
5. Who can see your data
Your trusted contacts see your name, email address and avatar. When you start an SOS, or a safety check of yours escalates because you missed the check-in, the accepted trusted contacts on that alert see your positions, the alert timeline, and your medical profile if you have switched on "Share during SOS". If you remove a contact, they lose access to your alerts.
When you respond to someone's alert, your name and response appear in that person's alert, where they and their other contacts on the alert can see it.
Invitations: SafeOn does not tell anyone whether you have an account. Someone who enters your email address or phone number always gets the same answer ("If they use SafeOn, they'll get your invite"), whether or not you use SafeOn. If the address or number is yours, you receive their invitation, with their name and email address, and a notification with their name. They learn that it reached you only if you accept it. Searching by name is not possible.
Push notifications show text such as "[your name] has triggered an emergency SOS alert!" on your contacts' phones, including on the lock screen. They never contain your position. See section 7 for what travels with them.
Text-message backup: if an SOS cannot reach our server, the emergency-call screen can open your phone's messaging app with a help message and a map link to your position, addressed to your emergency contacts. Nothing is sent unless you press Send yourself, and the message goes through your mobile operator, not through SafeOn.
Service providers who run parts of SafeOn for us (section 7).
Authorities, only if the law requires us to hand data over.
6. Your medical profile
It is optional. SafeOn works without it.
Before you save one for the first time, the app asks for your explicit consent. We record the time and the version of the consent text.
It is encrypted (AES-256-GCM) before it is stored.
It is shown only to your accepted trusted contacts on an SOS alert, or on an alert created when you miss a safety check, and only if "Share during SOS" is on. When an alert starts, a copy of the profile is attached to it. That copy is also encrypted, and it is deleted about 72 hours after the alert ends.
Withdrawing consent: tap "Delete my medical profile" in the app at any time. This deletes the profile and the copies attached to your alerts, including a running one. Withdrawing does not make earlier processing unlawful.
7. Service providers and where your data goes
SafeOn does not run its own servers. These providers process data on our behalf:
Provider
What it does
Data
Location
Render (Render Services, Inc.)
Runs the SafeOn server
Everything the app sends to and receives from our server, including IP addresses and server logs
Frankfurt, Germany (EU)
Supabase (Supabase, Inc.)
Hosts the SafeOn database
All the app data in section 3 (the medical profile encrypted)
Stockholm, Sweden (EU)
Google Firebase Authentication (Google)
Sign-in, verification and password-reset emails
Email address, password (stored as a hash), user ID, sign-in records
Global, including the US
Google Firebase App Check (Google)
Confirms requests come from a genuine app and device
Device and app attestation data
Global, including the US
Expo (Expo, Inc.)
Push notification delivery, and app updates
Push tokens and notification contents (below); for updates, your IP address and app version
US
Google Firebase Cloud Messaging (Android) and Apple Push Notification service (iOS)
Deliver notifications from Expo to your phone
Push tokens and notification contents (below)
Global, including the US
Gmail (Google)
Our support mailbox
Emails you send to safeon.support@gmail.com
Global, including the US
cron-job.org
Triggers the regular check for missed safety checks, and checks that the server's scheduled tasks are still running
No personal data
Germany (EU)
What notifications contain. A notification carries its text and some data for the app: a person's name, what happened, and the internal ID of the alert or safety check it is about. An SOS notification includes your name and the alert type. A safety check notification can include the title and destination you typed for the check (for example "Walking home (to Central Station)"); that is your own text, not a position. Other notifications include a person's name and what happened (for example a contact invitation, a response to your alert, or an SOS that has ended). No notification contains your position or any coordinates. Your contact's app fetches your position from the SafeOn server only after they open the alert. Notifications pass through Expo and then Google or Apple on their way to the phone.
Transfers outside the EU. Google, Expo and Apple may process data outside the EU/EEA, mainly in the United States. For these transfers the providers offer the safeguards in their terms: certification under the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses. Your position and your medical profile are not among the data that goes to them: both stay with our server and database in the EU. Render and Supabase are US companies, but the servers we use with them are in the EU.
8. How long we keep it
Positions: kept while an SOS alert or safety check is running, and deleted 30 days after it ends. Within those 30 days you and your contacts can still see where it happened.
Alert and safety check records: the fact that an alert or check happened (times, status, timeline, who responded), without positions after 30 days, stays in your history until you delete your account.
An alert that is never ended: an SOS, or an alert from a missed safety check, that has had no activity for 24 hours (no new position, no response from a contact, no change to its contacts and no new timeline entry) is ended automatically, and its timeline says so. From then on the same limits apply as to an alert you end yourself: the medical copy is deleted about 72 hours later and positions 30 days later. You need to end a running alert before you can delete your account; an abandoned one stops blocking deletion once it has been ended automatically.
Medical copy attached to an alert: deleted about 72 hours after the alert ends, or earlier if you delete your medical profile.
Medical profile: until you delete it or your account.
Account, contacts, safety check schedules and feedback: until you delete them or your account. There is currently no automatic time limit.
Push tokens: until you sign out on that device, sign out all devices, another account signs in on that device, the push service reports that the device no longer exists, or you delete your account.
Rate-limiting data (IP addresses): in memory for at most 24 hours.
Emails to our support address: for as long as needed to deal with your request.
The automatic deletions run every few hours, so data can last a few hours past the times above.
9. Deleting your account
In the app: Settings → Delete Account. You confirm with your password.
Deletion happens straight away and cannot be undone. It removes your account and sign-in, profile, trusted and emergency contacts, invitations, alerts you started with their positions and timelines, safety checks and schedules, medical profile, feedback and push registrations.
Some things remain after deletion:
Your responses on other people's alerts. Those timeline entries belong to the other person's record of what happened to them. They stay, with your name, email address and any free text naming you removed.
Backups kept by our database provider, until they expire under its normal backup cycle.
Server logs kept by our hosting provider, which can contain your internal account IDs (not your name or email address), until they expire.
Old record identifiers. For accounts from before SafeOn moved to its current database in 2026, an internal migration record keeps old record IDs, without names or contact details.
Things already on other people's phones, such as notifications or text messages they have received.
10. Your rights
Under the GDPR you have the right to:
Access your data and get a copy of it.
Rectification: correct it. You can change your name, phone number, avatar and medical profile in the app; ask us for anything else.
Erasure: have it deleted (section 9).
Restriction: ask us to limit how we use it.
Portability: get the data you gave us in a machine-readable format.
Object to processing based on our legitimate interests (section 4).
Withdraw consent at any time, for example by deleting your medical profile, without affecting processing that happened before.
To use any of these rights, email safeon.support@gmail.com, preferably from the address on your account so we can confirm it is you. We will answer within one month. If a request is complex we may extend this by up to two more months, and we will tell you why within the first month.
Complaints. You can complain to the Finnish data protection authority, the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), Lintulahdenkuja 4, 00530 Helsinki, Finland, tietosuoja.fi, or to the authority in the EU country where you live or work.
11. Age limit
SafeOn is for adults. It is not intended for anyone under 18, and you must confirm that you are 18 or older to use it. If we learn that an account belongs to someone under 18, we will delete it.
12. Security
All traffic between the app, our server and our providers is encrypted (HTTPS).
Medical data is encrypted with AES-256-GCM before it is stored.
Your alerts can be read only by you and the trusted contacts on them. Only you can change your profile, and only you can read your medical profile outside the SOS sharing described in section 6.
Deleting your account or signing out all devices requires you to enter your password again.
13. Changes to this policy
If we change this policy, we will publish the new version here and update the effective date. If a change matters for how your data is used, we will also tell you in the app.
14. Language
This policy is currently published in English only. The SafeOn app is available in English, Finnish, Swedish, Spanish, French, Turkish and Hindi.