How alerts stay private

Alerts are locked on your phone before they are sent. Chillswitch's servers pass along an envelope they cannot open. They know a deadline passed and which contacts you chose, but not what the message says.

In plain words

• When you write a note or attach a location, your phone seals it using keys that belong to your chosen safety contacts.
• The server forwards the sealed envelope and cannot read it.
• Alerts and all-clears are signed so your contacts can tell a real one from a forged one. The app shows when a signal cannot be verified.

What stays visible

Sealed content is not zero metadata. The service still handles who is connected to whom, schedules, deadlines, delivery state, and standard network details. SMS texts are not end-to-end encrypted and are visible to carriers.

The device is part of the boundary

An unlocked, compromised, or seized phone may expose keys and what is visible on screen. Hardware-backed key protection is used where the device supports it, and the app reports honestly where it does not. Duress controls change what is sent; they do not wipe the phone or erase evidence.

More detail

Read Security and Know the limits. To report a vulnerability, email [email protected].