Know the limits

Chillswitch is designed to support a check-in plan, but no mobile service can guarantee delivery or a response. These limits are part of deciding whether it fits your circumstances.

A missed check-in is not proof of danger

Chillswitch knows that a scheduled confirmation has not arrived. It does not know why. The person may be offline, asleep, out of battery, unable to respond, or in danger. Recipients must use their own judgment.

Notifications can fail or arrive late

Delivery depends on the device, battery, permissions, connectivity, operating system, Apple or Google push services, our infrastructure, and recipient settings. Time Sensitive notices on supported iPhones can break through some Focus settings, but Chillswitch does not use Apple Critical Alerts and does not override the mute switch. Android behavior varies by manufacturer and battery policy.

A notification action opens the app. It is not a guaranteed background check-in from a force-quit phone, and passcode- or gesture-protected accounts require verification. The app shows confirmed versus not-yet-delivered state; do not treat a local tap as server acceptance.

Sealed content is not zero metadata

In-app alert content is sealed on the device, but Modernaut’s server stores the account and circle relationships, schedules, deadlines, routing, push tokens, delivery state, and security records needed to operate the service. Connections also expose standard IP, timing, and device metadata to infrastructure providers. Chillswitch does not currently use an oblivious relay or pairwise unlinkable delivery queues.

Location is optional and never live

Chillswitch does not ask for “Always” or background-location permission, and it never shows anyone your live location. If enabled, a location is captured when you check in and may be shared in selected sealed in-app alert steps. On a paid plan, a trip you start can also record a route while it runs, even with the app in the background; the operating system shows its location indicator the whole time. Routes are sealed on your device and can be opened by your contacts only after a lapse or a help press. Any location can be stale, and its accuracy comes from the device. It is a starting point, not a rescue service or proof of safety.

Your device remains part of the trust boundary

Hardware-backed key wrapping is used where supported and reported by the device, with fallback behavior where it is unavailable. An unlocked, compromised, or seized device may expose keys and visible data. Duress controls can change the signal sent to the service; they do not wipe the phone or erase evidence.

Stores and providers learn operational facts

Apple and Google receive push and store-billing data. A paid subscription adds a durable store transaction identifier. Hosting providers process application data and network logs. Provider terms, outages, policy changes, and store removal can affect availability.

Organizations do not receive hidden access

Chillswitch has circle owners, not an organization-wide administrator who can inspect personal schedules. Owning a roster does not reveal another person’s check-in history, alert content, or location. Organization use remains subject to voluntary participation and separate written terms.

Not emergency services

Chillswitch notifies contacts you selected. No response center is watching, and Modernaut does not call or dispatch emergency services. Contacts may not see or act on a notice. If you are in immediate danger, contact local emergency services and use another appropriate safety method.

Read the policies

The Privacy Policy explains data handling. The Terms of Use govern the service. Both should be reviewed alongside these technical limits.