Privacy, in Plain Words
The short version of what we collect, what we keep, and what we will never do.
Most privacy policies take ten pages to say what could be said in ten sentences. This page is the plain-language summary of what Chillswitch does with your data, what we can and cannot see, and why our systems are built this way. If you need the complete legal agreement with formal statutory definitions, it is available at our full Privacy Policy.
What we never collect or require
No names, emails, or phone numbers required: Your account is identified by a cryptographic key pair generated directly on your phone. You do not need to provide an email address, phone number, or real name to use Chillswitch.
No always-on location tracking: Chillswitch never asks for “Always” or background-location permission, and never shows anyone your live location. Location is optional and off by default. It is attached only when you deliberately turn it on and press the switch, or, on a paid plan, recorded for a trip you start, with your phone’s location indicator on the whole time. Trip routes are sealed on your device and can be opened by your contacts only if the trip lapses or you ask for help.
No address book uploads: We never upload or sync your contact list. When you invite someone to your safety circle, our system learns only that single phone number so we can deliver fallback SMS alerts if you go quiet.
No third-party trackers or ads: No advertising networks, no tracking pixels, and no analytics SDKs.
What happens to your alert data
Sealed on device before transmission: When an alert is triggered, your message, departure location, and timestamps are encrypted on your device using keys that belong exclusively to your chosen safety contacts.
Sealed envelopes: Our servers deliver alert envelopes without possessing the decryption keys. We cannot read the emergency notes or locations contained within sealed in-app alerts.
No completed check-in history: We do not keep a history of your completed check-in times. Once an alert has been delivered to your contacts, it is removed from the active delivery queue. Limited operational and security records still exist, as the full Privacy Policy explains.
Why nothing on your phone gets deleted
The name sounds like a button that wipes your phone. It is not. Chillswitch never deletes your photos, messages, files, or applications. We made this architectural decision deliberately: in crisis situations, an app that erases user data can lead to criminal prosecution for destruction of evidence or obstruction of justice. Chillswitch is designed so you never face that danger.
Your recovery code
When you create your account, a recovery code is generated locally on your phone and is never sent to our servers. We hold an encrypted backup blob; you hold the recovery code. Neither works without the other. Because we do not know your code, we cannot reset it or hand it over to third parties or law enforcement.
Subscriptions and payments
In-app subscriptions are processed directly through Apple App Store or Google Play. We receive validation receipts to confirm your active entitlement, but we never see, handle, or store your credit card or billing details.
Full legal terms
This plain-language summary describes our actual architecture and daily operational boundaries. For legal disclosures, statutory rights under GDPR and CCPA, subprocessor notices (such as Twilio for SMS), and service warranties, please consult our full Privacy Policy and Terms of Use.