Terms of Service & Privacy Policy
Sanctuary is a personal safety tool that helps you create emergency plans, alert contacts, and document encounters. It is provided as-is for informational and personal safety purposes.
Sanctuary is NOT an emergency response service and is NOT a substitute for 911 or any professional emergency, police, medical, or fire service. Sanctuary does not contact, dispatch, or transmit your information to 911, emergency dispatchers, public-safety answering points (PSAPs), law enforcement, or any government or professional emergency responder. When you send an alert, Sanctuary notifies only (1) the personal emergency contacts you have chosen and linked, and (2), if you opt in, nearby Sanctuary community members — all through Sanctuary's own servers. Message and location delivery depends on network and device conditions and is not guaranteed. In any emergency or situation involving immediate danger, call 911 or your local emergency number directly.
Sanctuary is a tool to assist with personal safety planning, but it cannot guarantee your safety. Push notifications, emergency alerts, and community broadcasts are delivered on a best-effort basis and may fail due to network conditions, device settings, or service outages. Do not rely solely on this app in emergency situations — always call 911 or local emergency services when in immediate danger.
The "Know Your Rights" section contains general educational information only. It does not constitute legal advice. Laws vary by state and jurisdiction and can change at any time. Consult a licensed attorney for guidance specific to your situation.
You are responsible for complying with all applicable laws when using this app, including recording consent laws in your jurisdiction. Some states and countries require all parties to consent to being recorded. You are responsible for knowing and following the laws that apply to you.
Sanctuary has zero tolerance for objectionable content or abusive behavior. When you use the community alert feature, you agree not to send false, harassing, threatening, or abusive alerts, or to use alerts for any purpose other than genuine safety awareness. Community alert messages are limited to predefined safety templates — you cannot send custom free-text or media to other users. You can report an abusive or false community alert directly from the alert screen. We review reports and may remove content and suspend or permanently terminate the account of any user who violates this policy.
To the maximum extent permitted by law, the creators of Sanctuary shall not be liable for any damages arising from the use or inability to use this app, including but not limited to failure to deliver notifications, loss of data, or reliance on information provided within the app.
Account information (username, hashed password, email/phone), push notification tokens, emergency contact links, alert records (up to 90 days), and live recording footage and GPS trails (30 days). Community alert subscriptions include approximate location, rounded before it is stored. When you SEND a community alert, your location is shared with nearby opted-in users: for "I Feel Unsafe", "Potential ICE Activity" and "Community Check-In" your exact coordinates are sent so people can reach you; for "Police Encounter" alerts, which are reported by bystanders, the location is coarsened to an area of roughly one kilometre. Your own emergency contacts always receive exact location. If you report an alert as abusive, we store your username, the reported username, and the reason you give, for moderation review. If you send feedback, we store your username and your message. If you subscribe to Sanctuary Protector, we store your subscription status. If you choose to send an error report, we store the diagnostic details you submit.
Your safety plan (attorney, medical, dependents, custom messages) is encrypted on your device using AES-256-GCM. Only you can access it. Local evidence and alert history are also stored on-device.
Alert records: up to 90 days. Recording session metadata and GPS trails: 30 days. Uploaded recording files remain in our evidence storage until you delete them from the Evidence screen. Push subscriptions: 90 days. Community alert subscriptions: 7 days. Invite codes: 24 hours. Abuse reports: 180 days. Feedback submissions: 90 days. Diagnostic events: 7 days. Account data persists until you delete your account.
Sanctuary's core safety features, including emergency alerts, are free. Sanctuary Protector is an optional auto-renewing subscription. On iPhone and iPad, purchases are processed by Apple. On the web, purchases and donations are processed by Stripe. In both cases we never receive or store your payment card details. We use RevenueCat to manage subscription status, associated with your Sanctuary username, so we can unlock Protector features on your account.
If something goes wrong, you can choose to send us an error report. These reports contain diagnostic information (such as the error and app state) to help us fix bugs. They are used only to improve the app and are never used for advertising or tracking.
The app also sends a small stream of technical events automatically — an event name, related values such as the approximate area used for a community alert, a device-type label, and a timestamp — so we can diagnose alert-delivery failures. These are not linked to your username and are deleted after 7 days.
We do not use third-party analytics or advertising SDKs, we do not track you across apps or websites, and we never sell your data. We do not monetize your personal information. We do collect our own basic diagnostic events to keep alert delivery working — see Automatic Diagnostics above.
We use the following service providers to operate the app: Upstash (database), Cloudflare (evidence storage), Vercel (hosting), Apple (App Store purchases and push notification delivery), RevenueCat (subscription management), Stripe (web payments and donations), Resend (transactional email such as password resets), and Google Fonts (webfont delivery, which receives your IP address when the app loads). These providers process data only to provide their service to us.
You can export your account data and delete your account from the Account screen at any time. Deleting your account removes your login, emergency-contact links, push registrations, alert history and recording index from our servers. Recording and evidence files already uploaded to our evidence storage are not removed by account deletion — delete those from the Evidence screen first if you want them gone. Local data can be erased separately from Settings.
Questions about this policy? Contact us at empoweredrecordings@gmail.com.
Last updated: July 2026 · Empowered Recordings