Terms of Service & Privacy Policy
Sanctuary is a personal safety tool that helps you create emergency plans, alert contacts, and document encounters. It is provided as-is for informational and personal safety purposes.
Sanctuary is NOT an emergency response service and is NOT a substitute for 911 or any professional emergency, police, medical, or fire service. Sanctuary does not contact, dispatch, or transmit your information to 911, emergency dispatchers, public-safety answering points (PSAPs), law enforcement, or any government or professional emergency responder. When you send an alert, Sanctuary notifies only (1) the personal emergency contacts you have chosen and linked, and (2), if you opt in, nearby Sanctuary community members — all through Sanctuary's own servers. Message and location delivery depends on network and device conditions and is not guaranteed. In any emergency or situation involving immediate danger, call 911 or your local emergency number directly.
Sanctuary is a tool to assist with personal safety planning, but it cannot guarantee your safety. Push notifications, emergency alerts, and community broadcasts are delivered on a best-effort basis and may fail due to network conditions, device settings, or service outages. Do not rely solely on this app in emergency situations — always call 911 or local emergency services when in immediate danger.
The "Know Your Rights" section contains general educational information only. It does not constitute legal advice. Laws vary by state and jurisdiction and can change at any time. Consult a licensed attorney for guidance specific to your situation.
You are responsible for complying with all applicable laws when using this app, including recording consent laws in your jurisdiction. Some states and countries require all parties to consent to being recorded. You are responsible for knowing and following the laws that apply to you.
Sanctuary has zero tolerance for objectionable content or abusive behavior. When you use the community alert feature, you agree not to send false, harassing, threatening, or abusive alerts, or to use alerts for any purpose other than genuine safety awareness. Community alert messages are limited to predefined safety templates — you cannot send custom free-text or media to other users. You can report an abusive or false community alert directly from the alert screen. We review reports and may remove content and suspend or permanently terminate the account of any user who violates this policy.
To the maximum extent permitted by law, the creators of Sanctuary shall not be liable for any damages arising from the use or inability to use this app, including but not limited to failure to deliver notifications, loss of data, or reliance on information provided within the app.
Account information (username, hashed password, email/phone), push notification tokens, emergency contact links, and live recording footage and GPS trails (kept until you delete them). Alert records come in two kinds and are not kept the same way: a record of any alert you raise from an alert button is kept for 30 days with no coordinates, while a check-in timer or recording-session alert is kept for 90 days and does include your last known position and a map link, alongside your username. Travel Buddy trips hold each member’s approximate position — rounded to roughly 110 metres — while the trip is running, together with any safety plan details you explicitly choose to share with that trip, which are stored in plain text on our servers. Community alert subscriptions include approximate location, rounded before it is stored. When you SEND a community alert, your location is shared with nearby opted-in users: for "I Feel Unsafe", "Potential ICE Activity" and "Community Check-In" your exact coordinates are sent so people can reach you; for "Police Encounter" alerts, which are reported by bystanders, the location is coarsened to an area of roughly one kilometre. Your own emergency contacts always receive exact location. We do not store the coordinates from an alert-button press, whichever button it was: that record notes only that an alert happened, what kind it was, how many contacts it reached, and whether a location was attached. Check-in timer and recording alerts are different — they do keep your last known position, because they are the start of an evidence trail you may later need. If a recording was attached to that timer, the alert also carries a share link to it. That link opens the recording without signing in, for your contacts and for anyone they forward it to, and it stops working 90 days after the alert. The recording itself is not deleted then; only the link stops opening it. If you report an alert as abusive, we store your username, the reported username, and the reason you give, for moderation review. If you send feedback, we store your username and your message. We keep a security audit log — sign-ins, alert triggers, rate-limit blocks — for 30 days. Those entries record a truncated IP address, with the last part removed, so it identifies a network rather than your device; we do not store your full IP address in that log. If you subscribe to Sanctuary Protector, we store your subscription status and the customer ID our payment processor issues. If you choose to send an error report, we store the diagnostic details you submit — together with your username if you are signed in — for 90 days.
Your safety plan (attorney, medical, dependents, custom messages) is encrypted on your device using AES-256-GCM. Only you can access it. Local evidence and alert history are also stored on-device.
Alert records from any alert button — "I Feel Unsafe", "Police Encounter", "Potential ICE Activity", "Community Check-In" — and from a check-in timer running out, none of which carry coordinates: 30 days. Check-in timer and recording alert records, including the coordinates they carry: 90 days. Recording session metadata, GPS trails, and uploaded recording files are kept until you delete them from the Evidence screen. We do not delete your evidence on a timer, because a legal case can take months or years. Each account has a storage allowance; when it is full, new recordings stay on your device only until you delete some evidence or upgrade. Push subscriptions: 400 days after the subscription was last used or refreshed, and immediately whenever Apple or your browser tells us the device is gone. This is longer than most of the retention periods here on purpose: a push subscription is how an emergency contact’s phone gets woken up, and someone who installed Sanctuary to be reachable for another person may not open the app for months. Community alert subscriptions: 7 days. Invite codes: 24 hours. Travel Buddy trips, including shared positions and any shared plan details: until 7 days after the trip’s end date. Evidence share links: 90 days, after which the link stops opening — the recording itself stays until you delete it. Security audit log: 30 days. Abuse reports: 180 days. Feedback submissions: 90 days. Diagnostic events: 7 days. Daily device-open counts: 8 days. The all-time device-open total is a single number that is never deleted, because it is a count and holds no identifiers. Account data persists until you delete your account.
Sanctuary's core safety features, including emergency alerts, are free. Sanctuary Protector is an optional auto-renewing subscription. On iPhone and iPad, purchases are processed by Apple. On the web, purchases and donations are processed by Stripe. In both cases we never receive or store your payment card details. We use RevenueCat to manage subscription status, associated with your Sanctuary username, so we can unlock Protector features on your account.
If something goes wrong, you can choose to send us an error report. These reports contain diagnostic information (such as the error and app state) to help us fix bugs. They are used only to improve the app and are never used for advertising or tracking. We keep a report for 90 days and it is then deleted automatically. If you are signed in, your username is stored with it so we can follow up on what went wrong; if you are signed out, the report is stored without one.
The app also sends a small stream of technical events automatically — an event name, related values such as the approximate area used for a community alert, a device-type label, and a timestamp — so we can diagnose alert-delivery failures. These are not linked to your username and are deleted after 7 days.
When the app checks for an update, we add that check to a count of how many devices open the app — a running total for all time, and one for each of the last 8 days. It is a count, not a list: your device’s identifier is not stored, the count cannot be turned back into a list of the devices that opened the app, and it cannot tell us how many times yours did. Know the limit of that, because we would rather state it than overstate the protection: someone who already holds your device’s identifier — which in practice means someone who has your phone — could test it against these counts to learn whether that device is among them. Each daily count is deleted 8 days after the day it covers; the all-time total is a single number. We use it only to know roughly how many people the app is reaching.
Sanctuary reads your location when you act: when you send an alert, when you send a community alert, while you are recording, or when you update your position on a Travel Buddy trip. There is one reading you do not start each time, and you switch it on yourself. If you turn on Community Alerts, the app uploads your position automatically when you open the app, so we know which nearby alerts to send you. That automatic position is rounded to roughly 110 metres before it is stored, it is refreshed when you open the app, when you sign in, when you change these settings, and each time you send a community alert — and at most once an hour while the app simply stays open — and it is deleted after 7 days. Turn Community Alerts off and the automatic reading stops. There is no background location in either case — while the app is closed it cannot read your position at all.
When you send an alert, your position is delivered to your linked emergency contacts. If the community broadcast is on for that alert type, it also goes to nearby opted-in strangers within about 8 kilometres — and for "I Feel Unsafe", "Potential ICE Activity" and "Community Check-In" those neighbours receive your exact coordinates, because someone may need to reach you. "Police Encounter" alerts are the exception: the position is coarsened to an area of roughly one kilometre before it goes out, because the person sending one is usually reporting something they saw rather than asking for help. You can turn the community broadcast off for any alert type in Settings; your emergency contacts still receive the alert. There is no live location screen for your emergency contacts, for nearby users, or for us. Travel Buddy is the one exception, and it is one you set up yourself: while a trip is running, the members of that trip can see each other’s last shared position on a map, and it ends when the trip does.
What stays on our servers depends on which alert you sent. Every alert you raise from an alert button leaves a record with us that carries no coordinates at all — only your username, which button you pressed, how many contacts it reached, and whether a location was attached. A check-in timer that runs out, or a recording session that raises an alert, does store your last known position for 90 days, and the person who runs Sanctuary can see that point on a map next to your username. We keep it because that alert is the start of an evidence trail you may need — if you lose your phone, or a lawyer asks for it on your behalf, that record is the reason we can answer. A recording session also saves its own GPS trail, and Travel Buddy holds your approximate position while a trip is running, for the other members of that trip to see. We do not build a location history out of ordinary use of the app, we never tie your location to who you are for our own purposes apart from the places named here — the 90-day timer-or-recording record above, which sits next to your username; the GPS trail saved alongside a recording, which is part of that evidence and is kept for as long as you keep the recording; your position on a Travel Buddy trip, which you post yourself; and the approximate community position, which is stored against your device’s notification token and can be traced back to your account — and we never use your location for anything except delivering the alert you sent and keeping the evidence you asked us to keep.
We do not use third-party analytics or advertising SDKs, we do not track you across apps or websites, and we never sell your data. We do not monetize your personal information. We do collect our own basic diagnostic events to keep alert delivery working, and an aggregate count of how many devices open the app — see Automatic Diagnostics and App Opens above.
We use the following service providers to operate the app: Upstash (database), Cloudflare (evidence storage), Vercel (hosting), Apple (App Store purchases and push notification delivery), RevenueCat (subscription management), Stripe (web payments and donations), Resend (transactional email such as password resets), and Google Fonts (webfont delivery, which receives your IP address when the app loads). These providers process data only to provide their service to us.
Sanctuary is a small independent project, not a company with a legal department. If we receive a subpoena, court order, or other legally binding demand, we can only produce what we actually hold: your username, your hashed password, the email or phone number you gave us, your push notification tokens, which usernames you are linked to as emergency contacts, alert records (30 days for alert-button records, which carry no coordinates; 90 days for check-in timer and recording alerts, which do include your last known position), any recordings and GPS trails you chose to back up to our servers, an approximate location if you subscribed to community alerts, abuse reports involving you, feedback and error reports you sent — feedback carries your username and whatever text you typed, and an error report carries that plus what your device was doing when it failed: the app version, your device and browser, and for each fault its time, the screen you were on and the technical detail of the error, which can show that you were recording, running a check-in timer, or receiving an alert at that moment — a security audit log of account events, and your subscription status and payment processor customer ID if you subscribe. Your safety plan is encrypted on your device with a key we never receive, so it is not ours to hand over — with one exception, which you control: any plan details you explicitly share with a Travel Buddy trip are stored on our servers in plain text, and those we could be compelled to produce. Unshare them, or leave the trip, and they are deleted from our servers — though anyone who already read them in the app may have kept their own copy. We do not build a location history from your ordinary movement. A Travel Buddy trip is the closest thing to one: while it runs it holds each member’s approximate position, and it is deleted 7 days after the trip’s end date. We do not hand your data to law enforcement or immigration authorities voluntarily, and we do not act on an informal request. We will push back on a demand that looks overbroad or defective. But we are a small independent project without a legal department: if a demand is valid on its face we will most likely have to comply with it, and we cannot promise to fight one in court on your behalf. Where the law permits it, we will try to tell you before we respond so you have a chance to object. We would reach you at the email address on your account, so if you signed up with a phone number or with neither, we may have no way to contact you. A court can also forbid us from telling you at all, and we will not promise notice we are not allowed to give. If you want to reduce what could ever be produced about you, turn off server backup for recordings, leave location sharing off when you create a Travel Buddy trip, unshare your plan, leave trips you have finished — leaving deletes your position and your shared plan from that trip — and delete evidence you no longer need.
Every retention period on this page describes what we delete in the ordinary course of running the app. None of them is a promise that data will be gone by a certain date no matter what. If we are served with a preservation request or order before something expires, the law can require us to hold that data instead of deleting it on schedule, and it can require us not to tell you that it happened. We cannot opt out of that, and neither can you. The only data this cannot reach is data we never had: your safety plan is encrypted on your device with a key we never receive — apart from any plan details you chose to share into a Travel Buddy trip, which are stored in plain text and could be preserved like anything else — and the exact coordinates from an alert-button press pass through our servers to reach your contacts but are never kept — only the coarse diagnostic area described under Automatic Diagnostics, for 7 days.
You can export your account data and delete your account from the Account screen at any time. Deleting your account removes your login, emergency-contact links, push registrations, alert history and recording index from our servers. Deleting your account also permanently deletes the recording and evidence files you uploaded to our evidence storage. It removes you from any Travel Buddy trip you are on, taking your shared position and any plan details you shared with that trip with you; if you were the only member left, the trip itself is deleted. Local data can be erased separately from Settings. Deleting your account does not cancel a Protector subscription. On iPhone and iPad, Apple bills the subscription and only you can cancel it, from your Apple ID subscription settings. On the web, cancel from the Subscription screen before you delete your account — afterwards you can no longer sign in to manage billing.
Questions about this policy? Contact us at support@empoweredsanctuary.com.
Last updated: August 2026 · Empowered Recordings