SEYFI

Privacy Policy

Last updated: 1 October 2026

SEYFI is a personal safety check-in service built on one principle: safety without surveillance. While you are safe, your location is not shared with anyone — not your contacts. It is encrypted on your device before upload, and released to the contacts you chose only if you miss a safety check-in. Because SEYFI operates the release service, we are technically able to access this data; we access it only to deliver a genuine release and never otherwise. This policy explains what data we handle, why, and your rights.

1. Who is responsible

The data controller is Serge Schumacher (operating SEYFI), Luxembourg. Contact: [email protected].

2. What we collect and why

Account data

Your name, email address (from Sign in with Apple or Google; with Apple this may be a private-relay alias if you choose to hide your email) and, optionally, your phone number. Purpose: operating your account, and — only after a genuine alert — letting your trusted contacts recognise and reach you. Legal basis: performance of contract (Art. 6(1)(b) GDPR).

Trusted contacts — they join themselves

SEYFI never asks you for anyone else’s details and never reads your address book. To add a trusted contact, you send them an invitation link yourself (for example by iMessage or WhatsApp, from your own phone). The invitation contains no personal data. Only if the person opens it and chooses to accept do they enter their own name and phone number and/or email address. SEYFI stores exactly what they entered, for one purpose: delivering your alert to them if you miss a check-in or press the emergency button. They are never contacted while you are safe, never marketed to, and their details are never shared. Legal basis: their consent (Art. 6(1)(a) GDPR), and at the moment of an alert, protection of vital interests (Art. 6(1)(d)).

A trusted contact can withdraw at any time from the same invitation link (“Stop being an emergency contact”), which immediately deletes their details. Their details are also deleted when you remove them in the app or delete your account, and they can write to [email protected]. Invitations nobody accepted expire after 14 days and are removed.

Location data — only during a Safety Session

Location is recorded only while a Safety Session you started is active, at a deliberately coarse interval. Every sample is encrypted on your phone(AES-256-GCM under a per-session key) before it is uploaded; at rest our servers store only ciphertext. When you press “I’m safe” or end a session, that moment’s position is stored the same encrypted way. The trail is decryptedonly after a genuine release — when you miss a check-in or press the emergency button — by SEYFI’s release service, which then shows it to the contact you chose through a secure link. Legal basis: consent (Art. 6(1)(a) — you switch the trail on per session) and, at release, vital interests.

Check-ins and session metadata

Session start/end times, check-in confirmations and their timestamps, and — after an alert — whether you have since confirmed you are safe. Shown to your contacts on the emergency page so they can judge when you were last definitely fine.

Subscription status

Whether your account is on the free plan, a trial, or SEYFI+ (processed through Apple and RevenueCat; we never see your payment details).

Notifications

If you allow notifications, your device’s push token, used only to tell you when a trusted contact accepts your invitation. It is deleted when you sign out or delete your account.

Service notices to the operator

When an account is created, SEYFI’s operator receives an internal notice with the sign-in method, the app language, the time and the total number of accounts — never your name or email address.

What we do NOT collect

No advertising identifiers, no analytics or tracking SDKs, no behavioural profiling, no access to your address book and no details of other people entered by you (trusted contacts provide their own), no location outside an active session. The emergency page sets no third-party trackers.

3. How alerts work (and what recipients see)

If you miss a check-in and the grace period passes, or you press the emergency button, our server releases a one-time secure link to your chosen contacts by SMS or email. The message itself contains only your name and the link — never your location. The link opens a page showing exactly what you chose to share: your encrypted trail (decrypted in the recipient’s browser), your optional message, your check-in history, and your phone number so they can call you. Links expire after 48 hours and a limited number of views. We store only a cryptographic hash of each link token — a database breach cannot reconstruct working links.

4. Data retention — you choose

In Settings you choose between two retention modes for the encrypted trail and session payloads: delete 48 hours after the session ends (the default — 48 hours is the minimum, so an emergency page never outlives its data), or keep for 90 days, which you may prefer so the material is available to a criminal investigation. Ninety days is the hard ceiling in every mode; an automated sweep enforces it. Account data is kept until you delete your account. A trusted contact’s details are kept until they withdraw, you remove them, or you delete your account.

5. Processors and international transfers

Data is processed by these providers under data-processing agreements that require the same or equal protection of your data as this policy:

• Supabase (database, authentication) — hosted in the EU (eu-central-1, Frankfurt). Encrypted location data rests here as ciphertext only.
• Twilio (incl. its email service) — delivers alert SMS and email. Message routing data (recipient number/email, your name, the link) is processed in the United States under Standard Contractual Clauses.
• Cloudflare — hosts this website and the emergency page (edge network).
• Apple — sign-in, subscription billing and push notifications (Apple Push Notification service). Google — sign-in (Google Sign-In). RevenueCat — subscription status management.

6. Security

Client-side AES-256-GCM encryption of location and message payloads; per-session keys; release links stored as SHA-256 hashes only; row-level security on every table; server-side release logic so a stolen phone cannot silently cancel an alert; no plaintext coordinates in logs. The key that decrypts your trail is held separately from the database, in a managed secrets store, and is used only to deliver a genuine release. No system is perfectly secure, but the design goal is that a breach of the database alone yields ciphertext and hashes, not your movements. SEYFI is technically part of this trust boundary; we are not a zero-knowledge service.

7. Your rights

Under the GDPR you may access, rectify, erase, restrict, or port your data, object to processing, and withdraw consent at any time (e.g. by switching the location trail off or ending a session). Trusted contacts have the same rights over the details they gave us, and can withdraw instantly from their invitation link. Write to [email protected]. You may lodge a complaint with your supervisory authority — in Luxembourg, the CNPD (Commission nationale pour la protection des données, cnpd.lu).

8. Children

SEYFI is not directed at children under 16.

9. Changes

We will post any changes here and update the date above. Material changes will be flagged in the app.

SEYFI is a personal safety check-in, not an emergency service. In an emergency, always contact local emergency services.