OUR PRIVACY PROMISE
Safe check-ins.
Not constant tracking.
Privacy Policy · Updated November 11, 2026
SafeTrip is in family beta. This policy describes our data handling; it is not a certification of legal compliance. Children may participate only with a parent or guardian and any legally required verified parental consent.
Who is responsible
ILGV LLC, Florida, United States, operates SafeTrip. Contact privacy@safetrip.dev about personal data, or support@safetrip.dev for support.
What stays on the child’s phone
The child’s phone checks raw GPS fixes against your agreed safe places and route corridors. Raw fixes stay in a short local SQLite buffer for no more than 24 hours and are pruned on device. They are never uploaded as a stream. Local route rules, pending check-ins and diagnostic events help the app operate offline.
What your family shares
During normal use, the phone shares a derived status such as Inside safe spot, On route, Approved detour, Waiting or Offline, with a place or route identifier, last check-in time and optional battery level. These status rows contain no coordinates and overwrite the previous status.
When the child requests help or is confirmed outside their route corridor, an alert can share one snapshot: latitude, longitude, accuracy and time. An open snapshot can refresh at most once per minute by overwriting the same row. Resolving the alert clears those fields. We do not keep a server timeline of positions or a movement history.
Parents create safe places and routes, including their coordinates and schedules. These describe agreed places and plans, not a child’s movement. The parent map displays those plans and a snapshot point only while the relevant safety alert remains open.
Other information we process
Account email, family name, names and roles of members, optional phone numbers, child age and recovery email, pairing codes, device authentication records, push tokens, alert identifiers, requests and messages are used to deliver the family service. Use only information needed for your family. Do not put sensitive personal details in free-text messages.
Purpose and legal grounds
We use account and family information to provide the service requested by the parent; consent where required for a child’s data or device permissions; and legitimate interests in account security, abuse prevention and reliability, subject to applicable law. We do not sell personal data, serve targeted advertising or analyze children’s movement for marketing.
Who receives data
Authorized parents and paired devices receive family data according to their role. Infrastructure providers process data to deliver hosting, authentication, email and notifications: Supabase, Cloudflare, the configured transactional email provider, Expo, Apple and Google. Push notifications contain a short notification and record identifiers; the app fetches the authoritative record after opening. Do not rely on lock-screen notifications for confidentiality.
The web uses map data through tiles.safetrip.dev when configured. Native builds may still use the public OpenFreeMap service, which receives the parent device’s IP address and requested map tiles. Child mode is mapless and never requests public map tiles. Providers may process IP addresses, request timestamps and security metadata; they do not receive a raw child GPS stream.
Retention
Raw GPS buffer: up to 24 hours locally. Status: one current row per child. Alert coordinates: cleared when resolved. Resolved alerts and decided, expired requests: scheduled for deletion after 30 days in bounded batches. Pairing codes expire after 15 minutes; expired and used records are periodically removed. Push delivery records and IP-derived abuse buckets are short-lived operational data; failed push jobs remain available for investigation.
Family profiles, routes and places remain until removed or the eligible account/family is deleted. Soft-deleted routes and places remain as synchronization tombstones until family deletion. Provider security logs, database recovery copies and mobile backups may have independent retention. We do not promise that deletion retroactively removes provider backups immediately.
Your controls and rights
Parents can correct family information, review requests, change agreed routes, remove places and request account deletion at Delete account. If another parent remains, the family transfers to that parent; otherwise associated family and child device accounts are deleted. Server deletion does not remotely wipe an offline phone. Sign out and uninstall SafeTrip to remove its local caches.
You may request access, correction, deletion, restriction, objection or an export at privacy@safetrip.dev, and withdraw consent where processing relies on it. We verify identity without asking you to send your password. Applicable GDPR rights include contacting your local supervisory authority. We respond within applicable legal deadlines.
Children and parental consent
The web cabinet is for adults aged 18 or over. A child does not create a web account. A parent pairs a child’s mobile phone and explains what statuses and alert snapshots are shared. Device permissions, an email code and a pairing code are not a substitute for legally required verifiable parental consent. Families requiring such consent must complete the applicable consent process before child data is collected. Parents may review their child’s data, revoke permission and request deletion.
US COPPA requirements and European consent thresholds vary. The operator must complete the required consent and notice arrangements before making the service available to affected children. See the FTC’s COPPA guidance and European Commission guidance.
Security and international processing
We use TLS, per-family database access rules, scoped device membership and server-side parent authorization. No system can guarantee uninterrupted service or absolute security. Production data is initially hosted in the United States; providers may process data in other countries. Required contractual safeguards and any regional representation must be in place before an applicable international launch.
Cookies and changes
Essential HttpOnly cookies keep the parent signed in. Turnstile helps prevent automated abuse. We do not use advertising cookies. Material privacy changes will be described here and communicated where required. Contact us before using SafeTrip if you have questions about a child’s participation.