SaveSelf Privacy Policy

App versions: the active iPhone control and deletion marker described below apply starting with version 1.0.1. In version 1.0.0, use only one iPhone per Apple Account; that version does not enforce this control.

Last updated: October 16, 2026

SaveSelf is a safety app for families and the people close to them: each person chooses what they share (location and SOS alerts) with the people in their circle.

This policy explains what data the app uses, where it is kept, who can see it, for how long, and how you control all of it, in accordance with Brazil's General Data Protection Law (LGPD — Law No. 13,709/2018). If you live outside Brazil, see also section 12.

This is a translation of the original Portuguese (Brazil) version: Política de Privacidade do SaveSelf.

1. Summary in plain language

We don't have a server. What you share is stored in your own iCloud (the records of your link with each person are kept in the iCloud of whoever created the invitation; section 3), not on SaveSelf computers.
We don't see your data. We have no access to your location or your alerts.
You decide who sees what, person by person: location and alerts are separate choices, and you can change them or turn them off whenever you want. When you connect with someone, your name, photo, phone number and your iPhone's status (battery, last seen and location permission) are already visible to that person; location and SOS, only if they are turned on. On the screen where you make this choice, SOS starts on and location starts off (section 6).
No health data. This version does not access the Health app or Apple Watch data and does not send any health or fitness data anywhere (section 5).
We don't ask for your email. To sign in, all you need is "Continue with Apple", which gives us only your name (if Apple doesn't send it, you choose the name your circle sees).
No ads, no tracking, no selling of data, and no third-party usage analytics tools.
You can delete everything in Settings → Delete Account.

2. Who is responsible

Controller: Marcelo Mouro (individual), developer of SaveSelf.
Data Protection Officer (DPO): Marcelo Mouro, app.saveself@gmail.com.
Contact for any privacy matter: app.saveself@gmail.com.

3. Where your data is kept

SaveSelf uses Apple's iCloud (CloudKit) as its only cloud storage:

Your data is kept in the private database of your iCloud, within SaveSelf's space. It counts toward your iCloud storage, not toward servers of ours.
To show something to a person in your circle, the app uses iCloud's own sharing (CKShare): only the people you chose get read access to that part of the data.
The records of the link between two people (name, account identifier, what each one allowed, introductions and the "seen" and "I'm Helping" receipts) are kept in a zone in the iCloud of whoever created the invitation, shared only between the two of you, and are deleted when the link ends.
The most sensitive fields (location, phone number and photo) are saved with iCloud's field encryption: they are encrypted on your device before they go to the cloud. The following are kept with iCloud's standard protection: your name, the device status, the safety status ("Safe" or "Emergency"), the type and time of alerts (with a flag saying the alert was sent with a position, never the position itself), the "seen" and "I'm Helping" receipts (name, account identifier and time), the time of each location and, during an SOS, until when live location continues.
Apple operates iCloud under Apple's Privacy Policy. iCloud servers may be located outside Brazil or the country where you live (international transfer, Art. 33 of the LGPD; outside Brazil, see section 12).

On your iPhone, the app also keeps:

a temporary copy of what you published and of what your circle shared with you, to open quickly, work offline and resend anything still pending (excluded from iPhone backup);
the last position you published (latitude, longitude and time), in the app's internal settings, so the same position isn't sent again. It is included in iPhone backups and is erased when you stop sharing your location, on "Sign Out" and on "Delete Account";
your name and your sign-in identifier in the iPhone Keychain;
the names of the people in your circle, as you see them in the app (with the name you have for that person in Contacts, if any), in an internal file excluded from iPhone backup, to write alert notifications even when the iPhone is locked, together with a record of which alerts and notices have already been shown (so they aren't repeated);
within the temporary copy, the list of people who left your circle in the last 30 days (name and date), for the history in the Alerts tab, and the list of people you hid or removed (name and account identifier), for "Hidden People";
the profile photo you chose, the phone number you entered and your sharing choices;
the name, photo and phone number of the contact you choose for a person in your circle in the iPhone contact picker: we keep only the name, the thumbnail, the first phone number and the contact's identifier, excluded from iPhone backup. The phone number is used for "Call" and text messages when the person hasn't entered their own. The picker does not ask for access to your Contacts, so this happens even without that permission. With access, the stored name, photo and phone number follow any changes you make to that contact;
if you allow access to Contacts, the app also looks up the name and photo of each person in your circle by their phone number. They stay only in memory while the app is open and are not saved, except for the name in the internal notifications file (item above).

People you have in Contacts appear in SaveSelf with the name you saved (for example, "Dad") and, below it, the name the person chose. This applies only on your iPhone: the person and the rest of the circle keep seeing the name they chose. On each person's profile, "Unlink Contact" goes back to the name and photo they chose.

None of this leaves your iPhone, except for what is already described for iCloud and what is included in your own iPhone backup (on a computer or in iCloud Backup, if you use it). "Delete Account" erases all of this data from this iPhone, and "Sign Out" erases part of it (section 8).

One iPhone per Apple Account. A random iPhone identifier, the account state and the change time are stored in a private area of your iCloud, without access for your circle. When you delete the account, this minimal control remains to prevent another updated iPhone from recreating the data. It stays until you reactivate the account or erase SaveSelf data in iCloud. Update the app and sign out on your other iPhones; older versions do not respect this control.

A pending location removal is stored on this iPhone, excluded from backups, with only the account identifier and the intent to delete, without coordinates. If another iCloud account signs in, removal waits for the original account to return with internet and for this iPhone to be active. Until iCloud confirms, the last position may still be visible.

4. What data we use and why

Data	When	What for	Who can see it
Name	Always	Identify you in the circle and suggest connections (section 6). It comes from "Continue with Apple" or, if Apple doesn't send it, you choose it during setup; you can change it in Settings → Name in Circle	Everyone in your circle and, as a connection suggestion, people in the circle of someone in your circle (the connection only happens if you accept)
Account identifier (Apple and iCloud)	Always	Connect you to the people in your circle, suggest connections and keep you signed in	It doesn't appear on screen; the iCloud identifier goes to the devices of your circle and of people in their circles, to suggest connections
Phone number (optional)	If you enter it (setup asks, and you can skip it)	Let your circle call or text you, for example during an alert	Everyone in your circle
Profile photo (optional)	If you choose one	Appear in the circle (it can be a Memoji saved in Photos). It is encrypted on its way to your iCloud and only sent again when you change it	Everyone in your circle
Location	If you allow it and turn it on	Show your most recent position, with accuracy, time and approximate address; during an SOS, continuous updates for 60 minutes, which you can extend ("Keep Sharing Live"), with the time until which it continues ("live until…"). If you turn off "Precise Location" for SaveSelf in iPhone Settings, only your approximate position is sent, except during an SOS: then the app asks iOS for temporary precise location, and you decide in that prompt	Only the people you allowed to see your location
Device status	Whenever the app updates	Battery level and whether it is charging, device type, SaveSelf's location permission ("Always", "While Using the App" or off; people who see your location are told, for example, that it "Updates only while the app is open") and last seen, so your circle knows whether you have signal	Everyone in your circle
SOS alerts	When you trigger an SOS	Notify your circle with the time (your location is not in the alert: the people you let see your location follow your position, live during the SOS) and show you who has seen it ("Seen by…") and who is helping	Only the people you allowed to receive your alerts
Alert receipts ("seen" and "I'm Helping")	When you open an alert you received (from the notification, from the Alerts tab, or by opening the person's profile or their card on the Map while the alert is open) or tap "I'm Helping"	Show the person who asked for help that you saw it (your name and the time) and that you are helping. The person who asked for help passes "<your name> is helping" on to the other people who receive their alerts, so they know someone is already taking care of it	The person who triggered the alert; for "I'm Helping", also the people who receive that person's alerts, even if they aren't connected to you
Contact names, photos and phone numbers (optional)	If you choose a contact for someone in your circle or allow access to Contacts	Show, in the app and in notifications, the name and photo you already have for each person in your circle; use the chosen contact's phone number for "Call" and text messages when the person hasn't entered their own (see section 3)	No one: it all happens on your iPhone and nothing leaves it
Contact you invite (name and phone number or email)	If you invite someone by choosing a contact	The phone number or email goes to Apple's iCloud only to find the person's iCloud account and create the invitation; the name stays on your iPhone to show the invitation	Apple (iCloud) and the invited person, who receives the invitation

SaveSelf does not ask for or receive your email.

Emergency text: on the SOS screen, "Send Text" opens Messages with a prewritten text to the person you pick (in your circle or a contact you choose) that includes your last position, when your iPhone has one, and its time (an Apple Maps link), even if you don't share your location with that person in SaveSelf. It is only sent if you tap send in Messages, through your carrier or iMessage; it doesn't go through SaveSelf or the app's iCloud data.

Notifications: SOS alerts and the notice that an alert was ended arrive as an iCloud notification with generic text; the person's name is added on your iPhone, from the data they already share with you (if the iCloud notification doesn't arrive, the app creates the same notice when it updates the circle). The other notices are created by the app itself on your iPhone, from what it has already received from the circle, without sending anything to anyone: someone joined your circle and is waiting for your choice, someone asked to connect with you, someone left your circle and, during your SOS, the reminder that your live location is about to end. The test notification you request in Settings → Notifications is also created only on your iPhone. SaveSelf does not send advertising notifications.

Apple does not give SaveSelf the photo or Memoji of your Apple Account. That's why the photo your circle sees is the one you choose in the app itself; without it, each person sees the photo they have of you in their contacts or your initials. Likewise, people who have you in their Contacts may see you with the name they saved (for example, "Mom"), only on their iPhone.

Demo Mode: uses fictional people and data generated on the device itself. Nothing is sent or shared (not even an SOS triggered during the demo), and it ends when you exit it or close the app.

5. Health data

This version of SaveSelf does not collect, store or share health data. The app does not ask for access to the Health app (HealthKit), does not read Apple Watch data (such as heart rate, falls, sleep, activity or workouts) and does not send any of this to iCloud or to anyone in the circle.
The only alerts in this version are SOS alerts, which you trigger. The app does not generate automatic alerts from health data.
A health feature may exist in the future, as an option. If it does, it will only work with your specific and prominent consent, given on the iPhone itself and, separately, for each person you want to share with; health data will not be stored in iCloud, but in a service of our own, with protections described here beforehand. This policy will be updated and you will be notified in the app before the feature takes effect (section 13).

6. Who sees what

Sharing is always one-way and per person: you seeing someone's location doesn't give that person access to yours, and vice versa.
When you connect with someone, you choose, for that person, whether they see your location and whether they receive your alerts. Name, photo, phone number and device status are seen by the whole circle from the moment you connect, without turning anything on, and the choice screen says so.
On the choice screen, "Alerts (SOS)" starts on and "Location" starts off, because letting the people you chose know in an emergency is the main reason for the circle. Before you continue, the screen says who your SOS will reach, and you can turn it off right there. If you leave everything off ("Choose Later"), nothing beyond your profile is shared, and the app keeps reminding you that the choice is pending and warns you on Home when no one receives your SOS. You can change this at any time in Settings → Privacy and on each person's profile.
When you turn on location for someone, the app explains the "Always" permission and shows the iOS request; you can keep "While Using the App".
People who receive your alerts but don't see your location get the SOS with the time only, without any position.
Who is helping: if you tap "I'm Helping" on someone's alert, your name, your account identifier (so the app can recognize you) and the time go to that person and, through them, to the other people who receive their alerts, even those who aren't connected to you. Likewise, when you trigger an SOS, the people who receive your alerts see who is helping you.
Connection suggestions: people in the circle of someone in your circle may see your name and receive your account identifier, only so the app can suggest that you connect. The connection only happens if you accept the request. If you ask to connect with someone suggested, the request (with your name) is passed on automatically by the app of the person who has both of you in their circle. Declining a request or ignoring a suggestion does not notify the other person, and you can undo it in "Hidden People".
The status your circle sees for you:
- people who receive your alerts see "Safe" (no open alert from you in the last 24 hours and a signal from your device in the last 6 hours), "Emergency" (when there is an open SOS from you, from the last 24 hours) or "Unavailable";
- people who don't receive your alerts see only "Active" (your device checked in within the last 6 hours) or "Unavailable", never "Safe" or an inferred state of danger.
- "Safe" and "Active" don't guarantee that everything is fine: they only mean there is no open alert and that the device checked in, which is why they always appear with the age of the signal (for example, "Safe · signal 2 h ago"). "Unavailable" doesn't mean danger either, just that recent data is missing.
- Only the person who triggered an alert can end it. An alert that has been open for more than 24 hours no longer counts as an emergency.
We (SaveSelf) don't see any of this. The only company involved is Apple, as the provider of iCloud, notifications, maps (the approximate address of a position is obtained from Apple's maps service) and "Sign in with Apple".

7. Legal bases

Under the LGPD, the bases are:

Consent (Art. 7, I): for location, contacts, notifications and for each sharing option you turn on. You give this consent in the iOS permissions and in the choices within the app, and you can revoke it at any time.
Performance of the service you requested (Art. 7, V): name, account identifier and device status, without which the circle doesn't work.
Protection of life and physical safety (Art. 7, VII): sending your SOS alerts to the people you chose to receive them (on the choice screen, SOS starts on, with the sentence saying who it goes to, and you can turn it off before continuing or at any time afterward), and the "seen" and "I'm Helping" receipts that accompany an alert.

This version does not process sensitive personal data (Art. 5, II), such as health data. For people in the European Economic Area or the United Kingdom, the equivalent bases are in section 12.

8. For how long

Location: we keep only the most recent position, which is replaced with each update. There is no location history in this version.
Stopping location sharing erases the last published position: your circle stops seeing it, not just stops receiving new ones.
Alerts: they stay in your iCloud until you delete your account, so you and your circle can understand what happened. In the app, alerts from the last 30 days are shown.
Leaving the circle or removing a person: their access to your data is removed in iCloud, and their app tells them that you left their circle. The name, photo and phone number of the contact you had chosen for them are erased from this iPhone the next time the circle updates (if the circle becomes empty, only on Sign Out or Delete Account). People you remove stay in "Hidden People" (Settings → My Circle → People), so they don't come back as suggestions, until you tap "Show Again".
People who left your circle: the name and date stay on this iPhone for 30 days, in the history in the Alerts tab.
Sign Out (Settings → Sign Out): the app asks for confirmation and, if you have an open SOS, offers to end it first. Then it tries to remove your last location from the circle, stops sending data from this iPhone and erases from it your profile photo, your phone number, your last position, your alert preferences, contact names, photos and phone numbers, and the names used in notifications.
- A pending location removal is stored on this iPhone, excluded from backups, with only the account identifier and the intent to delete, without coordinates. If another iCloud account signs in, removal waits for the original account to return with internet and for this iPhone to be active. Until iCloud confirms, the last position may still be visible.
- The following stay on this iPhone, for when you sign in again: your name and your sign-in identifier in the Keychain, your general choice to share your location (if you turned it off, it stays off) and the copy of the circle, with your alerts (and the position of each one, when there is one) and what you show each person. The copy belongs to the device's iCloud account and is erased if another iCloud account signs in. Delete Account erases all of this.
- Everything else in your iCloud (profile and alerts) stays there, and your circle keeps seeing your name, photo, phone number and last signal. To erase it, use Delete Account.
- The same "Sign Out" happens automatically when the app detects that you disconnected "Sign in with Apple" from SaveSelf in iPhone Settings or that another iCloud account signed in on this iPhone (in that case, the general location choice also goes back to the default, because it's a different person). The app checks this when it opens and before sending data, also in the background, and the sign-in screen explains why.
Delete Account (Settings → Delete Account): erases from your iCloud everything SaveSelf stored, removes you from all circles and erases the app's data on this iPhone. The temporary copies on the devices of people who saw your data are erased the next time their app updates.
- If the iCloud part doesn't finish (without a connection, for example), nothing is erased from this iPhone: the app stops sending data, including SOS, and shows "Account Deletion in Progress" with "Finish" until it's done.
- If you have SaveSelf on another iPhone with your Apple Account, sign out of it first (section 3): it could recreate what was deleted.
- The "seen" and "I'm Helping" receipts you left on other people's alerts are part of their alert history: your name and the time stay in the app of the person who triggered the alert for up to 30 days, and "I'm Helping" (with your name and account identifier) also stays in that person's iCloud, visible to whoever receives their alerts, until they delete their account.
Disconnecting "Sign in with Apple": SaveSelf has no server. It doesn't send the code or the token Apple provides at sign-in anywhere, doesn't exchange them for Apple access tokens and doesn't store any token; this iPhone keeps only the identifier Apple gives SaveSelf and your name, which Delete Account erases. That's why there is no token for the app to revoke, and Delete Account does not, by itself, undo the link between your Apple Account and SaveSelf. To undo it, go to iPhone Settings → [your name] → Sign in with Apple → SaveSelf → Delete. In other versions of iOS, the path and the button name may be slightly different. The app shows this path when you confirm Delete Account and in the summary of this policy.
Uninstalling the app does not erase what is in your iCloud, and your circle keeps seeing the last data you published. To erase it, use Delete Account before uninstalling (if you already uninstalled, install it again, sign in with the same account and use Delete Account).

9. Security

No server of our own: there is no SaveSelf database that could leak.
Sensitive fields encrypted by iCloud before they leave the device.
Identifier kept in the Keychain; local files with iOS data protection.
No third-party SDKs, ads or analytics tools in the app.

No system is completely immune to failures. If a security incident occurs that could put you at risk, we will notify you and the Brazilian National Data Protection Authority (ANPD), as required by the LGPD, and also the authority in your country, if you live outside Brazil and its law requires it.

10. Your rights

Under the LGPD (Art. 18), you can:

Confirm and access the data: everything you share appears in the app itself (your profile and what each person sees of you).
Correct: name, phone number and photo in Settings.
Revoke consent: turn off each sharing option in the app or the permissions in iPhone Settings (Privacy & Security → Location Services and Contacts; Notifications).
Delete: Settings → Delete Account.
Know who we share with: only the people in your circle you chose, the people in their circles (your name and your account identifier, to suggest connections and, if you tap "I'm Helping," so the app can recognize who's helping; section 6) and Apple, as the iCloud provider.
Portability: we don't keep a copy of your data. What you entered (name, phone number and photo) is in the app itself and can be copied from there.
File a complaint with the ANPD (www.gov.br/anpd) or, outside Brazil, with the data protection authority in your country (section 12).

Since we have no access to your data, most of these requests are handled by you in the app. For any questions, write to app.saveself@gmail.com; we will reply within 15 days.

11. Children and teenagers

SaveSelf may be used by families with children and teenagers. Use by people under 18 must take place with the knowledge and consent of at least one parent or legal guardian (Art. 14 of the LGPD), who must also oversee what the minor shares and with whom. The app does not show advertising or collect data for any purposes other than those described here. In the United States, the European Economic Area and the United Kingdom, the rules in section 12 also apply.

12. If you live outside Brazil

SaveSelf is made in Brazil, and this policy follows the LGPD. If you live in another country, everything it says also applies to you: the app has no server, ads or tracking, and we have no access to your data. In addition:

Your rights: the rights in section 10 also apply outside Brazil. You can exercise them in the app itself or by writing to app.saveself@gmail.com; we will reply within 15 days.
Complaints: you can file a complaint with the data protection authority in the country where you live; in the United Kingdom, that is the ICO (ico.org.uk).
Legal bases in the European Economic Area (EEA) and the United Kingdom: the bases equivalent to those in section 7, under the GDPR and the UK GDPR, are consent (Art. 6(1)(a)), for location, contacts, notifications and each sharing option you turn on, which you can withdraw at any time; performance of the service you requested (Art. 6(1)(b)), for name, account identifier and device status; and vital interests (Art. 6(1)(d)), for sending your SOS alerts to the people you chose and the "seen" and "I'm Helping" receipts that accompany them.
International transfer: your data is kept in iCloud, operated by Apple, which may store it on servers outside your country, with the safeguards described in Apple's Privacy Policy. The app does not send any of your data to the developer, who is in Brazil.
Children: in the United States, children under 13 may use SaveSelf only if a parent or guardian sets up the app for them and supervises its use. In the EEA and the UK, people under the age of digital consent in their country (13 to 16, depending on the country) may use the app only with the consent of a parent or guardian. In every country, section 11 and local laws on consent for minors also apply. The app does not send the developer any data from anyone, including children, and the parent or guardian can erase everything on the child's iPhone, in Settings → Delete Account.

13. Changes to this policy

When this policy changes, we will update the date at the top and, if the change is significant (for example, a new type of data, such as health data, or the introduction of a subscription), we will notify you in the app before it takes effect.

14. Contact

Marcelo Mouro — app.saveself@gmail.com