The Four Consent Layers That Gate Location Capture

You grant permission in four places, and we check for it in four places. Any of them turning 'off' stops a capture from happening. Here's the exact list.

Download Free Learn More

The Challenge

Consent banners are usually all-or-nothing and written to be skipped, not read

'Accept all' buttons create durable permissions that users forget they ever granted

Apps bury the revocation in multi-step menus while making the grant a single tap

How I'm Alive Helps

Four separate gates, each with its own explicit prompt, and each visible in the app's Settings screen

Any gate can be toggled independently — disabling one does not force a full account change

Revoking the OS-level permission at any time is detected by the app on next launch and surfaced in Settings

The four layers

**Layer 1: the Family Plus entitlement.** You must have an active Family Plus subscription. If you're on free, Lifetime, or Family tier, the capture endpoint returns a 403 and refuses to process any incoming capture attempt. No amount of OS-level permission on your phone will overcome this server-side refusal. **Layer 2: the OS location permission.** iOS's "When In Use" permission, or Android's equivalent. You see a system dialog the first time Family Plus becomes active (triggered by our intro modal). You can revoke this any time in iOS Settings → Privacy → Location Services → I'm Alive, or Android Settings → Apps → I'm Alive → Permissions. Revocation is immediate. **Layer 3: the in-app switch.** Inside the app, Settings → Emergency Location has a toggle independent of the OS permission. This defaults to "on" after you complete the intro modal; toggling it off refuses new captures even if the OS permission is granted. The switch is meant for "I want this feature generally, but not for the next three weeks while I'm on vacation in a country I don't want logged." **Layer 4: the incident gate.** The server-side endpoint only accepts captures that reference an active (unresolved) escalation_incident for your user ID at stage 3 or 4. If you manually resolve an incident, subsequent pushes become no-ops. If your last escalation was days ago, there is no way to retrigger a capture short of actually missing a check-in.

What revoking each layer does

Revoke Family Plus — captures stop immediately. Live-at-the-moment-of-downgrade snapshots continue their 72-hour lifecycle; no new snapshots can start. Revoke OS permission — the mobile app can no longer obtain a reading, so captures requested by silent push fail silently. The incident continues without location; your contact sees no location card. The server is unchanged. Toggle the in-app switch off — same effective result as revoking OS permission, but reversible without going into system settings. The mobile app will short-circuit the capture flow at the permission check. Manually resolve the incident — existing captures for that incident remain visible to the contact for the resolution window (seconds), then enter the 72-hour purge. No new pushes will be acted on because the server-side gate now rejects any further captures for that incident.

How this differs from the 'permission once = permission forever' trap

Most app consent is a one-time checkbox. You granted microphone access to an app in 2019 and in 2023 it was still accessing your microphone — because you forgot you granted it, and the app had no interest in reminding you. Our four-layer model is designed so that at least three of the four gates are re-affirmed by state — meaning they don't just sit as a stale decision. The Family Plus entitlement is re-checked on every capture attempt (the server queries `user_subscriptions` live). The incident gate is intrinsically state-based (no active incident = no capture). The in-app switch is visible every time you open the Settings screen. Only the OS permission is a traditional one-time grant that sticks around — and even that, we show in the app's Settings → Emergency Location screen as a "Permission: Granted / Not granted" line so you can see at a glance whether to revisit it.

Get safety tips delivered to your inbox

Frequently Asked Questions

If I revoke Family Plus, does my location history get deleted right away?

Existing snapshots tied to live incidents continue their 72-hour purge cycle and are deleted normally. New snapshots cannot be created. If you want an immediate purge, contact privacy@imalive.co and we'll purge on request within 48 hours.

Can my emergency contact see whether I have location enabled?

No. The contact only sees the location card when a real snapshot exists (during an active stage-3+ escalation). Your permission state is not surfaced to them at any other time — they cannot tell 'is my parent's location on' from their dashboard.

Does revoking the OS permission break the daily check-in?

No. The daily check-in does not use location at any stage. Escalations still proceed, contacts still get notified, the AI voice call still fires. The only difference is the 'Emergency location' card on the contact's page will show 'no location available' instead of a neighborhood pin.

What if I want location only during high-risk travel and off the rest of the year?

Use the in-app switch (Layer 3) to toggle on when you leave for the trip, off when you come home. Alternatively, leave Family Plus but revoke the OS permission (Layer 2) and flip it on only during the trip. Both approaches work.