We Do Not Track Your Location

I'm Alive is the opposite of always-on tracking. Your location is captured only during an active emergency, shown only to the contact you named, then deleted 72 hours after the incident resolves. This page explains exactly what that means — and what it doesn't.

Download Free Learn More

Family Plus users carry no background location service. Zero coordinates enter our database outside an active escalation — verified in the open source code of the imalive-capture-location edge function.

The Challenge

Most 'family safety' apps run always-on tracking by default, which surveils the person they are meant to protect

Always-on location data is a liability — breached apps have exposed precise movement histories of millions of people

Children, elderly parents, and partners often resent the constant-tracking model and disable it, leaving them less safe than before

How I'm Alive Helps

One-shot capture: the location fetch happens exactly once per escalation stage, triggered by a missed check-in that your named contact has been notified about

Coarse precision: coordinates are stored at four decimal places (~11 meters at the equator), enough to help a contact find the right block but not the exact room

72-hour auto-delete: a daily purge wipes the encrypted coordinates 72 hours after the incident resolves — the column is overwritten to NULL, not archived

Encrypted at rest: every stored coordinate is column-encrypted with pgcrypto + a per-environment Supabase Vault key; only the service role can decrypt, and only at the moment it renders to the contact

What 'not tracking' actually means in code

Every location-collection claim should be provable. Ours is: there is no background location permission in the I'm Alive iOS or Android app. We never request, never receive, and never store continuous location. The only time the app asks the phone for coordinates is inside a specific event handler called `handleCaptureLocationPush`, and that handler only runs when your phone receives a silent push marked `type: 'capture_location'` — which our backend only sends during an active stage-3 or stage-4 escalation you caused by missing a check-in that was already surfaced to your contact. The app uses iOS's foreground-only permission (`NSLocationWhenInUseUsageDescription`). We deliberately do not request `NSLocationAlwaysAndWhenInUseUsageDescription`, because requesting it would both be misleading and trigger heightened App Store review. Background-mode location is disabled in our Expo config via `isIosBackgroundLocationEnabled: false`, again by design. Our code is private today but audit-grade — the relevant files are called out in our privacy spec (19-location.md §5.8) and every substantive change ships with tests. If that isn't enough for you, we would rather you used a different app than be mislead about this product.

What your emergency contact sees, and when

When your missed-check-in escalates to stage 3, the app on your phone wakes up (if the background-push permission is granted) and captures a single coordinate reading — about 11 meters of accuracy, rounded client-side to four decimal places before it ever leaves your device. The reading is posted to our capture endpoint with your own authenticated session; the endpoint refuses the request unless you are on an active Family Plus subscription and there is an open incident with your user ID. Your contact does not see the coordinates as numbers. The web page at `imalive.co/c/<token>` shows them a one-line neighborhood name ("Near Oxford Circus, London"), a privacy-preserving map pin, and a timestamp. The reverse-geocoding from lat/lng to place name happens on your phone, so we never call Google or Apple's geocoding APIs server-side with your coordinates — another decision that's auditable in the mobile code. When your incident resolves, the contact's page stops rendering the location within seconds; 72 hours later, the underlying row is overwritten to NULL even in the database. A compromised contact account cannot go back and read stale locations because the row with content for that incident no longer exists.

The one place we do collect is approximate country, and why

We do retain the country field (e.g. "GB", "IN") in the purged row shell — not the state, not the city, certainly not coordinates. The reason is operational honesty: we need to know, at a dashboard level, which countries Family Plus is actually saving users in. Five emergencies attributed in a country where we did not ship the SMS pipeline is a bug we should find quickly; five emergencies in a country where we did ship the pipeline is a validation we pass that region's review. Without any retained-country field, we cannot tell the two cases apart. Country alone cannot identify an individual — it is a bucket with hundreds of millions of people in each case. If you are uncomfortable even with that, you can close your account and we delete everything including the purged shells within 72 hours.

Get safety tips delivered to your inbox

Frequently Asked Questions

Does I'm Alive track my location in the background?

No. There is no background-location permission in the app. The phone is never asked for coordinates outside of a silent push that arrives during an active emergency escalation your contact already knows about. The Apple and Google permission strings we request are the foreground-only versions; the always-on variants are deliberately not in our manifest.

What exactly gets stored when a capture happens?

Four columns encrypted at rest: approximate latitude (4-decimal precision), approximate longitude (same), a reverse-geocoded neighborhood name your phone generated locally, and a short accuracy value in meters. The encryption uses pgcrypto with a key stored in Supabase Vault. Only our service role can decrypt; the decryption happens at the moment we render the contact page, and the decrypted value is never logged.

Can I turn emergency location off completely?

Yes. Decline the iOS or Android location permission when the intro modal appears, or revoke it later in system settings. Family Plus continues to work — the voice-agent call, the contact notifications, the escalation schedule — you just do not add a location snapshot to the contact's view.

How is this different from an 'always-on' app with a panic button?

Always-on apps collect coordinates every few minutes or continuously, then keep them indefinitely. We collect one coordinate per escalation stage (at most two per incident), only during an active emergency, and delete it 72 hours later. The total coordinate-minutes of your life on our servers over a year with no emergencies is exactly zero.

What happens to the location data if I cancel Family Plus?

Any live snapshots for incidents that are still active at cancellation remain visible to the contact until the incident resolves, then enter the 72-hour purge like any other. No new captures can occur — the capture endpoint rejects requests from non-entitled users with a 403.