Privacy Policy

Safewords apps (iOS and Android)

Scope

This policy describes the Safewords apps for iOS and Android, published by The Holding Company. The website has separate browser-storage and hosting behavior, described below.

Information and storage

The native apps do not require an account or operate a server that receives your group's secrets. They do not include analytics, advertising, tracking, or an app-operated crash-reporting service.

Group names, member labels, verification settings, preferences and custom emergency safewords are stored locally. The Guide's practice drills don't save your answers. Security checkup progress (which tasks you've ticked) is stored only on this device; wallet-plan choices aren't saved. Older installations may retain earlier local practice history. Seeds used to generate safewords are stored in the iOS Keychain or encrypted Android storage. Device authentication is handled by the operating system; Safewords does not receive your fingerprint, facial biometric data or device passcode.

The iOS app and its widget share group metadata and settings through an App Group and seed access through a Keychain access group. Android's app and widget use app-local storage. Device backup and transfer behavior is also subject to the operating system and your device settings; do not rely on an OS backup to restore a group secret. Safewords does not provide an account-based cloud backup service.

Permissions

Camera access is used after you choose to scan a setup QR code. Safewords does not upload camera images to an app server. Device authentication protects sensitive disclosures and exports even when app-opening lock is off; locking app opening is an additional setting. SMS drafts include the group name and setup instructions, but no verification secret. Android can also offer a share chooser. You choose the destination and whether to send; Safewords does not send the message automatically.

Sharing and exports

You can deliberately expose information by displaying a QR invite or recovery phrase, sharing or printing safety cards, copying a recovery phrase, revealing safewords on screen, or opting into live safewords display in a Home Screen widget. The app hides current safewords until you tap to reveal them, unless you turn on "Always show safewords". Home Screen widgets hide the current safewords or code by default. iOS Lock Screen widgets show only the group name and countdown, never safewords or codes. While the iOS screen is being recorded, mirrored or shared, the app does not show safewords, QR invites or recovery phrases. Android blocks screenshots and screen recording of the app. Neither measure stops someone from photographing the screen with another device. Printed copies, screenshots, shared files, clipboard copies retained elsewhere and information stored by another app remain outside Safewords' control.

Anyone holding a seed or its recovery phrase can reproduce the group's verification outputs with the corresponding settings. Invite QR codes contain the setup secret and supported group configuration. Recovery phrases restore only the seed, not the group name, settings, member labels or custom emergency safewords. Removing a group from one device does not revoke copies held elsewhere. Matching safewords demonstrate access to those safewords, which could have been shared or overheard; they do not prove possession of the secret or guarantee the speaker's identity.

The iOS recovery clipboard copy is configured local-only with a 60-second expiration. Android attempts to clear the recovery copy after 60 seconds if unchanged; operating-system restrictions and app lifetime can affect that attempt. Clearing or expiring the clipboard does not remove copies already saved elsewhere.

Safewords generates its core verification output offline. Choosing a store, website, messaging, printing, or sharing destination may invoke another app or service subject to that provider's own privacy practices. Apple, Google, and device manufacturers may separately process store, beta-testing, or operating-system diagnostics under their own settings and policies.

Removing local data

Choosing Delete everything in Settings requests removal of this device's saved groups, secrets, settings, checkup progress and retained practice history. If it cannot complete, some local data may remain. It does not remove exported, printed or shared copies, copies on other devices, or OS backups.

Contact

Questions about this policy: mail@theholding.company.

safewords.io website

What we collect

No accounts or server-side safewords storage. Progress and drafts stay on your device. Hosting includes cookieless Cloudflare Web Analytics.

What stays on your device

Your browser may store `safewords_progress` for drill scores, read articles, and last drill state. It may also store `safewords_protocol_draft`, including group name, members, safewords, and plan draft details. Clear this by deleting site data for safewords.io in your browser. Printed cards expose the safewords to anyone who can read them.

Plan data travels after #, not in the page request. The page removes it from the address bar and keeps it only in memory. Reloading clears it; reopen the original QR code or link. Anyone with the original link can read it; links are not encrypted.

Your browser may save your theme preference in safewords_theme on this device. You can remove it by clearing this site's browser data.

The optional Weekend Security Checkup saves completion choices and checklist preferences in safewords_checkup only when you select “Remember on this device.” It does not ask for passwords, recovery codes, phone numbers, or account details. Uncheck that option to remove its saved copy, or clear this site's browser data.

What we send over the network

The web tool requests static HTML, CSS, JavaScript, fonts and assets. It makes no backend API calls to store safewords or plans. Hosting providers may receive ordinary page-request data.

Hosting (web)

The safewords.io site is hosted as static files. The hosting provider may collect standard server logs (IP addresses, request timestamps) as part of normal web server operation. We have no access to or control over these logs.

Third parties

Hosting includes cookieless Cloudflare Web Analytics.