Trust & Safety Center
Version 1.2 · Effective 19 October 2026
What SafeLink Guardian does with your data and how it is protected, in plain language. This page states only what we have verified; where a point is still under review, it says so.
Security at a glance
In transit: connections between the app and our servers are encrypted with TLS (HTTPS).
At rest: the app's database and evidence storage are hosted in the European Union (Ireland region) and encrypted at rest with AES-256.
Access control: the database uses row-level security (RLS) to keep each Safety Circle's data apart. We are reviewing every server function against this rule and will update this page when the review is complete.
Evidence: photos and audio are kept in private storage, not at a public web address, and each file is bound to its incident with a SHA-256 fingerprint so it can later be shown that it was not altered.
Accounts: you can start anonymously — the app does not need an email address or phone number to sign you in.
No advertising, no data sales, and no advertising or analytics software in the app.
Purpose limitation: the data listed below is used only for the purposes stated next to it.
Plain-language honesty: this is not end-to-end encryption
SafeLink Guardian is not end-to-end (E2E) encrypted. A shared Safety Circle and alerts on other devices only work if our servers can route your data, so data stored on those servers is technically accessible to the provider that runs them for us (Supabase) and to MTÜ Unilink Center, which is responsible for the app. We do not sell your data and do not use it for advertising. If something must stay secret from everyone but you, do not store it in any online app.
What we collect and why
| Data | Collected? | Why | Shared? |
| Name (display) | Yes | Shown to your Safety Circle so they know who needs help | No* |
| Role | Yes | Adapts the app to how you use it | No |
| Precise location (GPS) | Yes — while the app is in use, including during an alert | So you and your circle can see where help is needed | No* |
| Emergency contacts (name, phone, email) | Yes, if you add them | To alert the people you choose during an SOS | No* |
| Evidence (photos, audio) | Only when you record or an SOS is triggered | Time-stamped record of the incident, bound to it with a SHA-256 fingerprint | No* |
| Check-ins and timers | Yes, if you use them | To alert your circle if you miss a check-in | No* |
| Speech (voice trigger) | Only while voice triggering is on | To recognise an alert word and start an SOS | See below |
| Notification subscription | Yes, if you allow notifications | To deliver alerts to your device | See below |
| Anonymous account ID | Yes | To keep your circle and data linked to your session | No |
| Language preference | Yes (on device) | To show the app in your language | No |
*"Shared" here means given to another company for its own purposes. We do not do this. The providers listed below take part in running the app; each card says what they do and on what terms.
Who processes your data
Supabase Pte. Ltd
Singapore · data stored in the EU (Ireland region)
Database, sign-in, realtime updates, evidence storage and server functions. Processes data on our behalf (Article 28 GDPR); any transfer outside the EEA relies on the EU Standard Contractual Clauses.
Netlify, Inc.
United States
Hosts the app's files and its configuration endpoint. Processes data on our behalf (Article 28 GDPR), for example IP addresses in server logs; transfers rely on the safeguards in Netlify's data processing agreement, including the EU Standard Contractual Clauses.
jsDelivr (Volentio JSD Limited)
United Kingdom
Delivers a code library the app loads (supabase-js) and sees your IP address when it does. Acts as an independent controller; the United Kingdom has an EU adequacy decision.
Google — speech recognition in Chrome (optional)
Your browser
When voice triggering is on, Chrome sends audio to Google to turn speech into text. This is Google's own browser service, not run by us.
Push services (Google Firebase Cloud Messaging)
Your browser's push service
Delivers alert notifications to devices that allowed them. The notification content is encrypted before it leaves our server.
Google Play
Google
Distributes the Android app. Downloads and updates are handled by Google under its own terms.
Google Maps (link only)
Google
An SOS message can include a Google Maps link to your location. Google receives the coordinates only if the person who gets the message opens the link.
SMS and WhatsApp alerts are sent from your own phone through your own apps, so they travel through your mobile operator or WhatsApp, not through our servers. Alerts inside the app go through our server and the push service listed above.
Your rights & how to use them
Under the GDPR you have the following rights. To use any of them, email [email protected]. We reply without undue delay and at the latest within one month (Article 12(3) GDPR).
Access — get a copy of the data we hold about you.
Rectification — correct data that is inaccurate.
Erasure — the "right to be forgotten" — delete your data.
Restriction — limit how we process your data.
Portability — receive your data in a machine-readable format.
Objection — object to certain processing.
Lawful basis: each processing activity relies on its own legal basis under Article 6 GDPR, and on Article 9 where special-category data is involved. The activity-by-activity list will be published in our Privacy Notice.
You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, www.aki.ee.
Deleting your data
You can ask us to delete your data at any time through the Account Deletion page or by email to [email protected]. We reply without undue delay and at the latest within one month (Article 12(3) GDPR).
Open the Account Deletion page
If something goes wrong
If a personal-data breach occurs, we notify the Estonian Data Protection Inspectorate within 72 hours unless the breach is unlikely to put anyone at risk, and we inform affected users without undue delay when the risk to them is high (Articles 33 and 34 GDPR).
Built for people who feel at risk
Start anonymously — no email or phone number needed.
One action starts an alert: a button, a spoken word in your own language, or a missed check-in.
Verified emergency numbers for 38 countries, including border regions where safety apps often show the wrong country's numbers.
SMS and WhatsApp alerts leave from your own phone, through your own apps.
An alert needs an internet connection to reach your circle; delivery cannot be guaranteed.
Using SafeLink to secretly track another person (stalkerware) is strictly forbidden and may be a crime.
SafeLink Guardian does not prevent an attack, does not call emergency services on your behalf and does not replace victim support services. In immediate danger, call 112.
Compliance roadmap
In place
✓Cookie Policy (version 2.0), Account Deletion page and this page published in ten languages.
✓Privacy Notice and Terms of Service rewritten for SafeLink Guardian, in ten languages, with every recipient named.
✓App data hosted in the EU (Ireland region).
✓GDPR rights and the complaint route to the Data Protection Inspectorate set out on this page.
✓No advertising, analytics or tracking software in the app.
✓Deletion requests by email and through the Account Deletion page.
In progress
→Retention periods for location, SOS and evidence data, with automatic deletion.
→A review of every server function against the access-control rules.
→A data protection impact assessment (Article 35 GDPR).
→Align the Google Play Data safety form with this page.
→Check that all in-app wording matches this page.
→EU AI Act: the classification of SafeLink Guardian is under review.
Last updated & changelog
19 October 2026 — v1.2 — Roadmap updated: the rewritten Privacy Notice and Terms of Service are now in place.
19 October 2026 — v1.1 — Statements brought in line with the app as verified: processors named, offline and trigger claims removed, deletion and response times aligned with the GDPR, a "what it does not do" note added.
1 July 2026 — v1.0 — First publication of the Trust & Safety Center.
Unilink