Privacy Policy

Who we are

This Privacy Policy describes how the Kymber mobile application ("Kymber," "we," "us") handles your information. Kymber is a privacy-first location-sharing and safety app that lets you share your live location with trusted contacts you choose — triggered by you calling a trusted contact from within Kymber, an in-app request, an SOS broadcast, a meet-up you arrange, or a short letter you send.

Kymber is operated by Todd Eastland. If you have questions about this policy or your data, contact us at support@kymber.app.

What we collect

Information you provide

• Your display name — the name shown to your trusted contacts. When you reach out to someone first (a request, ping, meet-up invite, or letter), your name — and your phone number, so they can recognize and add you back — may be shown to that person even if they haven't added you yet. You are choosing to identify yourself by reaching out.
• Your phone number — used so your trusted contacts can recognize and match with you. We do not verify your phone number, and we do not use it to send you SMS messages.
• Your trusted contacts — the names and phone numbers you enter for the people you want to share with. Kymber does not read your device's address book; you add contacts yourself. If you use the optional "choose from contacts" picker, Android returns only the single contact you tap (name and number) — Kymber never scans or uploads your address book and does not request the READ_CONTACTS permission.
• Letters, meet-up details, and reactions — the optional message text, titles, meeting place labels, notes, and emoji reactions you choose to send. See Letters, meet-ups & user content.
• Voice notes (optional) — you can record a short voice note, up to 20 seconds, and either attach it to a location share or a ping you are already sending, or use it as the caption on a post you make to a group board or your own bulletin — so the people you chose can hear what's happening in your own voice. Kymber uses your microphone only while you are recording one: recording starts when you tap record, runs only while that screen is open, and cannot run in the background — the app does not hold the permissions that would allow it to. If you never record a voice note, Kymber never even asks for your microphone. Voice notes go only to the people you chose for that share, ping, or post. One attached to a share or a ping is deleted after 30 days unless you save one to your own saved locations; a voice caption on a post is part of that post, so it stays for as long as the post does and is deleted when you delete the post — see Retention & deletion.
• Feedback you send us — if you use the feedback box in Kymber Resources to tell us how we can improve, we keep the note you wrote along with your app ID, your platform (Android or iOS), and your app version, so we can make sense of it. A copy is emailed to our own support inbox so that a person actually reads it — see Who we share with. We don't ask for your email address, so unless you write a way to reach you into the note itself, we have no way to reply.

Location data

• Live location during a share — collected only while a live share is active that you have started or accepted: a sharing session, an SOS, a meet-up live-share, or a live location you chose to attach to an "I'm on my way" letter. It is streamed live to the contacts in that session, and the live stream is deleted when the session ends. We do not store the continuous path you traveled. See How location works below.
• Individual location points you send — when you send a one-time location ping, attach your location to a letter, or when a live share ends, Kymber stores a single location point (a snapshot, not a path) so it stays viewable in your history or in the letter you sent. These points are kept only for a limited time and then deleted automatically — see Retention & deletion.

Information collected automatically

• Push notification token — a token from Firebase Cloud Messaging so we can notify you of incoming share requests, shared locations, meet-up activity, letters, and SOS alerts.
• Activity status (optional, off by default) — if you turn on the "Show when I'm on the app" setting in Privacy, Kymber records when you were last active in the app so your trusted contacts can see "Active now", or the time you were last active, on your contact card. This is a single, continuously-updated timestamp of app activity — not your location and not a record of where you've been. It is shared only with the trusted contacts who have you saved, and only while the setting is on; turn it off and they no longer see it.
• Reachability check (optional, off by default) — if you turn on the optional reachability check (Kymber asks you once, and you can change your answer at any time in Privacy), Kymber keeps a single timestamp of when your phone was last able to reach Kymber's servers. If your phone then cannot be reached for about 2 days or more — because it is off, broken, lost, or out of service — your trusted contacts see a gentle note that you may be unreachable, instead of assuming your phone can still receive their pings and alerts. This is not your location and not a record of your activity: it is one continuously-overwritten value, no history is ever kept, and your contacts are never shown "active now" or exact times from it. Turning the setting off removes it immediately.
• Basic technical data — our backend provider (Google Firebase) processes standard technical information such as IP address and device/connection data to operate the service and keep it secure.
• Purchase status — whether you have made an optional purchase (such as the unlimited-contacts upgrade), or have been given one as a gift, so we can enable the right features. If you send someone a gift, we also keep the phone number you typed for them, so the gift can reach the right person. Payments are handled by your app store — Google Play on Android, the Apple App Store on iPhone (see Payments).
• Safety & anti-abuse data — to keep Kymber safe we store: the list of people you have chosen to block; any reports you file about content or a sender (the sender's app ID and a small snapshot of what you reported); a small amount of timing data used to stop spam (for example, how recently someone has been sending you pings or requests); and, if several different people report the same sender, a temporary, automatically-expiring limit on that sender's outbound messages. You also control a "Only my contacts" setting that tells our servers to quietly turn away pings, requests, and letters from people you haven't added.

How location works Privacy-first

Location is the heart of Kymber, so we want to be precise about it:

• Only when you act. Kymber accesses your precise location only during a sharing session, SOS, or meet-up that you start or accept, when you send a one-time location ping or attach your location to a letter, or when you choose to share live location with an "I'm on my way" letter (which runs and stops like any other live share). There is no background or continuous location tracking, and Kymber does not request the "all the time" background-location permission.
• No movement trail. We never store a continuous record of where you've been. During a live share, your coordinates are streamed to your chosen contacts in real time and the live stream is deleted when the session ends.
• SOS responders. If you tap "I'm on my way" to someone's SOS, you may choose to share your own live location back to the person in distress so they can see how close help is. That reverse stream works just like any other live share — it runs only while the SOS is active, you can stop it at any time, and it is deleted when the SOS ends.
• Some single points are stored, briefly. A location ping, a point attached to a letter, and the final point of an ended share are saved as single snapshots — not paths — so the recipient and your own history can display them.
• Group check-ins & meeting points. Inside a Kymber Group — a private board shared only with the trusted contacts you choose — any member can start a "check-in" that asks everyone to mark themselves safe or that they need help. Responding is status-only by default: attaching your current location to your response is optional and your choice each time, and a status-only check-in shares no location at all. A member can also set a single shared "meeting point" pin that everyone in the group can see. These are single points shared only with that group's members — never a continuous trail and never live tracking. A check-in, and any location attached to it, is kept only while the check-in is open and is cleared automatically afterward; a meeting-point pin stays until a member changes or clears it.
• Check on me (check-in timers). If you arm a check-in timer and don't check in by your chosen time, Kymber automatically sends your last-known location (captured when you armed the timer, or the most recent refresh while the app was open), your optional note, and the timing of the missed check-in to the contacts you selected when arming. The countdown runs on our servers — the app does no background location tracking while a timer is armed, and the escalation works even if your phone is off. If you chose "Let them know," those contacts are also told when your timer starts and when you check in safely or cancel. Timer records (including the last-known location) are deleted 30 days after the timer ends.
• Limited retention. Ping points are deleted automatically after 30 days. A share's final point is kept with your share history and removed when you delete your data, or after 90 days — whichever comes first. A point attached to a letter is removed with that letter (see Retention & deletion).
• Shared locations are never turned into addresses. Kymber does not convert the locations you share into street addresses. When you tap to open a location in maps, the coordinates are handed to your device's maps app, which performs any lookup. One narrow exception exists when you arrange a meet-up: if you paste or type a street address or place name to position the meeting pin, that text is sent to our server and forwarded to Google's Geocoding service solely to find the spot on the map. We do not store the text you typed — only the resulting pin, and the place label you wrote yourself, are saved with the meet-up. (Coordinates, Plus Codes, and map links are resolved on your device and never reach our servers.)
• Last-viewed cache stays on your device. The most recently viewed location may be cached on your phone for convenience. That on-device cache is separate from the stored points above and is not uploaded to us.

Letters, meet-ups & user content You're in control

Beyond location, Kymber lets you send a few kinds of short, optional content to the trusted contacts you choose. This content is sent only to the specific people you select — Kymber has no public feeds, profiles, or strangers, and any groups are private and limited to the trusted contacts you choose.

• Letters ("Envelopes"). You can send a contact a short letter — an optional title and message, in a color you pick, with options to send it anonymously, to keep the content off the lock-screen notification, to have it self-destruct when it's opened, or to have it expire on its own after a time you choose. A letter's content is stored on our backend only to deliver it to the recipient; the notification itself never carries the message body. The recipient can read, delete, or keep a copy of a letter; you can optionally keep a copy in your own history and be told once when it has been opened. Some quick responses (like "I'm on my way!") let you optionally include your live location, which works like any other live share — you can stop it at any time.
• Meet-ups. When you arrange a meet-up, the meeting place (a label and/or coordinates you provide), the time, and any note you add are shared with the contacts you invite, along with each person's response (accepting, declining, "on my way," or "running late").
• Bulletin posts. Your Bulletin is a personal status board: a short piece of text you write, shown only to the specific trusted contacts you choose for that post. You pick the audience each time, you can delete a post, and you can reshare one to a Kymber Group you're in. There is no public feed and no discovery — a post is never visible to anyone outside the people you picked.
• Reactions. You can respond to a location ping with a single emoji, which is shown to the person who sent it.
• Delivery confirmations. When a ping, letter, or SOS alert you send actually arrives on the recipient's phone, their device records a single delivered timestamp with that message, so the sender can see whether it has truly reached their phone rather than only that it was sent (for letters, this sits alongside the existing "opened" notice, if you asked for one). A delivery confirmation is stored with the message itself and is removed with it.

Acceptable use. Because letters and meet-up notes are content you write, you are responsible for what you send, and you agree not to use Kymber to send unlawful, abusive, harassing, or otherwise objectionable content.

Staying in control. Kymber gives you quiet, in-app ways to manage who can reach you — none of which notify the other person:

• "I don't know this person." When a ping or location request arrives from someone you haven't added, you can ignore it, remove it from your view, block the sender, or block and report them.
• Block. Blocking quietly stops that person's pings, location requests, and letters from reaching you. Because SOS is an emergency feature, a block leaves their SOS coming through unless you explicitly choose to include it — that choice is always yours.
• Report. Reporting a letter, ping, or request flags it for our review. If several different people report the same sender, that sender's outbound messages may be limited temporarily and automatically while we look into it.
• Only my contacts. You can turn on a setting so only people you've added can ping you, request your location, or send you letters; everyone else is turned away quietly. An SOS still comes through — safety always wins.
• Unknown senders. Letters from people who aren't in your contacts are kept in a separate, low-key area of your inbox rather than mixed in with your contacts' letters.

You can manage blocked people, and this setting, on the Privacy screen. You can also reach us about a safety concern at support@kymber.app.

How we use information

• To let you share your live location with the trusted contacts you choose, when triggered by you calling a contact from within Kymber, an in-app request, an SOS, or a meet-up.
• To deliver the location points you send (pings, letter attachments) and the final point of an ended share, and to keep them viewable in your history for a limited time.
• To deliver the letters, meet-up plans, responses, and reactions you choose to send to the specific contacts you select.
• To match in-app requests against your trusted contacts, and to show your name to a person you reach out to so they can identify and add you back.
• To deliver push notifications for requests, shared locations, meet-up activity, letters, and SOS alerts.
• To keep an active sharing session running reliably via a foreground service with a persistent notification.
• To show your trusted contacts when you were last active in the app, if you choose to turn on the optional "Show when I'm on the app" activity status.
• To show your trusted contacts a calm heads-up that your phone may be unreachable, if you choose to turn on the optional reachability check.
• To show a sender whether a ping, letter, or SOS alert they sent has actually arrived on the recipient's phone.
• To enable optional purchased features and verify your entitlement.
• To read and act on the feedback you choose to send us.
• To keep Kymber safe — honoring the people you block and your "Only my contacts" setting, reviewing reports, and limiting spam and abuse.
• To operate, maintain, secure, and troubleshoot the service.

We do not use your information for advertising, and we do not sell or rent it.

Who we share information with

• The trusted contacts you choose — when you start or accept a share, send a ping, send an SOS, arrange a meet-up, or send a letter, the relevant information (your location, name, and any content you wrote) is shared with those specific people.
• Service providers — we use Google Firebase (Firestore, Realtime Database, Cloud Functions, Cloud Messaging, and Authentication — anonymous by default; Google Sign-In or Sign in with Apple if you enable backup) as our backend, which processes data on our behalf. See Google's Firebase Privacy and Security information. If you choose Sign in with Apple, Apple handles that sign-in under Apple's Privacy Policy.
• Google Play Billing (Android) and the Apple App Store (iPhone) — process any purchases. Which one applies depends on where you downloaded Kymber. See Payments.
• Google Maps — when you open a location in maps, Google's maps app or service handles it under Google's Privacy Policy. If you paste or type an address while arranging a meet-up, that address text is forwarded to Google's Geocoding service (via our server, so the lookup is never tied to a key on your device) solely to place the meeting pin.
• Resend — when you send feedback from Kymber Resources, our server hands your note to Resend, an email-delivery provider, purely to deliver it to our own support inbox. That is the only thing Resend is ever used for: nothing else in Kymber is emailed, and it is never used to send you marketing.
• Legal requirements — we may disclose information if required by law or to protect safety, rights, or property.

App permissions

Kymber requests only the permissions it needs for the features above:

Optional backup & account recovery Opt-in only

By default, Kymber keeps no way to recover your account: if you lose your phone or uninstall the app, your notes, history, and contacts are gone for good. If you prefer a safety net, you can optionally turn on backup — during setup or later from the Privacy screen. Nothing described in this section happens unless you explicitly choose it.

• What turning it on does. Backup links your Kymber account to your Google account or your Apple Account, whichever you choose. Linking stores that account's identifier — your email address, or, if you use Sign in with Apple and choose to hide your address, the private relay address Apple gives us instead — with Firebase Authentication so you, and only you, can sign back in and recover the same account on a new phone.
• What is backed up. A small copy of the keepsakes and settings that normally live only on your phone: your saved notes, letters you chose to keep a copy of, your saved meet-up templates and quick actions, your history view settings, and your theme. The app data already on our servers (your profile, contacts, and recent history) recovers automatically with your account.
• What is never backed up. Your app-lock PIN never leaves your device. A Silent SOS leaves no trace anywhere, including in your backup.
• How long it's kept. Your backup is kept until you turn backup off or delete your data. Turning backup off deletes the backup immediately and unlinks your Google or Apple account.

Data retention & deletion

• Live location stream is deleted when the live share ends — whether it was a sharing session, an SOS, a meet-up live-share, or a live location attached to a letter.
• Location pings (single points) are deleted automatically after 30 days.
• A share's final location point is kept with your share history and deleted when you delete your data, or after 90 days — whichever comes first.
• Letters are removed when they self-destruct on opening, when their timer expires, when the recipient deletes them, or after a backstop of 30 days — whichever comes first. A "letter opened" receipt, if you asked to be notified, is removed on the same backstop. The optional copy you keep in your own history stays on your device.
• Meet-ups that are completed are kept with your history for up to 90 days; meet-ups that are active or cancelled are removed after about 7 days.
• Check on me timers — a timer's record, including the last-known location captured when you armed it, is deleted 30 days after the timer ends.
• Voice notes attached to a location share or a ping are deleted automatically after 30 days — unless you save one. If you save a location with its voice note attached, we keep your own copy of that recording for as long as you keep the saved location, and it is removed when you delete it (or when you delete your data). A voice caption on a post works the same way as the words on that post: it is part of what you posted, so we keep it for as long as the post is there and delete it when you delete the post. Everything else expires on its own.
• Sharing history otherwise records who you shared with and when, alongside the limited location points described above.
• Activity status (if you turned on "Show when I'm on the app") is a single, current value that is continuously overwritten — no activity history is ever kept. It stops updating the moment you turn the setting off, and it is removed when you delete your data.
• Reachability check (if you turned it on) is likewise a single, current value that is continuously overwritten — no history is ever kept. It stops updating and is removed the moment you turn the setting off, and it is removed when you delete your data.
• Delivery confirmations are stored with the message they belong to and are removed with it, on the same schedule as that ping, letter, or SOS record.
• Dormant accounts. If an account's phone has not connected to Kymber for an extended period (about 90 days), we automatically mark that account as unavailable to its contacts, so no one is left believing an abandoned account can still receive their messages.
• Feedback you send us from Kymber Resources is kept for as long as we need it to act on what you told us and improve the app. It isn't tied to your name or email — only to your app ID.
• Gifts you send. The phone number you typed for a gift recipient is kept with that gift. Once the gift is claimed it stays on the record of the purchase; if nobody has claimed it yet, we hold it until they do, so the person it was bought for doesn't lose what you paid for. See Payments.
• Your profile and contacts are retained while you use Kymber so the app can function.
• Your optional backup (if you turned backup on) is kept until you turn backup off or delete your data; turning it off deletes the backup immediately and unlinks your Google or Apple account.
• Safety & anti-abuse data — your block list and "Only my contacts" setting are kept while you use Kymber and removed when you delete your data. Spam-prevention timing data and any temporary sending limit expire on their own automatically. Reports about possible abuse may be kept for as long as we need to review them and keep people safe.

Deleting your data. You can delete your Kymber data at any time from within the app, on the Privacy screen, using the two-step delete option. This permanently removes your profile, contacts, sharing sessions, requests, pings, stored location points, voice notes (including any you saved), meet-ups, letters, activity status, reachability timestamp, and SOS records from our systems. Permanent We may retain reports about possible abuse or safety violations, and limited related information, for as long as we need to review them and keep people safe. Because Kymber uses anonymous sign-in, this in-app action is the way to delete your data; there is no separate account to look up. If you enabled backup, deleting your data also deletes your backup and unlinks your Google or Apple account. If you no longer have the app installed: reinstall and recover your account (if you enabled backup), then delete from the Privacy screen — or email us at support@kymber.app from the address you linked and we will delete your account and data for you.

Security

Data is encrypted in transit using industry-standard TLS. Access to your data is governed by server-side security rules so that only you and the contacts you share with can see a session's location or a letter you sent. Kymber never has a password of its own to be stolen or leaked: sign-in is anonymous by default, and if you enable backup, authentication is handled by Google Sign-In or Sign in with Apple — your Google or Apple password is never seen or stored by Kymber. No method of transmission or storage is ever completely secure, but we work to protect your information.

Payments SOS is free forever

SOS and the core safety features are free forever, regardless of any purchase, and they always will be. Nothing in this section applies to them.

Beyond those, Kymber offers optional purchases — two for yourself, and the same two again as a gift for someone else:

• Kymber membership — a 7-day free trial, then $11.99 per year. It renews automatically each year until you cancel. You can cancel any time — in your Google Play account on Android, or in Settings under your Apple Account subscriptions on iPhone; cancelling stops the next renewal, and you keep your membership until the period you've paid for runs out. If you don't subscribe when the trial ends, you're not charged — you simply keep the free-forever features.
• Unlimited contacts — a one-time $1.99 purchase that permanently lifts the trusted-contact limit. It is not a subscription, it never renews, and it stays yours whether or not you ever take the membership.
• Gifting either of those to someone else — you can pay for another person's membership or their unlimited contacts. A gift is a one-time charge that never renews, and a gifted membership lasts a year.

What we collect when you send a gift

To deliver a gift, Kymber needs to know who it is for, so you type in the recipient's phone number. That number is the only thing about them we receive, and we use it for one purpose: matching the gift to their Kymber account so the right person gets it.

• If they already use Kymber with that number, the gift is applied to their account and Kymber notifies them that someone gave it to them.
• If nobody uses Kymber with that number yet, we hold the gift against that number until someone sets up Kymber with it and claims it. An unclaimed gift is kept for as long as it remains unclaimed, so that the person it was bought for can still receive it.
• The recipient never sees your payment details, and nothing about your card is stored on their phone or ours.
• A gift cannot be undone or moved to a different number once it is bought, so the number you enter is worth double-checking. If something goes wrong with a delivery, tell us from the feedback box in Kymber Resources and we will put it right.

We do not use a recipient's phone number for anything else. It is not added to your contacts, it is not used to market to them, and it is never sold or shared.

Purchases are processed by the app store you downloaded Kymber from — Google Play Billing on Android, or the Apple App Store on iPhone. Kymber does not receive or store your card or payment details: Google handles payment processing under Google's Privacy Policy, and Apple under Apple's Privacy Policy. We receive only your purchase and entitlement status, so the app can unlock the right features for you.

Refunds are handled by whichever store took the payment, because that store — not Kymber — is who charged you. On Android that is Google Play, under Google Play's refund policy. On iPhone it is Apple, through Apple's Report a Problem process. If something has gone wrong, write to us at support@kymber.app anyway and we'll help where we can.

Children

Kymber is not directed to children under 13 and is intended for users aged 13 and older. We do not knowingly collect information from children under 13. If you believe a child has provided us information, contact us at support@kymber.app and we will delete it.

Where your data is processed

Kymber's backend runs on Google Firebase infrastructure, with data processed and stored on servers located in the United States. By using Kymber, you understand your information may be processed in the United States, which may have data-protection laws different from those in your country.

If you are in the UK or the European Economic Area (EEA), moving your data to the United States is covered by recognized legal safeguards. Our backend provider, Google LLC, is certified under the EU-US Data Privacy Framework and the UK Extension to it (the "UK-US data bridge") — arrangements approved by the European Commission and the UK government that allow personal data to flow to certified US companies. Where those frameworks do not apply, Google's data-processing terms also incorporate the European Commission's Standard Contractual Clauses and the UK's International Data Transfer Addendum, which provide a separate legal safeguard for the transfer. You can ask us for more detail at support@kymber.app.

Your rights in the UK & Europe UK & EU GDPR

If you are in the United Kingdom or the European Economic Area (EEA), the UK GDPR and EU GDPR give you specific rights over your personal data. This section explains them and how Kymber meets them. These rights apply alongside everything described above — they don't replace it.

Who is responsible for your data

Kymber is operated by Todd Eastland, who is the "data controller" for the information described in this policy. You can reach us about any data question at support@kymber.app.

The legal bases we rely on

The UK and EU GDPR require us to have a "lawful basis" for using your personal data. Depending on what you do in the app, we rely on:

• Your consent. For the things you actively choose to do — starting or accepting a live share, sending a one-time location ping, sending an SOS, sharing your live location back to someone's SOS, arranging a meet-up, sending letters and reactions, recording an optional voice note to send with a share or ping or to caption a post, turning on the optional "Show when I'm on the app" activity status, turning on the optional reachability check, sending someone a gift (which is where the recipient's phone number comes from), and turning on the optional Google or Apple backup. You can withdraw your consent at any time by stopping the share, turning the setting off, or turning backup off — and that won't affect anything that happened before you withdrew it.
• Our legitimate interests. To operate, secure, maintain and troubleshoot the service, to deliver push notifications, and to keep Kymber safe from spam and abuse — honoring the people you block and your "Only my contacts" setting, reviewing reports, and applying temporary, automatic anti-spam limits. We've weighed these interests against your rights: we keep the data minimal, and you stay in control of what you share.
• Protecting someone's vital interests. In a genuine emergency, such as an SOS, to process the location needed to help get someone to safety.
• Legal obligations. Where we have to disclose information to comply with the law.

Your rights

You have the right to:

• Access the personal data we hold about you.
• Correct data that is wrong or incomplete — you can edit your display name in the app at any time.
• Delete your data — this is built into the app on the Privacy screen (the two-step delete), which permanently removes your profile, contacts, sessions, requests, pings, stored location points, meet-ups, letters, activity status, reachability timestamp, and SOS records. See Retention & deletion.
• Restrict or object to certain processing, including processing we carry out on the basis of our legitimate interests.
• Portability — receive a copy of the data you provided to us in a structured, commonly used, machine-readable format.
• Withdraw consent at any time for anything you switched on.

You also have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Kymber does not make any such automated decisions about you.

How to use your rights

Many of these are built right into the app: you can delete your data or edit your name on the Privacy screen, and turn any share or setting off whenever you like. For anything else, email us at support@kymber.app. We will respond free of charge and within one month. Because Kymber uses anonymous sign-in, we may need to ask you for details only you would know so we can locate the right data and confirm it's really you.

Complaints

If you have a concern about how we handle your data, please contact us first at support@kymber.app — we will acknowledge your complaint within 30 days and work to put it right. You also have the right to complain to a data-protection regulator. In the UK that is the Information Commissioner's Office (ICO) — ico.org.uk, helpline 0303 123 1113. In the EEA you may contact the supervisory authority in your country. We'd appreciate the chance to help before you do.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we'll revise the "Last updated" date above, and significant changes may be communicated in the app. Continued use of Kymber after an update means you accept the revised policy.

Contact

Questions about this policy or your data? Reach us at support@kymber.app.