Kymber

Privacy Policy

Location when it matters.

Effective date: May 30, 2026 · Last updated: July 16, 2026

The short version

Kymber is built to share your location only when you decide to — never silently, never in the background. We don't track your movements or keep a continuous trail of where you've been.

When you share live, your location streams to your chosen contacts only while that session is active, and that live stream is deleted when the session ends. The individual points you choose to send — a one-time location ping, the final point of a share, or a point attached to a letter — are kept for a limited time so they stay viewable in your history, then deleted automatically.

Kymber also lets you send short letters and meet-up plans to your trusted contacts. We store that content only to deliver it, and it is removed when it self-destructs, expires, is deleted, or after a short backstop period — whichever comes first.

We use anonymous sign-in, so you don't create an account or password. (You can optionally turn on backup with Google Sign-In so your account can be recovered on a new phone — nothing is backed up unless you explicitly choose otherwise.) We don't sell your data, we don't show ads, and we don't track you over time. This page explains exactly what Kymber collects, why, and how to delete it.

Who we are

This Privacy Policy describes how the Kymber mobile application ("Kymber," "we," "us") handles your information. Kymber is a privacy-first location-sharing and safety app that lets you share your live location with trusted contacts you choose — triggered by you calling a trusted contact from within Kymber, an in-app request, an SOS broadcast, a meet-up you arrange, or a short letter you send.

Kymber is operated by Todd Eastland. If you have questions about this policy or your data, contact us at theast.qa@gmail.com.

What we collect

Information you provide

Your display name — the name shown to your trusted contacts. When you reach out to someone first (a request, ping, meet-up invite, or letter), your name — and your phone number, so they can recognize and add you back — may be shown to that person even if they haven't added you yet. You are choosing to identify yourself by reaching out.
Your phone number — used so your trusted contacts can recognize and match with you. We do not verify your phone number, and we do not use it to send you SMS messages.
Your trusted contacts — the names and phone numbers you enter for the people you want to share with. Kymber does not read your device's address book; you add contacts yourself. If you use the optional "choose from contacts" picker, Android returns only the single contact you tap (name and number) — Kymber never scans or uploads your address book and does not request the READ_CONTACTS permission.
Letters, meet-up details, and reactions — the optional message text, titles, meeting place labels, notes, and emoji reactions you choose to send. See Letters, meet-ups & user content.
Feedback you send us — if you use the feedback box in Kymber Resources to tell us how we can improve, we keep the note you wrote along with your app ID, your platform (Android or iOS), and your app version, so we can make sense of it. A copy is emailed to our own support inbox so that a person actually reads it — see Who we share with. We don't ask for your email address, so unless you write a way to reach you into the note itself, we have no way to reply.

Location data

Live location during a share — collected only while a live share is active that you have started or accepted: a sharing session, an SOS, a meet-up live-share, or a live location you chose to attach to an "I'm on my way" letter. It is streamed live to the contacts in that session, and the live stream is deleted when the session ends. We do not store the continuous path you traveled. See How location works below.
Individual location points you send — when you send a one-time location ping, attach your location to a letter, or when a live share ends, Kymber stores a single location point (a snapshot, not a path) so it stays viewable in your history or in the letter you sent. These points are kept only for a limited time and then deleted automatically — see Retention & deletion.

Information collected automatically

Push notification token — a token from Firebase Cloud Messaging so we can notify you of incoming share requests, shared locations, meet-up activity, letters, and SOS alerts.
Activity status (optional, off by default) — if you turn on the "Show when I'm on the app" setting in Privacy, Kymber records when you were last active in the app so your trusted contacts can see "Active now", or the time you were last active, on your contact card. This is a single, continuously-updated timestamp of app activity — not your location and not a record of where you've been. It is shared only with the trusted contacts who have you saved, and only while the setting is on; turn it off and they no longer see it.
Reachability check (optional, off by default) — if you turn on the optional reachability check (Kymber asks you once, and you can change your answer at any time in Privacy), Kymber keeps a single timestamp of when your phone was last able to reach Kymber's servers. If your phone then cannot be reached for about 2 days or more — because it is off, broken, lost, or out of service — your trusted contacts see a gentle note that you may be unreachable, instead of assuming your phone can still receive their pings and alerts. This is not your location and not a record of your activity: it is one continuously-overwritten value, no history is ever kept, and your contacts are never shown "active now" or exact times from it. Turning the setting off removes it immediately.
Basic technical data — our backend provider (Google Firebase) processes standard technical information such as IP address and device/connection data to operate the service and keep it secure.
Purchase status — whether you have made an optional purchase (such as the unlimited-contacts upgrade), so we can enable the right features. Payments are handled by Google Play (see Payments).
Safety & anti-abuse data — to keep Kymber safe we store: the list of people you have chosen to block; any reports you file about content or a sender (the sender's app ID and a small snapshot of what you reported); a small amount of timing data used to stop spam (for example, how recently someone has been sending you pings or requests); and, if several different people report the same sender, a temporary, automatically-expiring limit on that sender's outbound messages. You also control a "Only my contacts" setting that tells our servers to quietly turn away pings, requests, and letters from people you haven't added.

How location works Privacy-first

Location is the heart of Kymber, so we want to be precise about it:

Only when you act. Kymber accesses your precise location only during a sharing session, SOS, or meet-up that you start or accept, when you send a one-time location ping or attach your location to a letter, or when you choose to share live location with an "I'm on my way" letter (which runs and stops like any other live share). There is no background or continuous location tracking, and Kymber does not request the "all the time" background-location permission.
No movement trail. We never store a continuous record of where you've been. During a live share, your coordinates are streamed to your chosen contacts in real time and the live stream is deleted when the session ends.
SOS responders. If you tap "I'm on my way" to someone's SOS, you may choose to share your own live location back to the person in distress so they can see how close help is. That reverse stream works just like any other live share — it runs only while the SOS is active, you can stop it at any time, and it is deleted when the SOS ends.
Some single points are stored, briefly. A location ping, a point attached to a letter, and the final point of an ended share are saved as single snapshots — not paths — so the recipient and your own history can display them.
Group check-ins & meeting points. Inside a Kymber Group — a private board shared only with the trusted contacts you choose — any member can start a "check-in" that asks everyone to mark themselves safe or that they need help. Responding is status-only by default: attaching your current location to your response is optional and your choice each time, and a status-only check-in shares no location at all. A member can also set a single shared "meeting point" pin that everyone in the group can see. These are single points shared only with that group's members — never a continuous trail and never live tracking. A check-in, and any location attached to it, is kept only while the check-in is open and is cleared automatically afterward; a meeting-point pin stays until a member changes or clears it.
Check on me (check-in timers). If you arm a check-in timer and don't check in by your chosen time, Kymber automatically sends your last-known location (captured when you armed the timer, or the most recent refresh while the app was open), your optional note, and the timing of the missed check-in to the contacts you selected when arming. The countdown runs on our servers — the app does no background location tracking while a timer is armed, and the escalation works even if your phone is off. If you chose "Let them know," those contacts are also told when your timer starts and when you check in safely or cancel. Timer records (including the last-known location) are deleted 30 days after the timer ends.
Limited retention. Ping points are deleted automatically after 30 days. A share's final point is kept with your share history and removed when you delete your data, or after 90 days — whichever comes first. A point attached to a letter is removed with that letter (see Retention & deletion).
Shared locations are never turned into addresses. Kymber does not convert the locations you share into street addresses. When you tap to open a location in maps, the coordinates are handed to your device's maps app, which performs any lookup. One narrow exception exists when you arrange a meet-up: if you paste or type a street address or place name to position the meeting pin, that text is sent to our server and forwarded to Google's Geocoding service solely to find the spot on the map. We do not store the text you typed — only the resulting pin, and the place label you wrote yourself, are saved with the meet-up. (Coordinates, Plus Codes, and map links are resolved on your device and never reach our servers.)
Last-viewed cache stays on your device. The most recently viewed location may be cached on your phone for convenience. That on-device cache is separate from the stored points above and is not uploaded to us.

Letters, meet-ups & user content You're in control

Beyond location, Kymber lets you send a few kinds of short, optional content to the trusted contacts you choose. This content is sent only to the specific people you select — Kymber has no public feeds, profiles, or strangers, and any groups are private and limited to the trusted contacts you choose.

Letters ("Envelopes"). You can send a contact a short letter — an optional title and message, in a color you pick, with options to send it anonymously, to keep the content off the lock-screen notification, to have it self-destruct when it's opened, or to have it expire on its own after a time you choose. A letter's content is stored on our backend only to deliver it to the recipient; the notification itself never carries the message body. The recipient can read, delete, or keep a copy of a letter; you can optionally keep a copy in your own history and be told once when it has been opened. Some quick responses (like "I'm on my way!") let you optionally include your live location, which works like any other live share — you can stop it at any time.
Meet-ups. When you arrange a meet-up, the meeting place (a label and/or coordinates you provide), the time, and any note you add are shared with the contacts you invite, along with each person's response (accepting, declining, "on my way," or "running late").
Bulletin posts. Your Bulletin is a personal status board: a short piece of text you write, shown only to the specific trusted contacts you choose for that post. You pick the audience each time, you can delete a post, and you can reshare one to a Kymber Group you're in. There is no public feed and no discovery — a post is never visible to anyone outside the people you picked.
Reactions. You can respond to a location ping with a single emoji, which is shown to the person who sent it.
Delivery confirmations. When a ping, letter, or SOS alert you send actually arrives on the recipient's phone, their device records a single delivered timestamp with that message, so the sender can see whether it has truly reached their phone rather than only that it was sent (for letters, this sits alongside the existing "opened" notice, if you asked for one). A delivery confirmation is stored with the message itself and is removed with it.

Acceptable use. Because letters and meet-up notes are content you write, you are responsible for what you send, and you agree not to use Kymber to send unlawful, abusive, harassing, or otherwise objectionable content.

Staying in control. Kymber gives you quiet, in-app ways to manage who can reach you — none of which notify the other person:

"I don't know this person." When a ping or location request arrives from someone you haven't added, you can ignore it, remove it from your view, block the sender, or block and report them.
Block. Blocking quietly stops that person's pings, location requests, and letters from reaching you. Because SOS is an emergency feature, a block leaves their SOS coming through unless you explicitly choose to include it — that choice is always yours.
Report. Reporting a letter, ping, or request flags it for our review. If several different people report the same sender, that sender's outbound messages may be limited temporarily and automatically while we look into it.
Only my contacts. You can turn on a setting so only people you've added can ping you, request your location, or send you letters; everyone else is turned away quietly. An SOS still comes through — safety always wins.
Unknown senders. Letters from people who aren't in your contacts are kept in a separate, low-key area of your inbox rather than mixed in with your contacts' letters.

You can manage blocked people, and this setting, on the Privacy screen. You can also reach us about a safety concern at theast.qa@gmail.com.

How we use information

To let you share your live location with the trusted contacts you choose, when triggered by you calling a contact from within Kymber, an in-app request, an SOS, or a meet-up.
To deliver the location points you send (pings, letter attachments) and the final point of an ended share, and to keep them viewable in your history for a limited time.
To deliver the letters, meet-up plans, responses, and reactions you choose to send to the specific contacts you select.
To match in-app requests against your trusted contacts, and to show your name to a person you reach out to so they can identify and add you back.
To deliver push notifications for requests, shared locations, meet-up activity, letters, and SOS alerts.
To keep an active sharing session running reliably via a foreground service with a persistent notification.
To show your trusted contacts when you were last active in the app, if you choose to turn on the optional "Show when I'm on the app" activity status.
To show your trusted contacts a calm heads-up that your phone may be unreachable, if you choose to turn on the optional reachability check.
To show a sender whether a ping, letter, or SOS alert they sent has actually arrived on the recipient's phone.
To enable optional purchased features and verify your entitlement.
To read and act on the feedback you choose to send us.
To keep Kymber safe — honoring the people you block and your "Only my contacts" setting, reviewing reports, and limiting spam and abuse.
To operate, maintain, secure, and troubleshoot the service.

We do not use your information for advertising, and we do not sell or rent it.

App permissions

Kymber requests only the permissions it needs for the features above:

Precise & approximate location (while in use only)

Used to share your location during an active session, SOS, or meet-up, and to capture a point when you send a ping or attach your location to a letter. Kymber does not request background location.

Notifications

To show share requests, shared locations, meet-up activity, letters, SOS alerts, and the persistent "sharing now" notification.

Foreground service (location)

Keeps a sharing session alive while you're sharing, with a visible ongoing notification.

Optional backup & account recovery Opt-in only

By default, Kymber keeps no way to recover your account: if you lose your phone or uninstall the app, your notes, history, and contacts are gone for good. If you prefer a safety net, you can optionally turn on backup — during setup or later from the Privacy screen. Nothing described in this section happens unless you explicitly choose it.

What turning it on does. Backup links your Kymber account to your Google account using Google Sign-In. Linking stores your Google account identifier (your email address) with Firebase Authentication so you — and only you — can sign back in and recover the same account on a new phone.
What is backed up. A small copy of the keepsakes and settings that normally live only on your phone: your saved notes, letters you chose to keep a copy of, your saved meet-up templates and quick actions, your history view settings, and your theme. The app data already on our servers (your profile, contacts, and recent history) recovers automatically with your account.
What is never backed up. Your app-lock PIN never leaves your device. A Silent SOS leaves no trace anywhere, including in your backup.
How long it's kept. Your backup is kept until you turn backup off or delete your data. Turning backup off deletes the backup immediately and unlinks your Google account.

Data retention & deletion

Live location stream is deleted when the live share ends — whether it was a sharing session, an SOS, a meet-up live-share, or a live location attached to a letter.
Location pings (single points) are deleted automatically after 30 days.
A share's final location point is kept with your share history and deleted when you delete your data, or after 90 days — whichever comes first.
Letters are removed when they self-destruct on opening, when their timer expires, when the recipient deletes them, or after a backstop of 30 days — whichever comes first. A "letter opened" receipt, if you asked to be notified, is removed on the same backstop. The optional copy you keep in your own history stays on your device.
Meet-ups that are completed are kept with your history for up to 90 days; meet-ups that are active or cancelled are removed after about 7 days.
Check on me timers — a timer's record, including the last-known location captured when you armed it, is deleted 30 days after the timer ends.
Sharing history otherwise records who you shared with and when, alongside the limited location points described above.
Activity status (if you turned on "Show when I'm on the app") is a single, current value that is continuously overwritten — no activity history is ever kept. It stops updating the moment you turn the setting off, and it is removed when you delete your data.
Reachability check (if you turned it on) is likewise a single, current value that is continuously overwritten — no history is ever kept. It stops updating and is removed the moment you turn the setting off, and it is removed when you delete your data.
Delivery confirmations are stored with the message they belong to and are removed with it, on the same schedule as that ping, letter, or SOS record.
Dormant accounts. If an account's phone has not connected to Kymber for an extended period (about 90 days), we automatically mark that account as unavailable to its contacts, so no one is left believing an abandoned account can still receive their messages.
Feedback you send us from Kymber Resources is kept for as long as we need it to act on what you told us and improve the app. It isn't tied to your name or email — only to your app ID.
Your profile and contacts are retained while you use Kymber so the app can function.
Your optional backup (if you turned backup on) is kept until you turn backup off or delete your data; turning it off deletes the backup immediately and unlinks your Google account.
Safety & anti-abuse data — your block list and "Only my contacts" setting are kept while you use Kymber and removed when you delete your data. Spam-prevention timing data and any temporary sending limit expire on their own automatically. Reports about possible abuse may be kept for as long as we need to review them and keep people safe.

Deleting your data. You can delete your Kymber data at any time from within the app, on the Privacy screen, using the two-step delete option. This permanently removes your profile, contacts, sharing sessions, requests, pings, stored location points, meet-ups, letters, activity status, reachability timestamp, and SOS records from our systems. Permanent We may retain reports about possible abuse or safety violations, and limited related information, for as long as we need to review them and keep people safe. Because Kymber uses anonymous sign-in, this in-app action is the way to delete your data; there is no separate account to look up. If you enabled backup, deleting your data also deletes your backup and unlinks your Google account. If you no longer have the app installed: reinstall and recover your account (if you enabled backup), then delete from the Privacy screen — or email us at theast.qa@gmail.com from your linked Google address and we will delete your account and data for you.

Security

Data is encrypted in transit using industry-standard TLS. Access to your data is governed by server-side security rules so that only you and the contacts you share with can see a session's location or a letter you sent. Kymber never has a password of its own to be stolen or leaked: sign-in is anonymous by default, and if you enable backup, authentication is handled by Google Sign-In — your Google password is never seen or stored by Kymber. No method of transmission or storage is ever completely secure, but we work to protect your information.

Payments SOS is free forever

SOS and the core safety features are free forever, regardless of any purchase, and they always will be. Nothing in this section applies to them.

Beyond those, Kymber offers two optional purchases:

Kymber membership — a 7-day free trial, then $3.99 per year. It renews automatically each year until you cancel. You can cancel any time in your Google Play account; cancelling stops the next renewal, and you keep your membership until the period you've paid for runs out. If you don't subscribe when the trial ends, you're not charged — you simply keep the free-forever features.
Unlimited contacts — a one-time $1.99 purchase that permanently lifts the trusted-contact limit. It is not a subscription, it never renews, and it stays yours whether or not you ever take the membership.

Purchases are processed by Google Play Billing. Kymber does not receive or store your card or payment details — Google handles payment processing under Google's Privacy Policy. We receive only your purchase and entitlement status, so the app can unlock the right features for you.

Refunds are handled by Google Play under Google Play's refund policy — because Google takes the payment, they issue the refund. If something has gone wrong, write to us at theast.qa@gmail.com anyway and we'll help where we can.

Children

Kymber is not directed to children under 13 and is intended for users aged 13 and older. We do not knowingly collect information from children under 13. If you believe a child has provided us information, contact us at theast.qa@gmail.com and we will delete it.

Where your data is processed

Kymber's backend runs on Google Firebase infrastructure, with data processed and stored on servers located in the United States. By using Kymber, you understand your information may be processed in the United States, which may have data-protection laws different from those in your country.

If you are in the UK or the European Economic Area (EEA), moving your data to the United States is covered by recognized legal safeguards. Our backend provider, Google LLC, is certified under the EU-US Data Privacy Framework and the UK Extension to it (the "UK-US data bridge") — arrangements approved by the European Commission and the UK government that allow personal data to flow to certified US companies. Where those frameworks do not apply, Google's data-processing terms also incorporate the European Commission's Standard Contractual Clauses and the UK's International Data Transfer Addendum, which provide a separate legal safeguard for the transfer. You can ask us for more detail at theast.qa@gmail.com.

Your rights in the UK & Europe UK & EU GDPR

If you are in the United Kingdom or the European Economic Area (EEA), the UK GDPR and EU GDPR give you specific rights over your personal data. This section explains them and how Kymber meets them. These rights apply alongside everything described above — they don't replace it.

Who is responsible for your data

Kymber is operated by Todd Eastland, who is the "data controller" for the information described in this policy. You can reach us about any data question at theast.qa@gmail.com.

The legal bases we rely on

The UK and EU GDPR require us to have a "lawful basis" for using your personal data. Depending on what you do in the app, we rely on:

Your consent. For the things you actively choose to do — starting or accepting a live share, sending a one-time location ping, sending an SOS, sharing your live location back to someone's SOS, arranging a meet-up, sending letters and reactions, turning on the optional "Show when I'm on the app" activity status, turning on the optional reachability check, and turning on the optional Google backup. You can withdraw your consent at any time by stopping the share, turning the setting off, or turning backup off — and that won't affect anything that happened before you withdrew it.
Our legitimate interests. To operate, secure, maintain and troubleshoot the service, to deliver push notifications, and to keep Kymber safe from spam and abuse — honoring the people you block and your "Only my contacts" setting, reviewing reports, and applying temporary, automatic anti-spam limits. We've weighed these interests against your rights: we keep the data minimal, and you stay in control of what you share.
Protecting someone's vital interests. In a genuine emergency, such as an SOS, to process the location needed to help get someone to safety.
Legal obligations. Where we have to disclose information to comply with the law.

Your rights

You have the right to:

Access the personal data we hold about you.
Correct data that is wrong or incomplete — you can edit your display name in the app at any time.
Delete your data — this is built into the app on the Privacy screen (the two-step delete), which permanently removes your profile, contacts, sessions, requests, pings, stored location points, meet-ups, letters, activity status, reachability timestamp, and SOS records. See Retention & deletion.
Restrict or object to certain processing, including processing we carry out on the basis of our legitimate interests.
Portability — receive a copy of the data you provided to us in a structured, commonly used, machine-readable format.
Withdraw consent at any time for anything you switched on.

You also have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Kymber does not make any such automated decisions about you.

How to use your rights

Many of these are built right into the app: you can delete your data or edit your name on the Privacy screen, and turn any share or setting off whenever you like. For anything else, email us at theast.qa@gmail.com. We will respond free of charge and within one month. Because Kymber uses anonymous sign-in, we may need to ask you for details only you would know so we can locate the right data and confirm it's really you.

Complaints

If you have a concern about how we handle your data, please contact us first at theast.qa@gmail.com — we will acknowledge your complaint within 30 days and work to put it right. You also have the right to complain to a data-protection regulator. In the UK that is the Information Commissioner's Office (ICO) — ico.org.uk, helpline 0303 123 1113. In the EEA you may contact the supervisory authority in your country. We'd appreciate the chance to help before you do.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we'll revise the "Last updated" date above, and significant changes may be communicated in the app. Continued use of Kymber after an update means you accept the revised policy.

Contact

Questions about this policy or your data? Reach us at theast.qa@gmail.com.