Privacy policy

1. The short version

No ads. We never sell or share your data — and there's nothing to opt out of, because we don't do it in the first place. Nothing is shared until you share it, every share is scoped to a circle you chose or a conversation you're in, and everything location-related expires on its own. You choose who can message you — everyone, your circles, or nobody — and the directory lists you only to them. No AI trains on your content, and no automated system makes decisions about you. Beaconaut exists so your closest friends can find you when you want to be found — that only works if you can trust it completely.

2. Who's responsible for your data

Beaconaut is an independent app operated from California, USA, and is the data controller for the information described here. For anything privacy-related — a question, a request, a worry — email johnny@beaconaut.com and a human will answer.

3. What we collect

• Account — the identifier Apple or Google gives us when you sign in, or the email address you sign up with (an Apple private-relay address counts), and your name if you chose to share it. With Apple or Google there's no password at all; an email password is stored only as a secure hash we can never read.
• Profile — your username, display name, an optional first and last name you can add in Settings, and your avatar if you set one. You choose whether people see your name or just your @username; your first and last name and your email are never shown to your circles or to anyone who looks you up. What someone who looks you up sees is your @username, your avatar, your name if you show it, and the circles you run that are listed in search.
• Messages and photos — what you send inside your circles and in conversations with one other person.
• Who can message you — your choice of everyone, your circles, or nobody. It's never shown to anyone else.
• Directory lookups — when you search or browse the directory we note that you did, and when, to limit how fast anyone can use it. We never store what you searched for, and the note is deleted after about two hours.
• Invitations — when a circle's admin invites someone who is already on Beaconaut: who invited whom, to which circle, and the answer. An invitation nobody answers expires after 7 days.
• Beacon pins (precise location) — the exact spot you picked when you sent up a beacon, its place name, and who responded. Precise location is sensitive, so we treat it that way: you share it deliberately, one beacon at a time, and the coordinates delete themselves (see retention).
• Coarse compass pings — only if you turned compass on for a circle, and always rough (see the tiers below).
• Push tokens and timezone — a device token from Apple so beacons can reach your lock screen, plus your timezone so times read correctly.
• How the app gets used — which screens you open and which features you use, tied to your account, so we can see where Beaconaut is confusing or broken and fix it. No third-party trackers, no ad networks, never sold or shared, and deleted after 180 days. You'll be able to switch it off in Settings → What beacon shares, and the app keeps working exactly the same.

That's the whole list. No contact books, no ad identifiers, no third-party analytics or trackers, and nothing about you for sale.

4. Why we're allowed to process it

If you live somewhere with a privacy law (the EU/EEA, the UK, and others), here's our lawful basis for each thing:

• To run the service — your account, profile, circles, messages, and beacons are processed to deliver what you asked for. That's a contract between you and us.
• Location and compass — processed only on your consent, given per circle and withdrawable any time.
• Safety and security — we handle reports, blocking, and abuse prevention because we (and you) have a legitimate interest in keeping circles safe.

5. Location — the four tiers

Location is the whole reason to be careful, so here is exactly how it works. These are the same words you'll find inside the app, on purpose.

Off by default

Nothing is shared. This is where you sit until you decide otherwise.

A beacon is a place, not a track

When you send a beacon, your circle sees the spot you picked — for up to one hour. The coordinates are deleted a day later; only the place name and who came stay as circle lore.

Compass is coarse and opt-in

If you turn it on for a circle, members see a rough direction and distance — never your exact location, never a map pin. Pings are snapped to a grid of roughly 500 meters on our servers (coarseness is a guarantee, not a client promise) and are deleted after 24 hours.

Approach is yours to start and stop

Sharing your approach only starts after you tap “On my way.” Your phone sends that circle how far you are from the beacon: the distance only, never your location, relayed live and never stored. The location indicator shows the whole time, and sharing ends the moment you arrive, change your answer, or the beacon ends.

Your own beacon follows you — on your phone

While a beacon of yours is up, your phone watches how far you are from the pin you set. That does two things: a beacon you've walked away from ends itself instead of sending your friends somewhere you already left, and the circle you sent it to can see how far away you are while they're heading over — so they find you, not a spot you've drifted from. It runs for that hour and no longer, and the blue indicator stays up the whole time so you can see it happening. Your position is never stored. It's relayed live to that one circle and nowhere else: no database row, no history, nothing kept on our servers, and nothing to delete afterwards because nothing was written down. It stops the moment the beacon ends.

Background location powers exactly three things. The compass: it keeps the coarse direction fresh for circles you've opted in — snapped to a rough grid, never a pin, never a route — and stops the moment you turn compass off. Your own live beacon, as above, for its hour only. And your approach, as above, from “On my way” until you arrive, change your answer, or the beacon ends. The app works fine if you leave location off entirely; you just won't send or follow beacons. If you allow location but not background access, the beacon check still runs — only while the app is open.

6. No AI, no automated decisions

We don't use artificial intelligence or machine learning to profile you, and no automated system makes decisions about you — nothing ranks you, scores you, or flags you without a person in the loop. When you report someone, a real human reviews it. And we never use your messages, photos, or any of your content to train AI models — ours or anyone else's. If that ever changes, we'll tell you in the app first, and ask before it applies to you.

7. Photos

Photos live in private storage buckets scoped to circle membership — only members of the circle a photo was shared with can load it. There are no public links. Leaving a circle ends your access to its photos, instantly.

8. Your contacts stay yours

The contact picker never uploads your contacts. When you invite a friend, the app helps you compose a message on your own phone — the invite is a code or link that you send yourself. A circle's admin can also invite someone who is already on Beaconaut, inside the app; that person accepts or declines, and nobody is added to a circle without saying yes. Your address book never touches our servers.

9. Push notifications

To deliver beacons to your lock screen we store an Apple push token for each of your devices. Tokens are deleted when you sign out, when Apple tells us a device is gone, and when you delete your account.

10. Who processes data for us

We keep the list short, and each one is bound by contract to protect your data to the same standard described here:

• Supabase — database, storage, and authentication infrastructure.
• Apple — sign in with Apple and push notification delivery.
• Google — sign in with Google, if you choose it.
• Vercel — hosts this website.

Each processes data only to run the service. No advertising networks, no data brokers, no tracking SDKs.

11. Where your data lives

Beaconaut and the providers above are in the United States, so if you're in the EU/EEA or UK, running the service means your data is transferred to the US. For those transfers we rely on Standard Contractual Clauses and the equivalent safeguards our providers offer. Want a copy of the safeguards? Email us.

12. How we keep it safe

Keeping your circles private is the whole point, not something we bolted on:

• Your connection is encrypted in transit (TLS), and your data is encrypted at rest on our infrastructure.
• Sign in with Apple or Google and there's no Beaconaut password to steal; an email sign-in password is stored only as a secure hash.
• Every message, photo, and beacon is access-controlled at the database level, so only members of the circle you shared with, or the other person in a conversation, can read it — not other users, not the open internet.
• We keep less on purpose. Beacon coordinates and compass pings delete themselves within about a day; data we don't keep can't leak.
• Our hosting providers maintain industry-standard security certifications.

No system is ever perfectly secure, but we design for the smallest possible blast radius.

13. If something ever goes wrong

If a breach ever affects your personal information, we'll tell you and notify the relevant authorities as the law requires — promptly, and within the deadlines that apply to us (for example, within 72 hours to regulators under the GDPR). We'll be straight with you about what happened, what was affected, and what we're doing about it.

14. Retention and deletion

• Beacon coordinates: deleted 24 hours after the beacon expires.
• Compass pings: deleted after 24 hours.
• Directory lookup notes: deleted after about two hours.
• A released @username or circle @handle: held for 14 days so nobody can pose as its last owner, then forgotten. After you delete your account, the held name is no longer linked to you.
• Messages and photos: kept while the circle exists, so the circle keeps its lore.
• Account data (profile, memberships, devices): kept for the life of your account.
• Everything tied to your account: erased when you delete your account in the app — profile, memberships, devices, messages, and media. If you signed in with Apple, we also revoke your Apple sign-in token. Any residual copies in our encrypted backups are overwritten on the regular backup cycle.

15. Your rights

Wherever you live, we extend the same rights to everyone: you can access, correct, export, or delete your data; restrict or object to certain processing; and withdraw any consent you gave — turning location or compass off in the app does exactly that, and the rest of the app keeps working. We never make solely automated decisions about you, and we won't discriminate against you for using any of these rights. Most of it you can do directly in the app; for anything else, email us and a human will answer.

If you're in the EU/EEA, UK, California, or somewhere else with a privacy law, these are the rights those laws describe — we just don't make you cite a statute to use them. You also have the right to complain to your data protection authority (in the EU/EEA or UK, your local supervisory authority) — though we'd appreciate the chance to make it right first.

Because we don't sell or share your personal information for advertising, there's no "Do Not Sell or Share My Personal Information" link to click — there's simply nothing to opt out of.

16. Children

Beaconaut is for ages 13 and up and is not directed at children under 13. We don't knowingly collect their data; if we learn an account belongs to someone under 13, we delete the account and the data tied to it. If you believe a child under 13 has an account, tell us and we'll take care of it.

17. Changes to this policy

If we change how we handle your data in any meaningful way, we'll tell you in the app before the change takes effect — not bury it here and hope. The latest version always lives at beaconaut.com/privacy.

Contact

Privacy questions: johnny@beaconaut.com.