We process data to authenticate accounts, deliver user-requested location sharing, positioning, messaging, calls and safety features, secure the service, prevent abuse, provide support and meet legal obligations. Group members see information shared to their groups; message and call participants receive the communications addressed to them.
Infrastructure providers process the minimum needed to host the API, database, media, email and push notifications. Google Maps processes map requests and necessary device/network data when a Google map is shown. Google ML Kit processes images or documents when you choose document scanning. If Premium Google positioning is enabled and requested, nearby cell and Wi-Fi radio measurements are sent through the FamilyCellMap server to Google Geolocation to estimate a position; the proxy does not store or log that scan or Google's answer. Google and other enabled sign-in/push providers process data under their own terms and privacy notices.
You can explicitly enable or disable sharing, pause sharing, choose approximate location and cell contribution/use scope, delete collected personal location/cell data while keeping the account, or delete the account. Most personal location and place/SOS history uses a configured 90-day default; while an account is active, its newest location may remain to show the last known position. Stale device tokens expire after 180 days. Content-free message tombstones expire after 30 days.
Raw attributable cell observations are deleted on a personal-data/account deletion request. A bounded Wi-Fi learning reservoir can temporarily contain exact radio samples tagged with a pseudonymous contributor hash. Deletion removes that contributor's reservoir samples while ingestion is serialized, then recomputes or drops each affected access-point state. Only learned Wi-Fi AP/sector and communal cell aggregates that no longer contain attributable raw contributions may remain until 180 days after last confirmation. Unpublished cell-tower aggregates expire after one year without confirmation. Published cell-tower map aggregates, which require the service's k-anonymity contributor threshold and do not store account IDs, may remain as learned map data.
Account deletion removes account/profile records and attributable data. Messages authored by the deleted user, including full-content copies forwarded by other users, are changed to content-free tombstones and their attached media access is revoked. Reports you submitted are deleted; a report about the account may be retained with its subject link anonymized when needed for safety or legal compliance. See the account deletion page.
The current service operator and privacy contact are identified in the app's Google Play listing. Use that verified developer contact for access, correction, deletion or privacy questions. Do not send passwords or authentication codes.