Privacy Policy

Last Updated: October 10, 2026

Homebound LLC, a Utah limited liability company ("we," "us," or "our"), operates the Homebound mobile application (the "App"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our App.

This notice describes our practices. It is not a contract, and using the App is not by itself how you consent to anything. Where we rely on your consent — for example, live location sharing — we ask for it separately and you can withdraw it (see Sections 2 and 9).

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Email address (required for authentication)
• First and last name (for personalization and to share with emergency contacts)
• Age (to verify you meet the minimum age requirement for your region)
• Age range from Apple (see below)
• Profile photo (optional, only if you choose to add one). Photos you upload are re-encoded on our servers before storage, and all embedded metadata—including any GPS location saved in the photo file by your camera—is removed. Your photo is visible in the App to your friends, to the people on group trips you are on, and to the safety contacts on your trips (contacts who only receive email do not see it); to anyone who can see a trip you publish or appear on in the Activity Feed, which, for an adult's trip published to everyone, means all Homebound users; next to your comments and reactions, to the people who can see them; and on invite pages you share. Section 7 limits who can see the photo of a user under 18.
• Apple ID identifier (if you sign in with Apple)
• Notification preferences (trip reminders, check-in alerts, friend activity notifications)
• Friend visibility settings (controls what friends can see about you, such as your check-in locations, live location, trip notes, achievements, and trip statistics). Your age is never shown to friends — it is used only for the minimum-age and under-18 rules described in Section 7.
• Activity Feed preferences (trip publishing mode, visibility scope, location privacy defaults)
• Privacy and consent records (which version of this Privacy Policy and which version of our Terms of Service you accepted, and the date and time you accepted each, whether you have restricted processing, and when you withdrew consent if you have, plus your locale and App Store region, used for compliance and to apply the correct minimum-age and regional rules — see Sections 6.2 and 9)
• App version (for compatibility and troubleshooting)

About the age range from Apple. When you finish setting up your profile, the App asks iOS whether it can share an age range for your Apple Account — for example "13–15" or "18 and over". This uses Apple's Declared Age Range feature, and for accounts set up as a child in Family Sharing the range is the one a parent provided.

• You choose. iOS shows you the request and you can decline. Declining costs you nothing: the App works exactly the same, and you give us your age yourself instead.
• If you share a range when signing up, we don't ask you to type your age; we record the youngest age in the range as your age. Accounts created earlier are asked once, on a later launch.
• We receive a range, not a birthday. We never learn your date of birth from this, and we do not ask Apple for it.
• What we store: the range, whether Apple described it as declared by you or by a guardian, and the date we received it.
• What we use it for: one thing only — applying the correct minimum age for your region, and the under-18 protections in Section 7. It plays no part in what you are shown, what you are charged, or anything we send you.
• It can only add protections, never remove them. If Apple's range says you are under 18 but the age you typed says otherwise, we treat you as under 18. It never works the other way round, so nobody can lift the under-18 limits by interfering with this.
• Apple does not learn anything about you from this. The request tells Apple only that an app asked whether you fall above or below the ages 13, 16, and 18.

1.2 Trip & Safety Plan Data

When you create a trip or safety plan, we collect:

• Trip title and activity type
• Start time and estimated time of arrival (ETA)
• Grace period preferences
• Location information (starting location and optional destination)
• Optional notes about your trip (included in the overdue email to your contacts)
• Optional trip difficulty grade
• Timezone information
• Check-in interval preferences
• Quiet hours settings
• Live location sharing preference
• Custom notification messages (for trip start and overdue alerts)
• Weather conditions at trip start and completion (temperature, feels like, conditions, precipitation probability, wind speed, UV index, humidity)
• Activity feed publishing preferences for the trip (visibility scope, location privacy, photo sharing, participant visibility)

Check-ins: When you check in during a trip, or extend your trip, we record the time and, if available, your coordinates at that moment. Extending a trip is recorded as a check-in.

Check-in photos and trip albums: You can attach a photo when you check in, with an optional caption of up to 80 characters, and add photos to a trip's album while it is underway or any time after it is completed (up to 12 photos per trip). Like profile photos, every photo is resized and re-encoded on our servers before storage and all embedded metadata — including any GPS location saved in the photo file by your camera — is removed. We do keep the time the photo was taken, which the App sends with it. A photo attached at a check-in is linked to that check-in, so it can be placed on the trip's map at the check-in's coordinates. Photos added to the album on their own, rather than at a check-in, are not linked to a check-in and are not given a location.

• Who sees them: you and the trip's members, in the App; and anyone with the trip's tracking link, which is sent to the safety contacts who receive email about the trip. The tracking page shows the trip's most recently taken photo (by the time it was taken) while the page is available (Section 3.1). On a group trip, every member's email contacts get the trip's tracking link, so a photo you add can be seen by other members' contacts. While a trip is in progress (active or overdue), friends who are safety contacts can also see its photos in the App: a member's safety contacts see that member's photos, and the trip owner's safety contacts see every member's photos. After the trip ends, they see its photos only if they can see its Activity Feed post. If the completed trip is published to the Activity Feed, the trip owner's friends can see the photos the trip's photo setting shares (Section 1.9). Any member who joined the trip, not only the owner, can publish it and choose its photo setting, and the photos still go only to the owner's friends. In the Activity Feed, photos are never shown to anyone outside the owner's friends, even if the trip is published with global visibility. On a group trip, the photos you add go into the trip's album and are shared as the trip's post allows.
• Your Photos library: photos you take with the camera inside Homebound (for a check-in or for your profile photo) are also saved to your iPhone's Photos library as soon as you take them, if you have allowed Homebound to add photos. There is no setting in the App to turn this off; you can stop it by turning off Homebound's access to Photos in your iPhone's Settings. That copy stays on your device and is yours, and deleting the photo in Homebound does not remove it from your library. To help you pick an existing photo for a trip, the App asks for access to read your photo library and shows you the photos in it taken between the trip's start and end. It reads the date each photo was taken to do this, not its location, and nothing leaves your device unless you choose it.
• Storage and links: photos are stored with Cloudflare R2 and delivered from public web addresses that contain a random string, so they can't practically be guessed. Anyone who has a photo's direct address can open it, so we only give the address to the people above.
• Deleting: you can delete any photo you added from the trip in the App, and the trip owner can remove any photo from their trip. If you can't reach a photo you added (for example, on an older trip on the free plan, or a trip that isn't published), email privacy@homeboundapp.com and we'll delete it. Deleting removes it from our storage. Copies already downloaded to other people's devices, or held in network caches, can take some time to disappear.

SOS: If you trigger an SOS during an active trip, we collect the time it was triggered, who triggered it, any optional message you include (up to 500 characters), and your location if your phone has one. So the alert is never held up waiting for GPS, the App sends the most recent location your phone already has, and if that location is a minute or more old, your contacts are told how old it is. If it is that old, or there isn't one, the App then tries to get a fresh location for up to a minute and sends it to us. If you have moved more than about 100 meters, or the first alert had no location, your contacts get one follow-up alert with the new location. SOS uses your location whether or not Live Location Sharing is on. On a group trip, an SOS and its location go to every other member of the trip and to every member's safety contacts. We keep only the newest location with the SOS record. An SOS sent from Apple Watch uses the watch's own location and has no follow-up. If the watch has no location and your iPhone sends the alert for it, your iPhone's most recent location is used instead, and the follow-up described above can apply.

Group Trips: When you create or join a group trip, we also collect participant lists, roles, invitation timestamps, group checkout settings, each participant's check-in status, each participant's location-sharing choices and "Let the group find me" setting, and—if individual finish ("I'm home") is enabled—each participant's arrival status.

Quick Trips: If you use the Quick Trips feature, we store your preset configurations (name, activity type, default location, duration, grace period, and selected contacts) locally on your device only. Quick Trip presets are not uploaded to our servers. If you start a Quick Trip using Siri or Apple Shortcuts, the trip is created the same way as one started in the App; your Siri interactions are handled by Apple on your device under Apple's privacy terms.

1.3 Emergency Contact Information

You may add emergency contacts to your account:

• Contact names
• Contact email addresses
• Optional contact groups for organization

You can also add friends (other Homebound users) as safety contacts for your trips; friends receive push notifications instead of emails.

Note: We only store the information you provide. We do not access your device's contact list, and we do not collect phone numbers for your contacts.

1.4 Location Data

Location is the most sensitive data we handle. We collect it only as described below.

Trip Locations: We collect location data when you set a trip's starting location or destination using the map, use your current location for a trip, check in during a trip, or extend your trip. Your check-in events may include the coordinates where you checked in.

Trip Live Location Sharing (Optional): If you enable Live Location Sharing for a trip, we collect real-time location data while the trip is active: coordinates, altitude, accuracy, speed, and the time of each fix. We also collect whether you are moving or stopped, whether your location has stopped updating or sharing is paused and why (for example, location access is turned off), whether Precise Location is off, your phone's battery level and whether it is charging, and the elevation you have gained on the trip, which we calculate from your altitude. Together these form a temporary trail used for safety, including to help locate you if you become overdue.

The trail and this status are shown to your safety contacts on that trip who are your Homebound friends and, on a group trip, to the other members, as your sharing choices for that trip allow. If a group trip does not share locations between members, only the trip owner sees the members' locations. Nothing is shown while your Allow Live Location setting in Settings > Privacy is off. Your phone sends updates more often while someone is viewing your live location, when you are overdue, and after an SOS, and our servers may send it a silent background notification asking for a fresh location. Sharing stops by itself when the trip ends, or when you finish ("I'm home") or leave a group trip, and the trail is deleted then (Section 5). Turning sharing off during a trip stops new updates; what was already collected is deleted when the trip ends.

If you become overdue: when the trip has Live Location Sharing on and your Allow Live Location setting is on (and, on a group trip you joined, your sharing choices for the trip include your contacts), your emergency contacts who receive email also get your last known location, with a map link, in the overdue email. If it is your own trip, its tracking page (Section 3.1) also shows, for as long as the trip is overdue, your live position (with how accurate it is, when it was taken, and whether it is approximate), your recent trail, your battery level and whether it is charging, and whether you are moving or stopped, or since when sharing has been paused or has not updated. Anyone with the tracking link can see that page.

Trip Live Location Sharing is:

• Optional — you must explicitly enable it for a trip
• User-controlled — you can disable it at any time
• Limited sharing — the App shows it to the safety contacts you choose for that trip who are your Homebound friends and, on a group trip, to the other members as your settings allow; if you become overdue, your email contacts can also see where you are, as described above

Circles & On-Demand Location Sharing (Optional): Separately from trips, you can create named "Circles" of your friends (for example, "Family" or "Climbing crew") and choose to share your current location with a Circle. This feature works like a live map of the people you've chosen:

• You choose who sees you. The App shows your location only to the friends in a Circle you share with. Sharing is one-directional—adding a friend to your Circle, or being added to theirs, does not automatically share your location back.
• Time-boxed. Each share lasts for a duration you choose (from 1 hour up to a maximum of 1 week) and then automatically expires. There is no indefinite sharing.
• Current location only, no trail. For Circle sharing we store only your most recent location fix (coordinates, altitude, accuracy, speed, and the time of the update)—not a continuous history. We also store whether you are moving or stopped, whether your location has stopped updating or sharing is paused and why (for example, location access is turned off), your phone's battery level, and whether it is charging, all of which the friends in the Circle can see. We also record whether Precise Location is off; Circle friends aren't shown that.
• How often it updates. While a share is active your phone updates your location about once a minute (more often while someone in the Circle is looking at the map, less often in Low Power Mode). We keep only the latest point, and our servers may send a silent notification asking for a fresh one if updates stop.
• Revocable. You can stop sharing, remove a friend from a Circle, or delete a Circle at any time, which immediately ends access. While you are sharing, the App displays a persistent banner so you always know.

Find and Meetup Pins (Group Trips): On an active group trip, including one that is overdue, members can use Find to get an arrow and distance to another member, and can drop a meetup pin to show the group where to meet.

• Who can find you. A Find session starts only if you allow it when the other member asks, or if you have turned on "Let the group find me" for that trip. That setting is off until you turn it on; after that, the App suggests your last choice when you create or join another group trip. With it on, a member can start a session without asking first, and you are told straight away: you get a notification saying who is finding you, with a way to stop it, and, if Live Activities are on, a Live Activity on your Lock Screen. If you start Find on a member who has already asked to find you, that counts as allowing their request. Find is separate from Trip Live Location Sharing and from your Allow Live Location setting in Settings > Privacy: it works when either is off, and turning either off does not turn Find off. People who have blocked each other cannot use Find with each other.
• What is shared, and with whom. Find works both ways. During a session, both phones send their precise location (coordinates, accuracy, and how recent the fix is) to our servers every few seconds, and each location is passed only to the other person in the session. When you ask to find someone, your location is sent to us straight away, but it is not shown to them unless the session starts. Our servers also use the two locations to tell you when you are close to each other. An unanswered request expires after 15 minutes, and a session lasts at most 15 minutes from when it starts. A request or session ends sooner when either of you stops it or marks the other found, when the person asked chooses "Not now", when your phones detect that you have reached each other, when either of you leaves the trip, is removed from it, or blocks the other, when either of you finishes with "I'm home" (after which nobody can start a new Find with that person), when you turn off "Let the group find me" (for a session that setting started), or when the trip ends. Starting a new Find ends the one you started before. While it runs, the App may use your location in the background, and iOS shows its location indicator.
• What is kept. When a session ends, both locations are erased, and the session record (who, with whom, when, and how it ended) is deleted about an hour later. When a session starts, we record in each person's location-access log that the other could see their location; that record is kept for 90 days.
• Nearby Interaction (Ultra Wideband). When both iPhones support it and are close together, they measure the distance and direction between them directly. Those measurements stay on the two devices and are never sent to us. To connect the phones, the App passes a temporary pairing token through our servers to the other person only. We also receive whether each phone supports this and whether it is in use, which we use, with your locations, to tell you when you are close. All of this is erased when the session ends.
• "Precise arrow" camera view. If you open it, the App uses your camera and motion sensors (through Apple's ARKit) to work out the direction to the other person. Camera images are processed on your iPhone only. They are never stored, and never sent to us or anyone else.
• Apple Watch. Your iPhone sends your watch the other person's first name, distance, and direction (never their coordinates), or a meetup pin's location and label. The watch uses its own compass, and its own GPS for meetup pins, and does not upload any location. Its only network request for Find is to stop a session when your iPhone can't be reached.
• Meetup pins. Any member can drop a pin on an active group trip, and a new pin replaces the trip's current one. We store the pin's location and accuracy, an optional label of up to 40 characters, who dropped it, and each member's reply ("On my way", "Here", or "Can't make it"). The pin, its label, and the replies, with each member's first name, are shared with everyone on the trip, except that people who have blocked each other don't see each other's pins or replies. While you are heading to a pin with the Find screen open, the App may mark you "Here" automatically when you arrive, within about 15 to 40 meters depending on your phone's GPS accuracy. Heading to a pin does not send your position to us: the arrow is worked out on your own phone, and only your reply is sent. A pin lasts an hour. The person who dropped it can extend it an hour at a time, up to three hours ahead. It ends when it is cancelled or replaced, when the person who dropped it leaves the trip, or when the trip ends, and it is deleted, with its replies, about an hour after it ends.

Background Location & Permissions: Some safety features only work if your device can report your location while the App is closed or in your pocket. To support them the App may request "Always" location access. Here is exactly when background location is used, and what for.

The App uses background location only while one of the following is true:

• You are on an active trip with Trip Live Location Sharing enabled — so your safety contacts can still see you when your phone is locked or the App is closed. This ends when you check out, when the trip is completed or cancelled, or when you turn sharing off.
• You have an active Circle share — so your current location does not go stale for the people you chose. This ends when the share expires or when you stop it.
• You are on an active trip with a destination set — your device watches for your arrival near that destination so the App can remind you to check out. This is a local reminder on your device; the arrival itself is not reported to us. It ends when the trip ends.
• You are using Find on a group trip: from when you ask to find someone until the session ends, while a session that includes you is running, and while you are heading to a meetup pin in Find. This keeps Find working when your phone is locked or you switch apps. It ends when the session ends or the request expires (15 minutes at most each), or when you stop heading to the pin, and it works with "While Using the App" access too.
• You check in, extend your trip, or send an SOS from the Lock Screen, a notification, or your Apple Watch — the App may read your location once, to attach it to that action.

To do this, the App relies on features your device provides: significant-location-change monitoring, visit monitoring, a boundary around your trip's destination, a boundary of about 200 meters around your current position while live sharing runs, a background location session for Find, and the silent background notifications described above. Your device may briefly wake the App to deliver one of these events. If no trip, Circle share, or Find session is active when that happens, the App sends nothing new (it may finish sending actions, location updates, or photos you queued while offline) and turns the background monitoring off. If a Circle location request reaches your phone after a share you stopped or that expired, the App doesn't read your location.

Outside those windows we do not request, receive, or store your location in the background. When none of the conditions above apply, background location monitoring is switched off entirely.

About your device's "used your location in the background" notice: iOS periodically shows a summary such as "Homebound has used your location N times in the background." That count comes from your device and includes every wake-up where your device handed the App a location — including wake-ups where the App sent nothing to us. If you see this notice while you have no active trip, Circle share, or Find session, you can choose "Change to Only While Using" at any time, and we would be glad to hear about it at the address in Section 10.

You can also use the App with "While Using the App" (foreground-only) access, in which case live and Circle sharing update only while the App is open. A Find session you start while the App is open can still continue in the background. Whenever the App is using your location in the background, iOS displays its own location indicator. You can change or revoke location permissions at any time in your device's Settings.

Place Search (Discover): When you use the Discover feature to find nearby places for your activities, your current location coordinates are sent to our servers, and from there to the place-search and weather providers listed in Section 3.3, to return relevant results. These queries contain location coordinates only—no name, email, or account identifier—and the results are not stored against your account.

Location Access Logging: We log these views of your location by other users (who viewed, what was viewed, and when), so we can maintain an audit trail and protect against misuse: a friend viewing your live location on a trip, including on the trip cards on their Friends tab, a member of a group trip you are on viewing your location, and a friend in a Circle you share with viewing your location. While someone keeps watching, we record the view about every 10 minutes (sometimes more often), not for every location update. For Find, we record it once, when the session starts. Some views are not logged: the trip's tracking page (anyone with the link can open it without signing in), a group member seeing your check-in points in the trip's member list or timeline, and the check-in points on an Activity Feed post. A record stays in your log if the trip is later deleted, and if someone who viewed your location later deletes their account, the record stays and shows them as a deleted account. These logs are kept for 90 days and then deleted (see Section 5).

Precise Location Is Sensitive. We treat precise geolocation as sensitive information, and several privacy laws classify it that way — including the California Consumer Privacy Act (as amended by the CPRA), which treats precise geolocation as "sensitive personal information," and the Washington My Health My Data Act, which can treat location information as consumer health data. We use your precise location only to provide the features you use (including Discover and weather) and the sharing you have chosen. This includes sending your check-in coordinates to OpenStreetMap/Nominatim (Section 3.3) to look up a place name for the check-in emails and notifications your contacts receive. We do not use it to infer characteristics about you, and we do not use it for advertising, profiling, or any purpose that would require an opportunity to limit its use. See Sections 6.7 and 6.8.

What We Do NOT Do:

• Sell your location data
• Share your location with advertisers or data brokers
• Collect your location except through the features described in this section that you use: setting a trip's location, checking in or extending a trip, SOS, live sharing, a Circle share, Find, a meetup pin, or Discover
• Keep background location monitoring running after your trip ends, your Circle share expires, or your Find session ends
• Access your location without your permission

1.5 Device Information

To send push notifications and Live Activities, we collect:

• Device push notification token
• Device platform (iOS)
• App environment (development or production)
• Live Activity tokens (for lock screen widgets, including when you watch a friend's trip)
• Live Activity start tokens (so we can show a Find alert on your Lock Screen when a group member starts finding you); the App sends one whenever Live Activities are on
• Last activity timestamp
• An app-install identifier (a random identifier for your app installation, used to keep push tokens accurate across reinstalls and token changes)

Our servers may also send silent background notifications to your device—for example, to request a fresh location while you are sharing with a Circle, while someone is viewing your live location on a trip, or when your live updates stop arriving; to wake the App when a group member starts finding you (see Section 1.4); to start, update, or end a trip's Live Activity; to refresh trip and friend information; to check that your device can still receive notifications; or to ask the App to send pending safety actions, when your connectivity returns and periodically during an active trip.

If you use the Homebound Apple Watch companion, your active trip data is mirrored between your iPhone and your watch; this does not create a new category of data on our servers. If your iPhone is out of range during a trip with Live Location Sharing on, the watch can offer to send its own location instead, at intervals watchOS decides (usually about every 15 minutes), until the iPhone is back in range.

1.6 Automatically Collected Information

When you use the App, we automatically collect:

• Timestamps of account creation and last login
• When you last used the App. This is updated when you open or use the App, not when iOS wakes it in the background, and it keeps updating while processing is restricted (Section 6.2). Your friends' apps receive it so they can sort friends by "Recently Active"; the App does not show them the time.
• Trip creation and completion timestamps
• Check-in, check-out, and ETA extension events
• SOS events
• Location-access logs (when other users view your location, as described in Section 1.4)
• Notification delivery logs (for troubleshooting and to confirm safety alerts were sent)

First-Party Usage Analytics: To understand where new users get stuck and improve the App, we collect basic usage events (such as app opens, which screens you view and for how long, onboarding steps, which features you use, and errors the App runs into when talking to our servers), along with your app version and platform. Feature events record what you did, for example that you created a trip or checked in, never what you wrote; error events record the error code and the type of request. This is done entirely with our own systems—we do not use any third-party analytics, advertising, or crash-reporting SDKs. Before you sign in, these events are linked only to a random anonymous identifier stored on your device; once you create an account or sign in, subsequent events are associated with your account, and they carry the same identifier, so earlier events from that device can be connected to your account. If you restrict processing (Section 6.2), we stop recording events for your account. If you delete your account, we delete your analytics events, including those recorded on that device before you signed up.

1.7 Subscription Information

If you subscribe to Homebound+, we collect App Store transaction identifiers, the product purchased, purchase and expiration dates, subscription status, auto-renewal status, free-trial status, any promotional or offer codes used, and family-sharing status. This information is processed through Apple's App Store.

1.8 Social & Friend Data

If you use social features, we collect friend connections, friend requests, invite links, Circles and Circle membership, visibility preferences, and achievements visible to friends.

1.9 Activity Feed Data

When you or your friends complete trips, we collect and may share (based on privacy settings):

• Completed trip details: Trip title, activity type, duration, completion timestamp, difficulty grade (if you set one), and number of check-ins
• Location information and route map: Subject to the trip's location setting. Exact shows the trip's start and destination and each check-in point with its time, drawn as a route; on a group trip this includes every member's check-in points. Generalized (the default) shows only the city or region, and the start and destination as general areas rounded to roughly 1 km, with no check-in points and no photo locations. Hidden shows no location. This setting, not your friend-visibility settings, decides what a published trip shows, and it applies to everyone who can see the post.
• Check-in photos: The photos the trip's photo setting shares (see below). On an Exact trip, a photo taken at a check-in is placed on the map at that check-in. Photos are shown only to the trip owner's friends, even on a trip published to everyone.
• Weather data: Conditions at trip start and end
• Engagement data: Reactions and comments on trips, including the identity of the person reacting or commenting and comment content (max 500 characters); comments may include @mentions of people who can see the post, who are notified
• Group trip participant information: Participant names and photos (or count only, based on your visibility setting). Under-18 members are handled as described in Section 7.

Activity Feed Privacy Controls:

• Publishing Mode: Choose 'auto' (always share completed trips), 'ask' (choose per trip — the default), or 'never' (never share)
• Visibility Scope: Share with 'friends' only or 'global' (all Homebound users)
• Location Privacy: Exact, Generalized (the default), or Hidden, as described above
• Photos: Share all of a trip's photos (the default), only the ones you pick, or none. If you share all, photos added to the trip later are shared too. If you pick, only the photos you picked are shared, and a photo added later is not shared until you pick it. If you choose none, no photos are shared.
• Participant Visibility: For group trips, show all participants or display only "with X others"

If your account tells us you are under 18, your Visibility Scope is capped at friends-only and your Location Privacy at Generalized. A trip with any member under 18 is never shown with exact location, whoever publishes it. See Section 7.

Share cards: You can also make a share card, an image of a completed trip, to post elsewhere. Share cards are created on your device and are not uploaded to us. If a design includes a map, the map image comes from Apple Maps (Section 3.3) for the area around your trip. Each card has its own location setting. General (the default) names only the city or region, and its map marks only a rough area, about 1 km across, never the exact spot. Exact shows the place names and points the trip stored. Hidden leaves out place names and the map. A card is only shared when you choose to save it to your Photos library, copy it, or send it to another app such as Instagram, which then handles it under its own terms.

1.10 Comments and Reactions

When you comment on or react to trips and comments in the Activity Feed, or react to a check-in:

• Comments: We store comment content, your user ID, timestamps, and any @mentions. Comments are visible to the trip owner and the owner's friends who can view the trip. You can mention only people who can see the post.
• Reactions: We store your reactions (such as emoji) to trips and comments. Who reacted, and how, is visible to the trip owner's friends; others who can see the post see only how many reactions it has.
• Check-in reactions: Friends who are safety contacts on a trip can react to its check-ins with a thumbs-up or a heart. We store who reacted and how, and the trip's members can see this on the trip's timeline.

1.11 Referral Program

If you participate in the referral program, we collect referral relationships (which account was referred by which invite), invite acceptance timestamps, qualifying-trip status, and the Homebound+ credit granted to each side, including running totals used to apply the program's earning caps.

1.12 Feedback

If you choose to submit feedback, feature requests, or bug reports through our in-app feedback link, that content—and any contact details you include—is handled by our feedback provider (see Section 3.3). Submitting feedback is entirely optional.

1.13 Reports and Blocks

If you use our moderation tools:

• Reports: When you report a post, comment, check-in photo, message, or user, we store the report—including the reason you select, any details you add, the account you reported, and a snapshot of the reported content captured at the time—so our moderation team can review and act on it. For a trip, the snapshot includes its title and the location text saved with it, even if what you saw was generalized or hidden. A copy of each report, including that snapshot, the names and email addresses of both you and the account you reported, and how many times that account has been reported before, is emailed to our moderation team. Only the person who received a message can report it.
• Blocks: When you block a user, we store the block so we can hide that user's content from you and yours from them, including each other's trips in the Activity Feed, even trips published to everyone. Blocking someone, or removing them as a friend, also removes each of you as the other's safety contact through the App on every trip, including one in progress (a contact you added by email address stays until you remove it), and from each other's Circles; the App warns you about this before you confirm. Unblocking does not restore them. You can view and remove blocks in Settings > Privacy > Blocked Users.

1.14 Check-In Requests and Messages

Friends who are safety contacts for you on a trip can, while the trip is underway, ask you to check in or send you a short message (a preset, or their own text of up to 200 characters). You can answer with "I'm okay" (which checks you in and records your location like any other check-in), with a quick reply, or with a message of your own.

• What we store: the message text, who sent it, who received it, the trip, the time, which message it replies to, whether a check-in request was answered and how (for example, by checking in, extending the trip, or replying), and whether our notification was accepted for delivery to at least one of the recipient's devices.
• No read receipts: we do not record whether or when a message was read. The sender sees "Delivered" or "Failed". "Delivered" means Apple's push service accepted our notification for at least one of the recipient's devices, not that they saw it. For a check-in request, the person who asked also sees whether and how you answered it.
• Who can see it: only the sender and the recipient. Messages are not shown to other group members (including the trip owner), on the Activity Feed, on the trip's tracking page, or in emails to your contacts. The text appears in the recipient's notification, so it may show on their Lock Screen and in their notification history, and our notification log keeps a copy for 30 days (Section 5).
• Your controls: Settings > Friends has separate switches, Allow update requests and Allow messages, for check-in requests and messages from your safety contacts. Turning off Check-in Alerts in your notification settings also silences check-in request notifications. Blocking someone stops both. Quick messages you write yourself are stored on your device only and are cleared when you sign out. Messages people write themselves pass through our content filter, and the recipient can report a message (Section 1.13).
• How long we keep them: until the trip, or the sender's or recipient's account, is deleted. You can't unsend a message, though we may remove one that breaks our Terms of Service.

2. How We Use Your Information

We use the information we collect to:

• Provide the Service: Create and manage your safety plans, group trips, Circles, and the Discover and Activity Feed features
• Send Safety Notifications: Alert you about trip status, remind you to check in, deliver SOS alerts, and notify your emergency contacts if you're overdue
• Enable Location Sharing: Share your live trip location with your safety contacts and, on a group trip, the other members, and your current location with the Circles you choose
• Help Your Group Find Each Other: Run Find and meetup pins on group trips
• Deliver Messages: Pass check-in requests and messages between you and your safety contacts
• Authenticate Your Account: Verify your identity via magic link codes or Apple Sign In
• Show You Your Own Trip History: Compute the statistics and safety insights we show you from your own completed trips (for example, totals, streaks, and favorite activities). These are computed for you and shown to you; what your friends can see is controlled by your friend visibility settings.
• Improve the App: Understand how the service is used and make improvements (using first-party analytics only)
• Operate the Referral Program: Attribute referrals and apply Homebound+ credit
• Communicate with You: Send service-related emails (magic link codes, trip notifications)
• Moderate and Protect the Service: Review reports, enforce our Terms, investigate abuse of the location-sharing and SOS features, and keep the service secure
• Comply with Law: Meet our legal obligations and respond to lawful requests (see Section 3.5)

For EU/EEA/UK/Swiss Users: We process your data under the following legal bases:

• Contract Performance (Art. 6(1)(b)): Providing the Homebound safety service you signed up for — including creating trips, running the overdue check, and notifying the emergency contacts you designated. This is the basis for the core safety function, because notifying your contacts if you do not check out is the service you asked us to perform.
• Legitimate Interest (Art. 6(1)(f)): Service security, abuse prevention, content moderation, first-party product analytics, and the location-access audit trail
• Legal Obligation (Art. 6(1)(c)): Retaining consent records and responding to lawful requests
• Consent (Art. 6(1)(a)): Optional features that go beyond the core service — Trip Live Location Sharing, Circle location sharing, and Find. You can withdraw consent at any time by turning the feature off (for Find, by declining or stopping a session, or turning off "Let the group find me"), which stops it going forward.

We do not rely on "vital interests" as a legal basis. Everything safety-related that we do is either performance of the contract you entered into with us or a legitimate interest, both of which are available to us and are the appropriate bases.

3. Information Sharing

3.1 Emergency Contacts

When you add emergency contacts to a trip, they will receive emails about: the trip being created, started, extended, completed, or cancelled; check-ins; a group-trip member arriving home; an overdue alert, and an all-clear if the overdue person then checks in; and an SOS alert, and any follow-up with a newer location. Every one of these emails names the trip and its activity. All except the all-clear and the SOS location follow-up also give the trip's destination, and several give its starting point, planned start time, or ETA. Overdue emails also include your trip notes and any custom overdue message you wrote, and the email sent when a trip starts includes any custom start message. On a group trip, an SOS from any member goes to every member's emergency contacts and friend safety contacts, and every member's contacts get the same tracking link, which shows whichever member checked in last.

Some of these emails include your location:

• Check-in emails include the name of your check-in location and your exact coordinates at check-in.
• SOS emails include your exact coordinates and a link to view them on a map. If that location is a minute or more old, the email says how old it is, and a follow-up email may give an updated location (Section 1.2).
• Overdue emails can include your last known location, with a map link, as described in Section 1.4.
• Most of these emails include a secure tracking link to a web page that shows the trip's title, activity, and status, ETA countdown, your first name, the trip's timeline, the location of the most recent check-in (on a group trip, whichever member checked in last, with their first name) or, before the first check-in or when the latest check-in has no location, the trip's destination, and the trip's most recently taken photo. Until the trip is overdue, those are the only locations it shows. Once the trip is overdue, it can also show the trip owner's live location, as described in Section 1.4. Anyone who has this link can view that page without logging in, so treat it as sensitive.

How the tracking link is protected. Because the link works without a login, we limit it in the following ways:

• It is unguessable. Each link contains a 256-bit random token. It cannot be found by guessing, enumerating, or crawling.
• It is scoped to one trip. A link reveals only the trip it was issued for. It gives no access to your account, your other trips, your contacts, or your profile beyond your first name.
• It stops working. The page is available while the trip is planned, active, or overdue, and for 48 hours after the trip is completed. After that the link returns "not found." A cancelled trip's link stops working immediately.
• The trip owner can revoke it. While the trip is planned or under way, the owner can open it and choose Revoke Shared Links in the Safety Contacts section. The tracking link in every email already sent for that trip stops working immediately, and a new one is issued. On a group trip, every member's contacts get the same link, and only the owner can revoke it. Your contacts are not cut off: their next message about the trip carries the new link, and the trip itself continues normally.

Even so, treat the link as sensitive: while a trip is live, anyone your contact forwards it to can see it. If you think a link has reached the wrong person, revoke it as described above (or ask the trip owner to), and tell us at privacy@homeboundapp.com if you would like us to look into it.

If you enable Trip Live Location Sharing, your designated safety contacts who are your Homebound friends can also view your real-time position in the App. On a group trip, other members can see it too, as your sharing settings allow (Section 1.4). If you share with a Circle, the friends in that Circle can view your current location on a map while your share is active.

3.2 Activity Feed Sharing

When you complete a trip with Activity Feed sharing enabled:

• Friends: Your friends on Homebound can see your completed trip details, subject to your privacy settings
• Global Users: If you choose 'global' visibility, all Homebound users can see your trip, except its check-in photos, which only your friends see
• Engagement: Only your friends can react to, comment on, or read the comments on your trips, including trips published with global visibility
• Weather & Duration: Trip weather conditions and duration are visible in the feed
• Location: Your location is shared based on the trip's location setting (exact, generalized, or hidden). On Exact, this includes the check-in points of everyone on the trip (Section 1.9)

3.3 Third-Party Service Providers

The tracking page and invite pages also load images directly from our own storage: the trip's latest photo from Cloudflare R2 (photos.homeboundapp.com) and the inviter's profile photo from Supabase Storage, so those providers see the viewer's IP address too.

Map links in our SOS and overdue emails point to Google Maps. If an emergency contact opens one, Google receives the coordinates in the link, and it may open in their device's map app instead. We do not control those services or what they do with the link.

Request logs. Our hosting and network providers (Render and Cloudflare) keep request logs for a short time for security and reliability. Requests that carry your location can appear in those logs. We don't keep application access logs of those requests ourselves, and we don't write your coordinates to our own application logs.

3.4 What We Do NOT Do

• Sell your personal information
• Share your data with advertisers
• Use third-party analytics, advertising SDKs, or tracking services (our usage analytics are first-party only — see Section 1.6)
• Share your information with data brokers

3.5 Legal Requirements

We may disclose your information if required by law, such as in response to a subpoena or court order, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

3.6 Business Transfers

If Homebound LLC is involved in a merger, acquisition, financing, reorganization, or sale of all or part of its assets, your information may be transferred as part of that transaction, or disclosed under confidentiality obligations during diligence for one.

This is not a sale of your personal information, and it does not change the commitments in this policy:

• Any successor will be bound by this Privacy Policy for information transferred to it, unless and until you are given notice of a different policy and, where the law requires it, an opportunity to consent or to object.
• We will notify you in the App or by email before your information becomes subject to a materially different privacy policy.
• Your rights in Section 6 — including deletion — continue to apply, and you can exercise them before or after a transfer.

3.7 Aggregated and De-Identified Information

We may create and use aggregated or de-identified information (for example, "how many trips were completed last month") that cannot reasonably be used to identify you. We will not attempt to re-identify it, and we will require anyone we share it with to do the same.

4. Data Security

We implement appropriate security measures to protect your information:

• Encryption in Transit: All data transmitted between the App and our servers uses HTTPS/TLS encryption
• Secure Authentication: JWT tokens with cryptographic signatures
• Secure Storage: Your sign-in tokens and basic account details are stored in the iOS Keychain with kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly protection (kept on your device, not synced to iCloud). A copy of your sign-in tokens is also kept in the App's local database on your device, which can be included in your device backups
• Access Controls: Our servers check who you are before returning your personal data through our API, and we limit each feature to the data it needs
• Location Access Logging: We log when other users view your location in the ways described in Section 1.4, to maintain an audit trail
• No Passwords Stored: We use magic link authentication, so no passwords are stored

Some real-time updates the App receives are not yet limited to each user's own data; we are rolling out per-user checks for them.

While we strive to protect your personal information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

If There Is a Security Incident

If we discover a breach of security affecting your personal information, we will:

• Investigate and contain it promptly, and take reasonable steps to mitigate harm.
• Notify the relevant regulator where the law requires it. For users in the EU/EEA and the UK, that means notifying the competent supervisory authority within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to your rights and freedoms (GDPR/UK GDPR Article 33). For users in Quebec, it means reporting a confidentiality incident presenting a risk of serious injury to the Commission d'accès à l'information and keeping a register of incidents, as Law 25 requires. For users elsewhere in Canada, it means reporting to the Office of the Privacy Commissioner where PIPEDA's real-risk-of-significant-harm threshold is met.
• Notify you directly — by email and, where appropriate, in the App — without undue delay when the breach is likely to result in a high risk to your rights and freedoms (GDPR/UK GDPR Article 34), and in any case as and when required by the breach-notification law of your state or country.
• Tell you what happened, in plain terms: what information was involved, what we have done, and what you can do.

Because location data is among the most sensitive information we hold, we will treat any incident involving location data as high-risk by default.

5. Data Retention

Deleting a trip in progress. If you delete a group trip you own while it is in progress, it is cancelled for everyone rather than deleted, and it stays in your History until you delete it again.

Account Deletion

You can delete your account at any time, in either of two ways:

• Settings > your name > Delete Account deletes your account right away. This cannot be undone.
• Settings > Privacy > Data Requests > Delete My Account schedules the deletion for 30 days later. During this 30-day grace period you can keep using the App and cancel the request at any time. After it, the deletion goes ahead and cannot be undone.
• Either way, we permanently delete all your data, including your profile, profile photo, check-in photos (yours everywhere, and everyone’s on trips you owned), trips, contacts, devices, friendships, Circles, location history, live-location status, check-in requests and messages you sent or received, Find sessions, meetup pins and replies, achievements, referral records, Activity Feed comments and reactions, reports you filed, your blocked-user list, Quick Trip presets, and your usage analytics events (including those recorded on your device before you signed up)
• A few records about you are held by other people and are not deleted with your account: an SOS you triggered on a trip someone else owns stays with that trip, no longer linked to your account, until that trip is deleted; if you viewed someone else's location, their location-access log keeps the record, showing a deleted account, until it expires (90 days at most); the text of a message you sent can remain in our notification log for the recipient for up to 30 days; and notifications to other people that name you (for example, "Alex checked in") stay in our notification log for up to 30 days, and a record of an overdue or SOS alert that could not be delivered is kept for up to 90 days

Deletions that do not wait for the grace period. The 30-day grace period exists to protect you from losing your own account by mistake. It does not apply where a delay would be inappropriate. We delete without the grace period, as soon as we have verified the request, when:

• A parent or guardian asks us to delete the account or data of a child below the minimum age for their region (Section 7);
• We determine that an account belongs to someone below the minimum age for their region; or
• The law requires deletion on a shorter timeline.

Note: You must cancel any active Homebound+ subscription separately through the App Store.

Local Data

To work reliably and support offline use, the App keeps a cache on your device. This may include your trips, emergency contacts, friends and group participants (including the last location a participant has chosen to share), saved locations, Quick Trip presets, quick messages you wrote, weather, photos you have viewed, check-in requests and messages, and actions, location updates, or photos waiting to sync, as well as records of pending in-app purchases. Saved locations, Quick Trip presets, and quick messages are stored on your device only and are not uploaded to our servers.

Settings > Resources > Clear Cache removes the copies of our servers' data kept on your device, including photos you have viewed and check-in requests and messages, and then loads them again, so it needs a connection. It does not remove actions, location updates, or photos waiting to sync, failed actions listed under Sync Issues, records of pending in-app purchases, or the saved locations, Quick Trip presets, and quick messages stored only on your device. Signing out clears locally stored data, including all of these. Saved locations and Quick Trip presets can be managed in their respective settings screens.

6. Your Privacy Rights

6.1 All Users

Regardless of your location, you can:

• Access your data through the App
• Update your profile information at any time
• Delete your account and all associated data
• Export your data (see "Exporting your data" below)
• Review your consent record — which version of this Privacy Policy and of our Terms of Service you accepted, and when — in Settings > Privacy
• Opt out of non-essential communications

Exporting your data. Settings > Privacy > Export My Data produces a machine-readable JSON file containing everything we store about you. You can also choose Request Data Export, under Data Requests on the same screen, to have the same file prepared on our servers and kept available to download for 7 days. Both are available to everyone, wherever you live, at no charge, and the file includes:

• your profile, account settings, notification and friend-visibility preferences, and your consent record;
• your trips, with location, weather, feed settings (including your photo-sharing choices), and per-trip notification settings, and the group trips you joined, with your sharing and Find choices for each;
• your check-ins, ETA extensions, and other trip events, with your locations, and any SOS alerts;
• for group trips you own, the other members' check-ins, SOS alerts (including any message sent with one), and other trip events (what happened, when, and who), without their locations;
• check-in photos, as links: the ones you added, and every photo on trips you own;
• your emergency contacts, contact groups, and the safety contacts assigned to each trip;
• your friends, your Circles (with their members' names) and the Circles you are in, and location shares;
• your recent live-location trail, your current shared location, and your live-location status (moving or stopped, battery level, and elevation gained);
• the log of who viewed your location, by name, and when;
• check-in requests and messages you sent or received;
• your Find sessions, with your own location in them, the meetup pins you dropped, and your replies to meetup pins;
• your devices, subscriptions and subscription history, referral credits, and pinned activities;
• your Activity Feed comments and reactions, comment reactions, mentions of you, check-in reactions, and group check-out votes;
• reports you have filed, your blocked-user list (with the names of the people you blocked), your notification history, records of the overdue and SOS alerts sent about your trips, your past data-export and account-deletion requests, and your usage-analytics events, including those recorded on your device before you signed up.

The file opens with a summary listing how many records of each kind it contains, so you can see at a glance what is in it.

Two things are deliberately left out. Security tokens — the links in your contacts' emails, your device's push and Live Activity tokens, the temporary pairing tokens Find uses, and sign-in tokens — are excluded, because they are credentials rather than information about you, and a copy of them in a file you might forward would be a risk to you. Other people's location data is excluded too, along with anything else about other people that your own records don't need. You will see a friend's name, because a friendship record makes no sense without it, the names of the people you blocked and of your Circle members, for the same reason, and the name of each person who viewed your location (or "Deleted account", if they have since deleted theirs), because that log means nothing without it. You will not see the identity of someone you reported or a copy of the content you reported. Achievements and trip statistics are calculated from the trips already in the file rather than stored separately.

If anything looks missing or wrong, email privacy@homeboundapp.com and we will deal with it on the timelines in Section 6.9.

6.2 European Union, EEA, UK, and Swiss Residents

If you are in the EU, EEA, UK, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR) or UK GDPR:

• Right to Access: Request a copy of your personal data. Use our Export My Data feature or contact us.
• Right to Rectification: Request correction of inaccurate data. You can update your profile directly in the App.
• Right to Erasure: Request deletion of your data. Use Delete Account or Delete My Account in the App (Section 5), or contact us.
• Right to Restrict Processing: In Settings > Privacy, under Pause Processing, turn on Restrict Processing to pause non-essential processing while we address your concerns, or ask us to do it. Trip and check-in reminders stop. So do non-emergency notifications about friends' trips and group-trip activity (such as invitations, other members' check-ins, checkout votes, and a group trip being completed or cancelled), comments and reactions, product news, and usage analytics. Safety-critical notifications continue, because they are performance of the contract you entered into with us — they are the service itself. That means overdue and SOS alerts to your safety contacts, overdue and SOS alerts about trips you watch or are on, the notifications telling you that your ETA is near or has passed and that your own check-in is overdue, check-in requests and messages from your safety contacts, and Find and meetup pins on a group trip. Emails to your safety contacts about your trips (created, started, check-ins with your location, extended, completed, and cancelled) also continue, and so do the copies of those emails sent to you. Your trips, check-ins, and check-outs keep working. Restricting processing does not unpublish your trips, hide you from your friends, or stop recording when you last used the App (Section 1.6), and nothing is deleted.
• Right to Data Portability: Receive your data in a machine-readable format via our Export feature (Section 6.1), which returns your complete record.
• Right to Object: Object to processing based on legitimate interests by contacting us.
• Right to Withdraw Consent: Each feature that relies on consent has its own control. You withdraw consent to Trip Live Location Sharing by turning off Allow Live Location in Settings > Privacy or ending the trip, to Circle sharing by stopping the share, and to Find by declining or stopping a session or turning off "Let the group find me". Withdraw Consent in Settings > Privacy also records a general withdrawal and restricts processing (as above) until you give consent again, with Give Consent Again or by agreeing to an updated version of this policy (Section 9.2). It does not by itself end a share or a Find that is already running. None of this affects prior processing.
• Right to Lodge a Complaint: File a complaint with your local data protection authority. Find yours at: https://edpb.europa.eu/about-edpb/about-edpb/members_en
• Rights of People You Add as Contacts: If someone has added you to Homebound as an emergency contact and you are not a Homebound user, you have your own rights — including the right to be told we hold your details, to object, and to have them erased. See Section 11.

To exercise any of these rights, contact us at privacy@homeboundapp.com. See Section 6.9 for how we verify and handle requests and how long we take.

6.3 California Residents

If you are a California resident, you have the following rights under the California Consumer Privacy Act, as amended by the CPRA:

• Right to Know / Access: What personal information we collect, the categories of sources, the business purposes, the categories of third parties we disclose it to, and the specific pieces of personal information we hold about you.
• Right to Delete: Request deletion of your personal information, subject to the exceptions the CCPA allows.
• Right to Correct: Request correction of inaccurate personal information. You can correct your name and age directly in the App; for anything else, contact us.
• Right to Opt Out of Sale or Sharing: We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the preceding 12 months, including for consumers we know to be under 16. Because we do not sell or share, there is nothing to opt out of and we do not offer a "Do Not Sell or Share My Personal Information" link.
• Right to Limit Use of Sensitive Personal Information: We collect precise geolocation and the contents of messages you send to other users through the App, both of which the CCPA classifies as sensitive personal information. We use them only to provide the features you request (including Discover and weather) and the sharing you choose, to deliver your messages, and to prevent abuse of those features. We do not use or disclose them to infer characteristics about you or for any other purpose. Because our use falls entirely within the exempt purposes in Cal. Civ. Code § 1798.121(a), the right to limit does not give you anything additional here — but you can still stop the collection of location at any time by turning off live location sharing, ending Circle shares, stopping Find, or revoking location permission in your device Settings.
• Right to Non-Discrimination: We will not deny you service, charge you a different price, or give you a lower quality of service for exercising any of these rights. Homebound+ pricing has nothing to do with privacy choices.
• Authorized Agents: You may use an authorized agent to submit a request. We will ask for proof of the agent's authority and, for access and deletion requests, for verification directly from you.

Categories of personal information collected in the last 12 months (using CCPA categories): identifiers (name, email, Apple ID identifier, device and install identifiers); commercial information (subscription and referral records); internet or network activity (first-party usage events, app version, and when you last used the App); precise geolocation; the contents of messages between users; audio/visual information (profile photos and check-in photos); and inferences drawn only for your own trip statistics. We collect these from you, from your device, and from Apple (subscription status). We disclose them for business purposes to the service providers in Section 3.3 and to the recipients you choose. We do not sell or share any category.

Shine the Light (Cal. Civ. Code § 1798.83): We do not disclose personal information to third parties for their own direct marketing purposes.

6.3.1 Do Not Track and Global Privacy Control

Homebound is a mobile app with no advertising, no third-party analytics, and no cross-site tracking, so there is nothing for a browser-based tracking signal to turn off.

• Do Not Track (DNT): Our web pages (our marketing site, the tracking pages, and the dashboard) do not track you across other websites or over time, so we do not respond differently to a DNT header. There is no industry-standard meaning for DNT that would apply to what we do.
• Global Privacy Control (GPC): We do not sell or share personal information, so there is no sale or sharing for a GPC signal to opt you out of. We honor GPC in the sense that we already behave as if every user had sent one.

If we ever begin selling or sharing personal information, we will update this section, honor GPC as a valid opt-out request, and provide the required opt-out link before doing so.

To exercise your rights, contact us at privacy@homeboundapp.com. See Section 6.9 for how we handle requests.

6.4 Canadian Residents

If you are in Canada, you have rights under the Personal Information Protection and Electronic Documents Act (PIPEDA):

• Access: Request access to your personal information
• Correction: Request correction of inaccurate information
• Withdrawal of Consent: Withdraw consent to the collection, use, or disclosure of your information (subject to legal restrictions)

To exercise your rights, contact us at privacy@homeboundapp.com.

If you are in Quebec, Law 25 (the Act to modernize legislative provisions as regards the protection of personal information) gives you more:

• Consent for minors. We do not knowingly collect personal information from anyone under 14 in Quebec without the consent of the person having parental authority. See Section 7.
• Privacy by default. Any setting that would make your information public is off unless you turn it on. Trips are not published to the Activity Feed unless you choose to publish them, the default audience is your friends rather than everyone, and location on a published trip is generalized by default.
• De-indexation and portability. You may ask us to stop disseminating your information, to de-index it, and to receive a computerized copy of the information you gave us — the export in Section 6.1 provides the last of these.
• Automated decisions. We do not make decisions about you based solely on automated processing. If that ever changes, we will tell you and you will be able to ask for a human review.
• Complaints. You may complain to the Commission d'accès à l'information du Québec. We also report confidentiality incidents to the Commission where the law requires it (see Section 4).

6.4.1 Our Privacy Officer

The person responsible for the protection of personal information at Homebound LLC is the Founder, who can be reached at privacy@homeboundapp.com or at the postal address in Section 10. Quebec's Law 25 requires us to publish this; we do it here for everyone, not only Quebec residents.

6.5 Australian Residents

If you are in Australia, you have rights under the Privacy Act 1988:

• Access: Request access to your personal information
• Correction: Request correction of inaccurate information
• Complaint: Lodge a complaint with the Office of the Australian Information Commissioner (OAIC)

To exercise your rights, contact us at privacy@homeboundapp.com.

6.6 New Zealand Residents

If you are in New Zealand, you have rights under the Privacy Act 2020:

• Access: Request access to your personal information
• Correction: Request correction of inaccurate information
• Complaint: Lodge a complaint with the Office of the Privacy Commissioner

To exercise your rights, contact us at privacy@homeboundapp.com.

6.7 Other U.S. State Privacy Rights

If you are a resident of a U.S. state with a comprehensive consumer privacy law — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland, Tennessee, Indiana, Kentucky, Rhode Island, and others as they take effect — you have the following rights, regardless of which of those states you live in. Where your state's law grants you less than this, we still apply the list below.

• Confirm and Access: Confirm whether we process your personal data and obtain a copy of it.
• Correct: Correct inaccuracies in your personal data.
• Delete: Delete personal data we hold about you.
• Portability: Obtain your data in a portable, machine-readable format.
• Opt Out of Targeted Advertising, Sale, and Profiling: We do not engage in targeted advertising, do not sell personal data, and do not use automated profiling to make decisions that produce legal or similarly significant effects. There is nothing here to opt out of.
• Consent for Sensitive Data: Precise geolocation is sensitive data under these laws. We process it only to provide the features you ask for (including Discover and weather). In states that require opt-in consent for sensitive data, we ask for that consent before turning on live location sharing or a Circle share, and Find only shares your location with another member if you allow it or have turned on "Let the group find me". You can withdraw consent at any time.

Your Right to Appeal. If we deny your privacy request, in whole or in part, we will tell you why. You may appeal that decision by replying to our response, or by emailing privacy@homeboundapp.com with "Privacy Appeal" in the subject line, within a reasonable time after you receive our decision.

We will review the appeal and give you a written answer, including the reasons, within 45 days of receiving it (or within 60 days where your state's law allows an extension, in which case we will tell you). If we deny your appeal, we will give you a way to contact your state Attorney General to submit a complaint. This right applies to every U.S. resident who asks for it, whether or not their state law requires it.

6.8 Washington and Nevada — Consumer Health Data

Washington's My Health My Data Act and Nevada's SB 370 define "consumer health data" broadly, and both can treat precise location information as consumer health data in some circumstances.

We publish a separate Consumer Health Data Privacy Policy covering the disclosures those laws require — the categories we collect and why, our sources, what is shared and with whom, the complete list of third parties and affiliates, our geofencing commitment, and how to exercise your rights. The summary below is the short version; that notice governs.

Homebound is a safety app, not a health app. We do not collect health conditions, diagnoses, treatments, medications, biometric data, reproductive-health information, or gender-affirming-care information, and we do not attempt to infer any of those from your trips.

Even so, because your trip destinations and precise coordinates could in principle reveal something about health, we want to be explicit:

• What we collect and why: The location data described in Section 1.4, collected solely to deliver the trip-safety, SOS, live-location, Circle, Find, meetup pin, Discover, and weather features you use.
• Who can view it: The people you designate can view it: your safety contacts for a trip (and anyone they forward the trip's tracking link to); the other members of a group trip you join and, for your SOS location and your latest check-in on the tracking page, their safety contacts; the friends in a Circle you share with; and the audience chosen for a trip you or another member publishes. The service providers in Section 3.3 process it on our behalf.
• We do not sell it. We have never sold consumer health data and we will not. Washington and Nevada both require your separate written authorization before any such sale; we do not seek one because we do not sell.
• Your rights: You may confirm whether we collect, share, or sell your consumer health data; access it; obtain a list of the third parties it has been shared with; withdraw consent to its collection and sharing; and have it deleted. To exercise these rights, email privacy@homeboundapp.com. We respond within 45 days, with one 45-day extension where permitted, and you may appeal a denial as described in Section 6.7.
• Deletion: On a verified deletion request we delete the data from our live systems and direct our processors to do the same.

6.9 How We Handle Privacy Requests

Where to send them. privacy@homeboundapp.com, or the postal address in Section 10. Requests made from the email address on your Homebound account are the fastest to verify.

Verification. To protect you, we verify that a request actually comes from you before we act on it. Normally that means confirming that the request comes from — or can be confirmed at — the email address on the account, which is also the credential you use to sign in. For requests seeking specific pieces of sensitive information, or for deletion, we may ask you to confirm details we already hold. We use information you give us for verification only for that purpose, and we do not create new accounts or collect new data in order to verify you. If we cannot verify a request, we will tell you, and we will treat an unverifiable access request as an opt-out request where the law directs us to.

Timing.

• We acknowledge requests within 10 business days of receipt.
• We respond substantively within 45 calendar days. Where the law permits and the request is complex, we may extend once by a further 45 days (or, for EU/UK requests, by up to two further months) and we will tell you why within the original window.
• For EU/UK requests under Section 6.2 we respond within one month, extendable as GDPR Article 12(3) allows.

Cost. Free. We may charge a reasonable fee, or decline, only for requests that are manifestly unfounded or excessive, particularly repetitive ones — and we will explain why before doing so.

Appeals. See Section 6.7. EU, UK, and Swiss users may also complain to their supervisory authority (Section 6.2); Canadian, Australian, and New Zealand users to the regulators named above.

7. Age Requirements

Homebound has different minimum age requirements based on your region:

Homebound is no longer offered in the European Union, the EEA, Switzerland, or the United Kingdom. As of 27 July 2026 the App was removed from those App Store storefronts, and new accounts cannot be created from those regions. The thresholds above are retained because a small number of accounts created before that date remain active, and everything in this document — including the rights in Section 6.2 — continues to apply to them for as long as they use Homebound.

How we determine your region — and its limits. We use your App Store storefront country as a starting point, because it is the signal available to the App. A storefront is not the same thing as where you live, and the law that protects you depends on where you are, not where your Apple account is registered. So:

• The storefront only ever sets a default. It never reduces the protection you are entitled to.
• If you live in the EU, EEA, Switzerland, or the UK but use a different storefront, the rights in Sections 6.2 and 8 still apply to you in full, and we will apply the age threshold for your actual country of residence.
• If your storefront and your residence differ, tell us at privacy@homeboundapp.com and we will correct the region on your account.
• Quebec. Your storefront can't tell us where in Canada you are, so we rely on the age you give us. If we learn that an account belongs to someone in Quebec who is under 14 without a parent's or guardian's consent, or under 13, we delete it, as described below.

How we know your age. Two ways, and the more protective one wins. If you allow it, iOS tells us the age range Apple holds for your Apple Account, which for a child account is the one a parent set (Section 1.1); if you share a range when you sign up, we record the youngest age in it as your age instead of asking you to type one. Otherwise you enter an age yourself. If your age and Apple's range disagree in a way that matters, we apply whichever indicates you are younger.

Users below the minimum age. We do not knowingly collect personal information from users who do not meet the minimum age requirement for their region. If we learn that an account belongs to someone below that age, we delete it and the associated data without waiting for the 30-day grace period (Section 5).

Parents and guardians. If you are a parent or guardian and believe your child has provided us with personal information, email privacy@homeboundapp.com. We will:

• Confirm receipt within 10 business days;
• Delete the account and its data, without the 30-day grace period, once we have verified the request;
• Confirm to you in writing when it is done.

We will not require you to create a Homebound account, or to provide more information than we need to verify the request, in order to do this.

Extra protections for users under 18. Homebound is a location-sharing app, so accounts that tell us they are under 18 are limited in what they can publish, and in what others can publish about them. We apply these limits in the App and when our servers save and show published trips, and they cannot be turned off:

• No global publishing. A trip that an under-18 user owns or publishes goes to friends only. If a global audience is requested, we save it as friends-only instead. A trip an under-18 user published to everyone before these limits existed is shown only to their friends and the people on that trip.
• No exact location in the feed. A trip with any member under 18 shows only a general area in the feed, never exact points, whatever the person publishing it chooses. A member here means the trip's owner, anyone who joined it as a participant, and anyone who checked in or added a photo to it. If exact location is requested, we save the generalized setting instead. We also apply this rule each time the feed is shown, so it covers a member whose age we learn after the trip was published.
• Hidden from people who are not their friends. On any published group trip, including an adult's trip published with global visibility, an under-18 member's name, photo, and account are shown only to their own friends and to the people on that trip. Anyone else who can see the post sees them counted among the trip's members, but not who they are. The same goes for comments and reactions: on any post, an under-18 user's comments and reactions, and any @mention they make, are left out for anyone who is not their friend and was not on that trip.

These limits apply to the per-trip setting, the account-wide default, and trips published automatically at checkout.

What is not restricted, and why. Live location sharing during a trip, and Circle sharing, still work. The App shares them with the trip's safety contacts and members, and with the friends the user chose, and they are the safety features the App exists to provide. Once a trip is overdue, its tracking page also shows the trip owner's live position to anyone with the link (Section 1.4). Turning them off for minors would remove the protection a parent most likely wants. Find, meetup pins, check-in photos, and check-in requests and messages are not restricted either. Find, meetup pins, and check-in requests and messages reach only the people on the same trip and the trip's safety contacts. Check-in photos are seen by the trip's members, by anyone with the trip's tracking link (which shows the latest photo), and, for the photos shared on a published trip, by the trip owner's friends; and, while the trip is in progress, by friends who are its safety contacts, in the App.

A note for parents. Two things already limit contact from strangers: becoming someone's friend requires both people to exchange an invite link (there is no way to search for a user or send an unsolicited friend request), and only friends can comment on or react to a trip. If your child uses Homebound, we still encourage you to review Settings > Privacy together, and to talk about who belongs in their Circles. You can ask us to delete their account at any time using the process above.

8. International Data Transfers

Our servers are located in the United States. If you access the App from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country.

For EU/EEA/Swiss Users: We rely on Standard Contractual Clauses (SCCs) approved by the European Commission to ensure adequate data protection for transfers to the United States.

For UK Users: We rely on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs for transfers to the United States.

For Canadian Users: We ensure transfers comply with PIPEDA requirements for cross-border data transfers.

For Australian Users: We take reasonable steps to ensure overseas recipients handle your information consistently with Australian Privacy Principles.

For New Zealand Users: We ensure transfers comply with the Privacy Act 2020 requirements.

Sub-Processors

The providers that process personal information on our behalf — Render, Supabase, Cloudflare, Resend, Apple, and Canny — each handle it under their data processing terms, which require them to protect it in accordance with applicable data protection laws, to act only on our instructions and for the purposes we have specified, and not to use it for their own purposes. Where the law requires a data processing agreement, we have one in place.

The remaining providers in the table above are sent nothing that identifies you: the geocoding, weather, and place-search services receive location coordinates only, with no name, email, or account identifier, and several of them are public or government services that we query without any commercial relationship. CARTO, unpkg, and Google are different: we send them nothing ourselves, but the browser or device of someone viewing a trip's tracking page or an invite page, or opening a map link in one of our emails, contacts them directly, so they receive that person's IP address, and CARTO and Google Maps also receive the map area or coordinates being viewed.

9. Your Consent & Changes to This Privacy Policy

9.1 How We Record Your Consent

This Privacy Policy and our Terms of Service are versioned separately. Each is identified by the "Last Updated" date at the top of that document.

You are asked to accept both documents when you create your account and complete your profile. When you accept, our servers record, against your account, which version of each document you accepted and the date and time you accepted it. The version recorded is the one published on our servers at that moment — it is not supplied by your device.

You can review your consent record — whether consent is on file, and the version accepted, for each document — at any time in Settings > Privacy. It is also included in the data export described in Section 6.

9.2 When We Ask You to Consent Again

We may update this Privacy Policy from time to time. When we do, we update the "Last Updated" date at the top.

If the "Last Updated" date of either this Privacy Policy or our Terms of Service is newer than the version you last accepted, the App shows you a full-screen notice the next time it loads your profile. That notice tells you which document changed, links to both documents, and asks you to agree before you continue using the App. Because the two documents are versioned independently, a change to one is not described as a change to the other: if only the Terms of Service change, the notice says so.

Agreeing records the current version of both documents. If one of them has not changed since you last accepted it, its original acceptance date is kept, so your record continues to reflect when you actually agreed to each version.

If you have withdrawn consent. Agreeing through this notice is also how you give consent again. If you had withdrawn consent (Section 6.2), agreeing clears your withdrawal, records a new acceptance date for both documents, and turns Restrict Processing off, so normal processing resumes. If you want processing to stay paused, you can withdraw consent again in Settings > Privacy after agreeing. If you turned on Restrict Processing without withdrawing consent, agreeing leaves it on.

This prompt depends only on the versions of these documents. It is independent of your App version, and updating the App does not by itself change your consent record.

9.3 If You Do Not Agree

If you do not wish to accept an updated Privacy Policy or Terms of Service, stop using the App and delete your account through Settings > your name > Delete Account, or through Settings > Privacy > Data Requests > Delete My Account if you want the 30-day grace period (Section 5).

You may also withdraw consent for non-essential processing at any time (Section 6) without deleting your account. If you do, your account remains active for the core safety functionality — such as notifying your emergency contacts if you become overdue — because that processing is performance of the contract between us, not something you consented to separately. Withdrawing consent pauses non-essential processing (Section 6.2) until you give consent again, either in Settings > Privacy or by agreeing to an updated version of this policy (Section 9.2). The features that rely on consent (Trip Live Location Sharing, Circle sharing, and Find) have their own controls, and using them is how you withdraw consent to those features. None of this affects processing that already happened.

We ask for your agreement through the in-app notice described in Section 9.2. Simply continuing to use the App is not how you accept an updated policy, and we do not treat it as acceptance.

10. Contact Us

Homebound LLC is the controller of the personal information described in this policy.

If you have questions about this Privacy Policy or our privacy practices:

Email: privacy@homeboundapp.com Postal: Homebound LLC, 1518 Lake Front Ct, Park City, UT 84098, United States

The same address handles California privacy rights, other U.S. state privacy rights and appeals (Section 6.7), consumer health data requests (Section 6.8), EU/UK/Swiss GDPR requests (Section 6.2), and requests from non-users (Section 11). You do not need to use a particular form of words — just tell us what you want.

11. Emergency Contacts and Other People Who Are Not Homebound Users

Homebound users can add other people as emergency contacts by entering a name and email address. If someone has added you, we hold your name and email address even though you never signed up. This section is for you.

Where your information came from. A Homebound user entered it. We did not obtain it from you, and we did not buy it from anyone. The email you received tells you who added you.

What we hold. Your name, your email address, the trips you have been designated a contact for, and the delivery records for messages we sent you. Nothing else. We do not have your phone number, we do not read your device contacts, and we do not build a profile of you.

What we do with it. We use it for one purpose: sending you the safety messages the user asked us to send — trip created, trip started, check-in, ETA extended, trip completed, trip cancelled, a group-trip member arriving home, overdue alert, overdue all-clear, SOS alert, and SOS location follow-up. Some of those messages include the user's location, and most include a link to a page showing the trip's status and the location of the most recent check-in (or, before the first check-in or when the latest check-in has no location, the trip's destination). We do not send you marketing, we do not sell your information, and we do not use it for anything else.

Our legal basis (if you are in the EU, EEA, UK, or Switzerland) is our legitimate interest, and the user's, in your being able to act if they do not come back safely. We are the controller for this processing, and this section is our notice to you under Article 14 of the GDPR.

How long we keep it. Until the user deletes you as a contact or deletes their account, or until you ask us to remove you — whichever comes first.

Your rights. You do not have to accept being someone's emergency contact, and you do not need their permission to opt out. You can:

• Stop receiving messages. Email privacy@homeboundapp.com from the address that received them and say you want to be removed. (Our automated messages are sent from a no-reply address, so please write to privacy@ rather than replying.) We will remove you from the trips you have been added to and tell the person who added you. You do not need to give a reason.
• Ask what we hold about you, and get a copy.
• Correct your name or email address.
• Object to the processing, or ask us to restrict it.
• Have your details erased. We will delete them and tell the user that a contact was removed, without telling them anything about you beyond that.
• Complain to your data protection authority (see Section 6.2) or your state Attorney General.

Email privacy@homeboundapp.com and say what you want. We handle these on the timelines in Section 6.9 and we will not ask you to create an account to do it.

If you think someone is misusing this. If a Homebound user is adding you as a contact to harass you, or you believe the App is being used to track or intimidate someone, email privacy@homeboundapp.com and tell us. We will remove you from the trips you were added to, tell the person who added you, and act on the account under our Terms of Service.

This Privacy Policy is effective as of October 10, 2026.