Safety & privacy
Who sees your SOS, and for how long.
To be useful, an emergency message has to reach strangers' phones. Here is exactly what ResQNet protects, what it can't, and how long it keeps things.
Signed, not encrypted
Each phone holds its own signing key in the platform keystore. Every SOS carries a signature over its text, location, hop limit and expiry. A relaying phone can't change any of these without the signature failing, so receiving phones reject altered copies, and the server checks the signature before crediting a relayed SOS to the person who sent it. The content itself is not encrypted.
Who can see what
- Phones that receive your SOS over the mesh
- Your name, the full SOS message and your exact location. Relays keep a copy until the SOS expires (24 hours by default).
- Your trusted contacts (push notification)
- Your name, the SOS category and your location, never the message or medical details. The notification text is generic: "<name> needs emergency assistance — open ResQNet."
- Your trusted contacts and local numbers (SMS)
- A pre-filled text you send from your phone: category, your name, any message you typed and a location link. Never medical details.
- People notified by the server about a nearby emergency
- The category and an approximate distance only.
- Responders with respond permission
- The exact location and message, while retention allows.
- Staff with monitor permission only
- Location rounded to about 1 km. No message, phone number or notes.
Medical information is opt-in
- Your profile can hold blood group, allergies and medications. These stay in your profile.
- “Include medical information in automatic SOS” is off by default and resets to off whenever anyone signs out.
- When it's on, blood group and allergies (never medications) are added to the signed message of an automatic SOS. Every phone that receives that SOS over the mesh can then read them.
- A manual SOS contains only what you type. Ordinary mesh messages, push notifications and SMS never carry medical details.
How long data is kept
| Data | Retention |
|---|---|
| SOS message, exact location and responder notes | Stops being served 90 days after a responder closes the incident, then redacted |
| Link between an SOS and your account | Removed 730 days after closure |
| Incidents that no responder has closed | Kept; never aged out while unhandled |
| Shared-location chat messages | 30 days |
| Location used for nearby alerts (opt-in) | Ignored and deleted after 30 days without updates |
| Earthquake sensor reports | 30 days |
| Your own sent SOS entries on your phone | Removed 7 days after being sent or closed |
| Other people's SOS relayed through your phone | Dropped at expiry, 24 hours by default |
| Server backups | Can keep deleted data for up to about 8 weeks |
Automated deletion runs once the operator schedules the retention job. Expired SOS data stops being served at expiry even before the job runs.
Account security
Every request that reads or writes your account goes through a signed-in session with short-lived access tokens and rotating refresh tokens. Your data is checked against your account on every request. Google Sign-In is verified with Google by the server, and ResQNet never handles a Google password. You choose who sees your profile photo: private, contacts only or public.
Limitations
What we won't claim.
Security and privacy claims are easy to overstate. These are the current limits.
- Mesh messages are signed, not encrypted. Anyone running ResQNet within range can read an SOS that reaches their phone.
- Copies that reached other people's phones can't be deleted remotely; they expire on those phones.
- Account deletion exists on the server, but there is no button for it in the app yet.
- Trusted contacts can't yet read the SOS text inside the app.
- These retention periods are ResQNet's own operational policy. They have not been legally reviewed, and ResQNet does not claim compliance with any particular law.
Read the full legal detail in our