Privacy policy

The short version

• We use your information to run Farwatch and for nothing else.
• We don't sell it, don't show ads, and don't use analytics services or tracking cookies.
• A trip plan is seen by the people the traveler sends it to, and by anyone they share its link with.
• You can delete your account in the app, or by email without it. Anyone else can ask us to remove their details at privacy@farwatch.app.

Who this is about

These kinds of people can have information in Farwatch:

• Travelers have an account and write trip plans.
• Watchers are the people a traveler sends a plan to. They don't have an account; the traveler enters their name and email address.
• Emergency contacts are named on a plan by the traveler, with a phone number. Farwatch never contacts them.
• People named in attachments. A traveler can attach files, such as a group's own trip plan, which may list other people.

If you're a watcher or an emergency contact, the traveler chose to add you. We didn't get your details from anywhere else.

What we collect

If you have an account

• Your name and email address. Your password is handled by Amazon Cognito, the sign-in service we use. The app sends it straight there, and our own servers never see it.
• What you put in your trips: the trip's name, description and notes, the area or route, starting point and map link, start, turnaround and return times, how long to wait before the trip counts as overdue, and when you mark it back safe or cancel it.
• The name, phone number and notes for a trip's emergency contact.
• The names and email addresses of the watchers you add. Each one is also saved to a contact list kept with your account.
• Files you attach: images or PDFs, up to 10 MB each.
• If a watcher stops trip plans from you and says they don't know you, a note of that, kept with your account. It isn't shown to you. It is there so we can spot an account that adds people who don't know it.

If you subscribe to Farwatch Plus

When your subscription runs out, which store you bought it through, whether it was a test purchase, and when we last checked. We get these from RevenueCat, described under Service providers below, rather than from you. Apple or Google take the payment, and we never see your card or payment details.

If you're a watcher

• The name and email address the traveler entered for you, on each trip they add you to and in that traveler's contact list. Only that traveler's account uses their list.
• When the plan was emailed to you, and when you confirmed you read it or told the traveler you can't watch that trip.
• If you stop trip emails from one traveler or from everyone, a record that you did, and, if you said you don't know that traveler, that you said so. It holds a fingerprint of your email address rather than the address: a code worked out from it that we compare against addresses we're about to email. It isn't anonymous, since anyone with your address could work out the same code, but it keeps the record from being a list of addresses.
• If you mark an email from Farwatch as spam, the same record as stopping trip emails from everyone, made for you. Our email provider stops sending to an address that does that, and the record is how the traveler finds out you can't be sent trip plans.
• If our email provider tells us your address doesn't accept email, or that it has stopped sending to it, a fingerprint of the address, made the same way, and which of the two it said. The traveler who added you is told your address doesn't accept email when that is the reason, and otherwise only that you can't be sent trip plans.

The plan page doesn't ask you to sign up, doesn't set cookies, and answering doesn't record your device or location.

If you're an emergency contact

The name, phone number and any notes the traveler entered for you.

Collected automatically

• Your device's time zone, recorded when you create a trip, so the dates in the plan email read in the trip's time zone. It is erased with the rest of a trip's contents when you delete your account.
• The days you use the app. When you're signed in, we note the date you used Farwatch, but not the time or what you did. We use it only to count how many people use Farwatch and how often. It is deleted when you delete your account.
• IP addresses, briefly. To stop abuse, we count requests by IP address when someone opens or answers a plan or opens its files, and when a signed-in traveler creates a trip or adds a file. Those counts expire after a few minutes, or after about an hour for trips and files, and are then deleted automatically, normally within a few days.
• Server logs, kept for 30 days. They record which part of the service ran, internal IDs and error details. When something fails, those details can include what was being saved or sent, such as a trip's text or a name or email address. They don't record IP addresses.
• Error reports from the app and from farwatch.app, described under Service providers below.

How we use it

We use this information only to:

• Show plans to the traveler and to their watchers.
• Send the emails the service consists of (listed below).
• Keep the service working, find and fix errors, and prevent abuse.
• Check whether you have Farwatch Plus, and show you when it runs out.
• Count how many people use Farwatch and how often, as totals rather than per person.
• Answer requests you send us.

Farwatch sends email only when a person does something. Those emails are: sign-up and password-reset codes to a traveler; a plan to each watcher when the traveler sends it, except one who has stopped these emails; a “back safe” note to those watchers when the traveler marks the trip finished; a “trip cancelled” note to them if the traveler calls the trip off; and a “plan withdrawn” note if the traveler deletes their account before the trip is over. We don't send marketing email.

Who can see a trip plan

• The watchers the traveler sends it to. Each gets an email with the trip's name, dates and area, and a private link to the full plan. The full plan includes the starting point, notes, emergency contact and attachments. The email shows the traveler's name, and replying to it reaches the traveler's email address.
• Anyone who has the link. The link works like a key, and there is no sign-in behind it. Forwarding it shares the plan. That's partly intended: a watcher who is worried should be able to hand it to search and rescue. But keep it as private as the plan itself.
• Watchers don't see each other's names or email addresses.

Service providers

A few companies process information on our behalf, only to provide their part of the service:

• Amazon Web Services hosts everything: the database, file storage, sign-in and email. It all runs in the United States.
• Sentry receives error reports from the app and from farwatch.app. A report describes the error, the device type, operating system and app version, and the recent screens, taps and requests leading up to it. A report from the app also carries a random ID that Sentry's software creates for the installation, which isn't linked to your account. We've turned off Sentry's collection of personal details and remove plan links from these reports. Like any web service, Sentry can still see the IP address a report arrives from. It keeps reports for a limited time under its own retention policy.
• Expo delivers updates to the app. When the app checks for an update, Expo sees the request, including your IP address, your device platform, and a random ID the app creates for its installation.
• RevenueCat keeps track of Farwatch Plus subscriptions for us. The app gives it your account's ID, a random code rather than your name or email address, and RevenueCat receives the purchases Apple or Google report for that account, along with your device's language, region and currency settings. We ask it whether your subscription is active. It doesn't receive your trips, your watchers or your contact list. Like any web service, RevenueCat can see the IP address a request arrives from. It keeps purchase records under its own retention policy, and we ask it to delete yours when you delete your account.

Apple and Google handle downloading the app, and paying for Farwatch Plus, under their own privacy policies. We don't share information with anyone else unless the law requires it.

How long we keep it

Your account and trips stay until you delete them, except for attachments, which are described below. Deleting works differently depending on whether anyone was sent the plan:

• A trip nobody was sent is deleted completely, attachments included.
• A trip that was sent can be deleted once you've marked it back safe or cancelled it. It disappears from your app, but we keep it so the links your watchers hold keep working. That is deliberate: the plan may be needed by search and rescue long after the trip. Its attachments are kept only as described below. To have a sent trip removed completely, email us.

Attachments are deleted 90 days after a trip ends, which is when it is marked back safe or cancelled. The plan itself, and the links your watchers hold, stay as described above, and so does each file's name, so the plan can show that a file was there. A trip that is never marked back safe or cancelled hasn't ended, so its attachments are kept. For a trip that ended before October 15, 2026, the 90 days count from October 15, 2026.

If you subscribe to Farwatch Plus, the attachments on trips you created are kept for as long as you subscribe. When your subscription ends, they are kept for 30 more days, and after that the rule above applies: a trip's attachments are deleted 90 days after it ends, so any already past that point are deleted then, and a trip that hasn't ended keeps them. A deleted file can't be brought back, including by subscribing again.

Your contact list stays until you delete your account, which deletes it. A trip keeps the name and email address each watcher was added with, even if they later leave the list.

A watcher's “stop”. Stopping trip plans from one traveler lasts until you undo it from the link in a plan email, or until that traveler deletes their account. Stopping trip emails from everyone lasts until you undo it, and we keep it even if you ask us to remove your details, because it is how we keep honouring your request not to be emailed.

A spam report or an undeliverable address. Either record lasts until you ask us at privacy@farwatch.app to email you again. We then take your address off our email provider's list of addresses it won't send to, and remove both records. We do that only when the request comes from the address itself, since the record that came from a spam report also stops trip emails from everyone.

Deleting your account (Account tab in the app, or by email if you don't have the app) deletes every trip nobody was sent. It withdraws every trip that was sent: the plan's contents, emergency contact and attachments are erased, and the link shows only that you withdrew the plan. Watchers of a trip that isn't over are emailed to say so, unless they have stopped Farwatch's emails. If you ever subscribed to Farwatch Plus, we also ask RevenueCat to delete its record of your purchases. Deleting your account doesn't cancel a subscription, which you do in the App Store or Google Play. What remains is:

• An emptied record of each withdrawn trip, holding only internal IDs and dates.
• The names and email addresses of watchers who were sent a plan, which lets their link show that it was withdrawn.
• A record that the account was deleted, holding internal IDs and no names.
• If we ever suspended your account or changed its limits, a record that we did and when, holding internal IDs and no reasons.

Deletion records. When you delete a trip, a watcher or a file, we keep a short record of it, including its name, while your account exists. Deleting your account removes the names from those records.

Backups and logs. Deleted information can remain in database backups for up to 7 days, and so can the previous copy of a file that was removed or replaced. So that restoring a backup cannot undo a deletion, we also keep a short note of each one for 8 days, and of each opt-out or block and each reversal of one. A note about an opt-out or block, or its reversal, includes the watcher's email address. These copies are cleared on a schedule, so clearing them can take a few days longer. Deleted information can remain in server logs for up to 30 days. Messages sent to privacy@farwatch.app are held for 30 days on the way to our inbox. We keep our correspondence with you as a record of your request.

Your choices and requests

In the app you can edit a trip until you send it, delete trips as described above, and delete your account. For anything else, email privacy@farwatch.app. You can ask us to:

• Delete your account, if you can't do it in the app. Deleting your account has the steps, including how we check the request is yours.
• Send you a copy of the information we hold about you.
• Correct something that's wrong.
• Remove a sent trip completely.
• Remove you from someone's trip, if you're a watcher or an emergency contact. We'll delete your name and contact details from that trip, and from that traveler's contact list. For a watcher, your link stops working.
• Delete an attachment that contains your information.

We may reply to the address you wrote from to confirm the request is yours. We answer within 30 days, and there's no charge. You don't need an account to ask.

Emails from Farwatch. Plan emails are sent because a traveler sent a plan or updated a trip, not from a mailing list. If you don't want them, open any plan someone sent you: at the bottom you can stop trip plans from that traveler, or trip emails from everyone, and undo either later from the link in a plan email we sent you. A link a traveler passed on to you themselves can stop that traveler's trip plans and nothing more: stopping trip emails from everyone, and undoing either stop, need the link in your plan email, since the traveler holds the shared link too. The travelers on an affected trip are told only that you can't be sent trip plans, not which you chose, though someone who tried adding you to other trips could work it out. You can also email us and we'll do it for you.

Attachments

We store attached files exactly as uploaded and don't open, read or analyze them, so we can't tell who is named inside one. If you attach a file, only include other people's information you have their permission to share.

Security

Everything travels over encrypted connections (HTTPS), and it's encrypted where it's stored: the database holding your account, trips and contacts, and uploaded files. Access to the systems holding your information is limited to what running Farwatch needs. No system is perfectly secure. If a breach affects your information, we'll tell you as the law requires.

A plan's link is the one thing that grants access to it, so treat it like a key.

Children

Farwatch isn't meant for children under 13, and we don't knowingly collect their information. If you believe a child has given us theirs, email privacy@farwatch.app and we'll delete it.

Changes to this policy

When this policy changes, we'll update this page and the date at the top. If a change affects how we use information we already hold, we'll also tell account holders before it takes effect.

Contact

Questions and requests about privacy go to privacy@farwatch.app.