Last updated: July 27, 2026
This is the Android policy. The iPhone version of HomeSafe is a different build with different data flows — it syncs community reports through Apple’s public CloudKit database, uses Apple Maps and WeatherKit, and carries an Apple account identifier on each public record. None of that exists in the Android app. Its policy is at /privacy/. Where the two differ, the difference is real, not editorial.
HomeSafe has no account, no sign-in, no advertising identifier, and no analytics of our own. There is no HomeSafe server. Every route score, safety signal, contact, saved place, trip snapshot, journal entry, community report and Bestie conversation is processed and stored on your device only.
Two things leave the phone because you asked for them: the map/routing/weather lookups the app needs to work at all, and — if you switch it on — a Guardian Live-Link. One more thing is in the app that we did not write and do not control, and we would rather name it than let you find it: see “Google Play Billing brings its own components”.
HomeSafe does not contact emergency services on your behalf, does not relay or forward your location to 112, 1091, 1098, 181 or any other emergency line, and has no partnership of any kind with any emergency service. It pre-fills the system dialler; you place the call.
The app sets android:allowBackup="false" and ships res/xml/data_extraction_rules.xml that excludes
every storage domain from both Android Auto Backup and device-to-device transfer. The operating
system therefore does not copy HomeSafe’s data to your Google account or to a new phone.
The honest cost of that promise: if you lose, reset or replace this phone, what HomeSafe stored is gone. We consider that the right trade for an app that holds your home address and your trusted contacts’ phone numbers.
These requests go from your phone to these providers. They never pass through GenesisCipher Labs, and like any web request they show that provider your device’s IP address and roughly the area you are asking about.
| Purpose | Service |
|---|---|
| Address search / geocoding | Nominatim (nominatim.openstreetmap.org) |
| Route geometry | FOSSGIS OSRM (routing.openstreetmap.de) |
| Street lighting, crossings, points of interest | Overpass (overpass-api.de) |
| Map tiles | OpenStreetMap tiles, OpenFreeMap (tiles.openfreemap.org) |
| Temperature, rain outlook, air quality | Open-Meteo (api.open-meteo.com, air-quality-api.open-meteo.com) |
| Guardian Live-Link transport (opt-in only) | ntfy.sh |
Premium is sold through Google Play, so the app includes Google’s Play Billing library. That library
does not arrive alone. Google ships it bundled with its own DataTransport components
(com.google.android.datatransport, including the transport-backend-cct uploader and the
com.google.firebase:firebase-encoders wire encoders) and with parts of Play Services
(play-services-base, play-services-basement, play-services-tasks, and — despite HomeSafe using
none of it — play-services-location and play-services-places-placereport).
What that means, stated plainly:
play-services-location is linked but never called. HomeSafe’s location comes from the Android
framework LocationManager, not from Google Play Services. The library is present only because
Play Billing depends on it. It is not a second location pipeline.If you never open the Premium screen, none of this changes what HomeSafe itself does with your data: your places, contacts, journal and flags still never leave the phone.
The mic button in the Bestie chat is optional and only active while you hold it. HomeSafe hands the
audio to your phone’s own speech-recognition service and asks it to work offline
(EXTRA_PREFER_OFFLINE), so that nothing leaves the phone where the system supports it. HomeSafe
itself never records, stores or uploads your audio, and the button only appears when your phone has a
recognition service at all.
We will not over-promise here: on Android, “prefer offline” is a request, not a guarantee. Whether the transcription actually stays on the phone is decided by that system service, and on some devices your speech may be sent to its provider to be transcribed. The transcript becomes a message only when you tap Send.
Reports you submit stay on this device. Unlike the iPhone version of HomeSafe, the Android app has no shared reports database: your flags are never uploaded, never shown to other users, and carry no account, device or advertising identifier anywhere — because they never leave your phone.
HomeSafe stops showing and stops counting a report after 90 days and deletes it from the device the next time it reads them.
If you choose to share a live trip link, HomeSafe publishes your live position, remaining ETA and distance, safety score, transport type and a destination label to ntfy.sh — a free, account-less public messaging service — on a channel named by an unguessable 160-bit token that is also the link.
| Permission | Why |
|---|---|
| Location (fine/coarse) | Scoring the route you are actually on, live navigation, and the location you choose to share. Never uploaded to us. |
| Microphone | Only while you hold the Bestie mic button (see above). |
| Notifications | Trip check-in prompts. |
| Internet / network state | The services in the table above. |
| Vibrate | The on-device Fake Call ring (simulated; no telephony). |
Settings → Privacy & data:
There is nothing to request from us, because we hold nothing.
Premium is billed by Google Play. We never see your card. Premium never buys a safer score, a faster check-in or a different way to reach help — every safety surface is identical whether or not you pay.
HomeSafe is not directed at children under 13.
If this policy changes materially we will update the date at the top and, where the change affects what leaves your device, say so in the app’s release notes.
GenesisCipher Labs — genesiscipherlabs@gmail.com