Privacy policy

Last updated 15 October 2026

Guardian Star is a daily check-in. It lets your family know if you miss one. It is built to know as little about you as possible.

What we keep

A random ID for you and for your iPhone, and your iPhone's public key, which proves requests come from it.
The name you choose to show your family, your time zone, your check-in times (one to three a day), and how long to wait before your family are told.
Signs of life: when one happened, what kind it was (for example "steps" or "tapped I'm OK"), and your battery level. Your family list sees these. If your battery is low and not charging, each of them is told (at the level they chose, once a day at most), and if your phone may have died (a nearly empty reading, then two hours without a word from your phone), that too; each Sunday they get a short note about how your week went. Every morning, and before saying your phone may have died, your server sends your iPhone a silent nudge, with no words in it, which lets Guardian Star run for a moment in the background.
If someone on your family list turns their alerts off after several missed days in a row, that choice, until you next check in.
Who is on whose family list, the alerts that were sent, and who answered them. A note added when closing an alert is passed on to the others who were told (with Guardian Star Plus, by text too), and isn't kept by Guardian Star once it has been delivered.
Hearts and short notes that family send to the person they look out for: who sent each one and when, kept for a week and shown only to that person (each family member sees just their own). That person can turn them off in Settings, which also deletes the ones kept.
Your iPhone's notification address from Apple, so alerts can reach you.
If you ask someone to try Guardian Star, the code of the link you sent, and when it was used and by whom (kept until 30 days after the link expires).
With Guardian Star Plus: whether someone has it, and from Apple only the subscription's state and dates (never payment details). The phone numbers added for Plus's texts and calls, encrypted, with the name given for someone added by text, whether each number has joined (texted JOIN) or said STOP, and for 90 days when each text or call went and whether it arrived. Each alert text (and email) has a link, made for the person it went to and that alert, that lets them say they're on it: which link is whose is kept until a day after it stops working, 48 hours after it was made.
With Guardian Star Plus's emails: the email addresses added for them, encrypted, with the name given for someone added by email, whether each address has said yes or stop, whether an email to it bounced, and for 90 days when each email went. If someone asks never to be emailed, a one-way code of their address (not the address) is kept, so that no invite reaches them again; and for 30 days after an invite, a one-way code of the address and how many invites it got, so nobody can be asked too often.
With Guardian Star Plus, if you fill one in: your emergency card (your address, how to get in, someone nearby to call, pets and anything else you write), encrypted. Only your family list can see it, and only while you have Plus. It asks for nothing medical. You can change or delete it at any time.
When each notification reached your iPhone: as one arrives, the app sends our server its code. The person who checks in sees whether their alerts and test runs reached each family member's iPhone, and each family member sees whether they reached their own. If the first person told about an alert doesn't get it, the others on the list are told that too.
For each day, how many check-ins were on time, late or missed, and how each alert ended, counted without names so we can check that Guardian Star works.
Which version of Guardian Star your iPhone has and when it last reached our server. To stop people guessing codes or setting up many fake accounts, the network address of some requests (for example a wrong invite code, or a new iPhone setting up) is kept for two days.

What stays on your iPhone

Step counts, motion data and (if you turn it on) Apple Watch heart rate are read on your iPhone only. Our server is sent just the time and the kind of each sign of life, never your steps, movements or heart rate.
When you invite someone from your contacts, their name and number stay on your iPhone. The invite is sent from your own Messages app; our server knows only the invite code. (With Guardian Star Plus, someone you add by text is different: their name and number go to our server, so Guardian Star can text them once they've joined.)
Phone numbers that family members add for the Call button stay on their own iPhone and are never sent to our server. (Numbers for Guardian Star Plus's texts and calls are different: see above.)

What we never collect

No location, photos or health data, nothing from your contacts, and no phone numbers or email addresses except those added for Guardian Star Plus's texts, calls and emails. No advertising, no tracking across apps (Guardian Star's emails have no tracking images or links), and we never sell or share your data for marketing.

If you write to us

Send feedback (in Settings) opens an email to us in your own Mail app, with the app's version and your iPhone's iOS version. If Guardian Star closed unexpectedly on your iPhone in the last two weeks, the email also has a short technical note of what happened, with no names, check-ins or anything you typed. You see everything in it before you send it, and we get your email address only if you do. We use what you send only to answer you and to fix Guardian Star.

Who helps us run it

Cloudflare hosts the server and stores the data above. Apple delivers notifications and handles Guardian Star Plus subscriptions. With Plus, Twilio sends the texts and makes the calls: it gets each number and what the text or call says, and keeps its own record of them. Resend sends Plus's emails: it gets each address and what the email says, keeps its own record of them, and tells us whether each one arrived. None of them may use your data for anything else.

We never sell, rent or share phone numbers or email addresses, or anyone's agreement to get texts or emails, with anyone for their marketing. All the above categories exclude text messaging originator opt-in data and consent; this information won't be shared with any third parties.

How long we keep it

Check-ins are kept for about 90 days (the history in the app shows up to 90), the record of which notifications arrived for 90 days, hearts and notes for a week, and alerts and the daily counts for about a year, then deleted. A number or address for Plus's texts and emails is deleted as soon as it's taken off the family list, or when its owner stops looking out for anyone. You can delete everything at any time in the app: Settings, then Delete everything. It is removed at once, and your family list stops seeing you. All that stays is a count that one more person deleted everything, with nothing about you attached.

Not an emergency service

Guardian Star can't detect falls or emergencies and doesn't contact emergency services. If someone may be in danger, call 911.

Children

Guardian Star is meant for adults.

Questions or requests: xwisniewski2@icloud.com.

If this policy changes, the new version will appear on this page with a new date.