Privacy Policy

Updated September 11, 2026

This policy explains how unwavering.band (“we”, “us”) handles your information. The product is built so that precise location history is encrypted on your device before storage. We design the system so that operators with database access cannot read your coordinates in the clear.

Who we are

unwavering.band is operated by Johnny Outlaw LLC / DataDay Studio. Contact: support@unwavering.band (forwards to the operator). Support page: unwavering.band/support.

What we collect

• Account. Email address, display name, optional avatar URL, and sign-in provider (Google and/or email).
• Encryption metadata. A salt, wrapped data-encryption key, and public key material. These do not reveal your passphrase or plaintext locations.
• Location history. Coordinates and times from imports (for example Google Timeline) and optional live readings you choose to share. Coordinates are stored as ciphertext when encryption is enabled.
• Named places. Labels you attach to locations (coordinates encrypted; names stored so you can find them).
• Relationships. Who you invited or accepted, your privacy tier per person, and encrypted daily share payloads used to compute distance over time.
• Usage. Standard hosting logs (IP, user agent) from Vercel may be processed for security and reliability.

How encryption works

You choose an encryption passphrase (separate from your sign-in password). Your device derives keys from that passphrase and encrypts coordinates with AES-GCM before they are written to our database. We do not receive your passphrase. If you forget it, we cannot recover your history.

How we use information

• To show your own timeline after you unlock encryption.
• To show live presence on the “Now” canvas when you opt in to share location.
• To compute distance-over-time charts with people you explicitly connect with, under the privacy tier you set for each person.
• To operate, secure, and improve the service.

Privacy tiers with other people

For each relationship you control what they can see of you:

• Distance only. The official app shows miles apart. Technical note: distance still requires position shares on an encrypted channel between the two of you; a modified client could recover more detail. Choose a stricter tier only with people you trust.
• City / state (coarse). Miles plus a coarse place.
• Exact. Miles plus finer location and any named place match you allow.

Sharing

We do not sell your personal information. We use processors that host the app and database (currently Vercel and Supabase). They process data under contract to provide the service. Encrypted location payloads remain ciphertext at rest in the database.

Retention and deletion

We keep your account and encrypted history until you delete them. You can delete your account and all unwavering.band data from Settings. Turning off live sharing clears live coordinates. Withdrawing consent for live sharing does not automatically delete imported history; use account deletion or contact support for a full wipe.

Children

The service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has created an account, contact us and we will delete it. For App Store age ratings we treat the product as 17+ because it involves ongoing location sharing between people.

Your choices

• Do not enable encryption or import history if you prefer not to.
• Opt in or out of live location sharing at any time.
• Set privacy per relationship.
• Delete your account from Settings.
• Export: you may download your Google Timeline from Google; we do not yet offer a portable export of decrypted history from this app.

Background location (native apps)

The iOS and Android apps can keep sharing your location while the app is in the background, similar to Find My. This is opt-in: turn on “Share where you are” in Settings and grant Always location permission when the system asks. Turning sharing off stops background tracking and clears your live coordinates.

While background sharing is on, the app periodically writes your recent position into your account (visits and live last-known coordinates) so people you share the Now canvas with can still see your band. Google Timeline history you upload remains covered by the vault encryption model above. You can revoke Always permission in system Settings at any time.

Changes

We may update this policy. The “Updated” date at the top will change. Continued use after an update means you accept the revised policy.

Contact

Privacy questions: support@unwavering.band or /support.