22:55Privacy policyBeta
Privacy policy for the beta
What the TZX Locate app and its server collect, why, for how long, and who sees it. In plain words, written from what is actually built.
This policy is for the closed beta of TZX Locate. A final policy will replace it before public launch.
Who we are
TZX Locate is a family location-sharing app for iPhone and Android, made by TechZoneX. TechZoneX is the controller of the personal data described here: we decide why and how it is processed.
The app works with a small server we run, which we call the relay, at relay.tzxlocate.com. The relay passes encrypted messages between the phones in a circle.
This policy covers the TZX Locate apps and the relay during the closed beta. This website and its waitlist have their own notice.
Waitlist privacy noticeWhat we collect, and why
We do not ask for your real name, email or phone number to create an account. The account is made on your phone with a key the phone generates itself. Below is everything the app handles, tied to the feature that needs it.
2.1 Kept on your phone
None of this leaves your phone in readable form:
- Your identity key and recovery code
- WhyTo sign you in and open messages sent to you.
- WhereiPhone: the Keychain, this device only. Android: encrypted with an Android Keystore key.
- Your history
- WhyA point about every five minutes and the day’s events you received, so you can look back at the day.
- How long7 days, or 30 days if you choose, then deleted on the phone.
- Your saved places
- WhyName, centre, radius and alert rules. Arrival and departure alerts are worked out on your phone, never on our server.
- Your routine, for place suggestions
- WhyThe places you stayed 20 minutes or more, and when, so the app can ask “Is this Home?”. It is never sent to anyone, and only a place you answer “Yes” to becomes a saved place. You can turn suggestions off or clear your routine.
- How long28 days.
- Your Timeline
- WhyYour day as stays, trips (with a simplified route) and gaps, so you can look back. It is shared only as section 2.2 says.
- How long7 days, or 30 or 90 days if you choose that with Plus.
- What others share with you
- WhyTimelines your circle shares with you, and your circles’ places, to show them to you.
- How longEach Timeline for the period its sender chose (7, 30 or 90 days); each circle place while you are in that circle.
- Settings, and what runs the app
- WhySharing levels and language, the names of the people in your circles as your phone last saw them, who each place tells, voice clips you recorded or received, and the state of Walk with me and Safe Ride.
- The home-screen widget (if you add one)
- WhyA small snapshot of up to four people in a circle: name, a status word, the place name only at the level they share it, when it was last checked, and a battery band. No coordinates.
All of this is left out of Apple and Google cloud backups. If you change phones, your account comes back only with your recovery code, and your old history does not move. From the app’s data settings you can export a file of what your phone holds about you.
2.2 Sent to your circle through the relay, encrypted on your phone
The app sends the following to the members of the circles you choose. Each message is encrypted on your phone, separately for each recipient’s key, and signed by your phone; the relay stores and forwards the encrypted bytes.
- Your position, its accuracy and age
- FeatureThe live map. Exact, or rounded to “area” or “city” if you chose a lower sharing level for that circle. While sharing is on.
- Your phone’s state
- FeatureBattery as a band (good, low, critical or charging, never a number), power-saving state, whether you are still, walking or driving, and rounded speed while driving: so your family can tell “phone off” from “not sharing”.
- Safety and place events
- FeatureArrivals and departures, check-ins, Walk with me and Safe Ride, SOS, roll call, find requests, meeting points, and a convoy’s leader and trail. When you or the app trigger them.
- Your name, and the circle
- FeatureYour profile name, avatar choice and pronoun (for Arabic grammar), and the circle’s name: so phones can show who you are.
- Voice clips
- FeatureTalk inside a group. Only while you hold the talk button, two minutes at most per clip.
- Circle places
- FeatureA place you add for a whole circle goes to every member, so each phone can tell when its own owner arrives or leaves. Each phone checks only itself; nobody’s phone checks anyone else.
- Your Timeline for the day
- FeatureTo each person you share your location with, at their level: Exact gets stays, trips and routes; Area gets places rounded to about a kilometre and trip times without routes; City gets the city and times only. Turning your Timeline off tells their phones to delete what they hold of it.
- Speeding alerts
- FeatureOnly if you drive above the limit your circle’s organiser set (120 km/h unless changed; or 100, 140 or off) for 30 seconds or more. Worked out on your phone and sent only to the people who see you at Exact. Your phone tells you when a circle you are in has it on.
Who hears about your arrivals. A place you keep for yourself tells only the circles or people you choose for it, and a circle place tells only that circle. You can also stop your phone telling one person when you arrive or leave, while they still see your location. SOS and missed check-in alerts cannot be switched off this way.
Live talk. When you hold the talk button in a circle that has it on, your voice goes live to the members listening, through a voice server we run on the same server in Jeddah. Each phone encrypts its audio with a key shared only inside the circle; the voice server passes the audio on and is not set up to record it.
Guest links. If you create a guest link, someone without the app can follow your own location, and only yours, in a web browser until the link expires or you withdraw it. The key that opens it is in the part of the link after “#”, which browsers do not send to servers. The relay keeps the link’s expiry and how many times it was opened, and shows you that count.
Reports. Both apps have three kinds of report, and none is sent unless you choose: “Report a bug” (your note, a screenshot if you add one, and the app’s recent log from this phone); a crash report, where after an unexpected stop the app asks “Send crash report to TZX?” and the report carries the error and the recent log without locations; and a weekly battery summary if you turn it on, with battery-use numbers only and never your location.
A bug report includes your location only if you tick “Include my recent location”; otherwise places and coordinates are removed from the log. Every report is sealed on your phone to a TechZoneX key whose private half we keep off the server, so the relay stores it for 60 days without being able to open it.
Founders codes. If you redeem a Founders code, we keep a one-way hash of the code and which account used it, so you keep Plus.
2.3 The grounds we rely on
- Your consent: for sharing your location, place events, clips and safety messages with the circles you choose, for phone permissions, and for each report you send. You can withdraw it at any time.
- Providing the service you asked for: running your account, routing encrypted messages, keeping you signed in, notifications and Founders codes.
- Keeping the service secure: access and service logs, abuse limits and backups.
- Legal obligations: answering lawful requests from competent authorities. Because message contents are encrypted on phones, what we could provide is limited to the routing information and logs in section 3.
What our server can read, and what it only carries
3.1 How the encryption works
Your phone generates a private key that never leaves it. Each message is encrypted on the sending phone, separately for each recipient’s key, and decrypted on the recipients’ phones. The private keys stay on phones and we do not receive them, so the relay holds the encrypted bytes without the keys to open them. We use published, widely used algorithms (libsodium: XChaCha20-Poly1305, X25519, Ed25519), and every message is signed by the sending phone and checked by the receiving phone.
So that each phone knows whom to encrypt for, the relay hands out the circle members’ public keys. That is why the phones check them: an invite link carries a fingerprint of the inviter’s key, and phones show a notice when a member’s key changes. No independent security firm has reviewed this design yet, which is why we describe how it works instead of making broader promises.
3.2 What the relay can read (routing information)
To deliver encrypted messages, the relay keeps the following in readable form. None of it includes a latitude, longitude, place name, message text or voice.
- Account number and public sign-in key
- What128 random bits, not derived from your phone number, name or email; and a public key to check it is your phone signing in.
- How longUntil you delete your account.
- Sign-in sessions
- WhatA one-way hash of the session token, your phone’s model name (for example “iPhone16,2”), and when it started, expires and was last used.
- How long30 days, deleted 7 days after expiry or sign-out.
- Circles and memberships
- WhatA random number for each circle, its type, who created it, a trip’s start and end, its member limit and its encrypted name; and who is in which circle, in what role, and when they joined or left.
- How longWhile the circle exists (see section 6).
- For each encrypted message
- WhatThe sending account, the circle, the message type (for example “location” or “SOS”), its size, a sequence number and the time. For the latest message per person per circle: the encrypted message itself.
- How long24 hours (trail points 1 hour, voice clips 10 minutes). The latest message: until replaced or you leave the circle, and at most 30 days with nothing newer.
- “Who is looking” records
- WhatWhich account opened which circle’s live map, and when, so everyone in the circle can see who is watching.
- How long8 days after the viewing ended.
- Safety timers and second-contact alerts
- WhatThe account, circle, type, due time and grace period, and whom to wake and who answered when: so an overdue alert can be raised even if a phone goes silent. Never what happened or where.
- How longUntil they fire, are answered or are cancelled, then 24 hours.
- Invites and join requests
- WhatOne-way hashes of invite links and codes, who created them, how many uses they allow and have had, and their expiry; failed attempts to use them; and join requests waiting for an organiser’s approval.
- How longUp to 7 days after the invite ends or is used up; a request until answered, or 7 days.
- Notification tokens
- WhatThe token, iPhone or Android, the phone’s model name, and whether it is a test build: to wake your phone for an alert when the app is closed.
- How longUntil the phone is removed from your account, the token stops working, or you delete your account.
- Sealed reports
- WhatThe sending account, the report type, iPhone or Android, the app build number, its size, when it arrived, and the sealed report itself.
- How long60 days from receipt.
- Other settings and states
- WhatYour weekly sharing summary setting (on or off), Founders membership, each member’s encrypted circle-places list, and who is talking in which circle right now (in the server’s memory only).
In other words: our server can see that a given account raised an SOS or checked in, in a given circle, at a given time. It does not see where, or what the message says. It needs the type to decide how long to keep each message and which ones should wake other phones.
3.3 Technical logs
- Web server access log
- WhatThe network (IP) address a request came from, the time, the path requested, the status and the size. No sign-in tokens.
- How longUp to 7 days.
- Relay service log
- WhatThe event type (for example sign-in, circle created, message relayed), account and circle numbers, message type and size, and timing. No IP addresses and no contents.
- How longWe have not set a fixed time limit yet. We will state it here once it is set.
- Live talk server log
- WhatWhen someone joins or leaves a talk room: the account number and the phone’s network (IP) address. No audio, no keys.
- How longWe have not set a fixed time limit yet. We will state it here once it is set.
- Abuse counters
- WhatA network address or account with a count, in the server’s memory only.
- How longUp to 24 hours.
The app regularly asks our server which app builds are current and compares the answer with its own build number on the phone; the request is logged like any other. We use logs only to run, secure and fix the service and to handle abuse.
Phone permissions
- Location (while using, or always)
- WhyShowing and sharing where you are, arrival and departure alerts, place suggestions, your Timeline and speeding alerts, all worked out on your phone. “Always” keeps them working when the app is closed.
- If you say noYou can see others but they cannot see you; place alerts stop or have gaps.
- Motion & fitness / physical activity
- WhyTelling still, walking and driving apart, to save battery, to label trips and to know when a speeding alert can apply.
- If you say noMore battery use; no driving detection.
- Bluetooth, and Ultra Wideband (iPhone)
- WhyKnowing who is nearby and helping find a person close by. The direction arrow only between two phones that both have UWB.
- If you say noNearby features are off.
- Microphone
- WhyVoice clips and live talk, only while you hold the button.
- Camera
- WhyScanning QR codes for invites and guardian approval codes. You can type the code instead.
- Notifications
- WhyAlerts from your circle. If you say no, you will not be alerted.
- Speech recognition (iPhone)
- WhyThe app may ask for it to show a voice clip’s transcript on this phone only. The current version does not produce transcripts.
- Face ID (iPhone)
- WhyConfirming it is you before your recovery code is shown. Otherwise your phone passcode is used.
How long we keep data
Our server deletes what is over automatically, on a schedule, whether or not you delete your account.
- Encrypted messages on the relay
- 24 hours (trail points 1 hour, voice clips 10 minutes).
- Latest encrypted position per person per circle
- Until replaced, until the person leaves the circle or it ends, or the account is deleted, and at most 30 days with nothing newer (longer only while that person’s safety timer in the circle runs, or ended less than a day ago).
- Ended trips and circles
- Their messages, latest positions, clips and guest links are deleted at once. A record that it existed and who was in it stays 7 days, then is deleted.
- Membership of someone who left a circle that still exists
- Until the circle ends (then 7 days), or until that person deletes their account. It says only that they were in it and when they joined.
- Safety timers and second-contact alerts
- Until they fire, are answered or are cancelled, then 24 hours.
- Invites and join requests
- 7 days after an invite expires, is withdrawn or used up; each failed attempt 7 days; a join request until answered, or 7 days.
- Guest links
- Until they expire or are withdrawn, then 1 day.
- “Who is looking” records
- 8 days after the viewing ended.
- Sign-in sessions
- 30 days, deleted 7 days after expiry or sign-out.
- Sealed reports
- 60 days from receipt.
- Founders codes
- A used code stays recorded as used, with no time limit; its link to your account is removed when you delete your account.
- Account, public key, current memberships, notification tokens
- Until you delete your account (or the phone is removed, for tokens).
- Web server access log
- Up to 7 days.
- Relay service log and live talk log
- No fixed time limit yet (section 3.3).
- Server backups
- An encrypted backup every night, each kept 14 days.
- On your phone
- History 7 or 30 days; Timeline 7 days, or 30 or 90 with Plus; routine 28 days.
Your rights, and how to delete
7.1 Right in the app
You can do most of it yourself: see and export what your phone holds, change or stop what you share and with whom (sharing levels, Pause, leaving a circle), correct your name and profile, turn off your Timeline or place suggestions, erase what is on the phone, and delete your account.
Delete your account: Me → Settings → Delete account
It is deleted from our server at once, and the last backup copy is gone within 15 days. What your circle’s phones already received stays on their phones. The full details, and what to do if you can’t open the app, are on the delete-account page.
Delete-account page7.2 Your rights under the law
Depending on the law where you live, including Saudi Arabia’s Personal Data Protection Law and the UAE’s Federal Decree-Law No. 45 of 2021, you may have the right to:
- be told how your data is processed (this policy);
- access your data and get a copy of it;
- ask for it to be corrected or deleted;
- withdraw your consent at any time, and restrict or object to processing where the law allows;
- complain to the regulator: the Saudi Data and Artificial Intelligence Authority (SDAIA) in Saudi Arabia, or the UAE Data Office in the UAE.
Because almost everything we hold is encrypted with keys we do not receive, the readable copy of your data is the one on your phone. On request we will also give you the routing information in section 3.2 linked to your account. As we hold no name, email or phone number for your account, we will ask you for a way to show the account is yours before we answer. Write to hello@tzxlocate.com.
Withdrawing consent does not affect processing that happened before. If you withdraw consent to location sharing, the app stops sending your position, and your circle can see that you are not sharing.
Children and age
TZX Locate is for people aged 13 and over. A child under 13 can use it only if a parent or guardian sets the app up on the child’s phone; a child under 13 cannot create an account alone.
At setup the app asks for the month and year of your birth. It uses them once, to set itself up for your age, and keeps on your phone only your age group and the month it changes. Your birth month and year are not saved and never sent. If you are under 18, your circle receives only what the approval steps need: that you are under 13 or between 13 and 17, and later that you have turned 18.
- 13 to 17
- You can join or start a circle, but nothing is shared from your phone until a parent or guardian in your circle approves: they type the code shown on your phone into theirs, confirm they are your parent or legal guardian and read the family agreement; you read the same agreement and accept it. A parent or guardian can withdraw approval at any time. SOS always works.
- Under 13
- A parent or guardian sets the app up on the child’s phone: they confirm their own age and that they are the child’s parent or legal guardian, then follow the same approval steps.
- Until 18
- Pausing, and leaving a circle that holds the approving guardian, need the guardian. SOS, deleting the account and removing the app are never blocked.
- At 18
- Your phone tells your circle, you control your own sharing, and a guardian’s special rights end.
Approval, the agreement and the 18th-birthday notice are encrypted messages inside the circle like any other; our server sees only that a message of that type was sent. Your phone keeps a record of who approved and when.
This is a declaration, not a verification: we have no way to check a birth date or that the person approving is really the parent or guardian. If you are a parent or guardian and believe a child is using TZX Locate without your involvement, write to us and we will help remove the account.
A parent or guardian who adds a child to a family circle is responsible for deciding that sharing the child’s location with that circle is in the child’s interest, and for explaining to the child, in a way they understand, who can see where they are. Everyone in a circle, child or adult, can see who is looking at the map.
TZX Locate must not be used to monitor another adult (for example a spouse, employee, driver or domestic worker) without that person’s own free participation. The app has no stealth mode, no hidden install and no way to stop an adult leaving a circle.
Security
- All connections to the relay use HTTPS, and the app builds we distribute connect only to relay.tzxlocate.com.
- The relay stores only one-way hashes of session tokens, invite links and codes.
- One public entry point to the server, a database reachable only from the server itself, and nightly backups encrypted with a key kept apart from the database.
- On your phone, keys are kept in the iPhone Keychain or protected by the Android Keystore.
- Deleting an account needs a signature from your phone’s key, not just a signed-in session.
No system is perfectly secure, and no independent security review has been carried out yet. If we learn of a personal-data breach that affects you, we will tell you and the competent authority as the law requires.
Changes to this policy
This is a beta policy, and a final policy will replace it before public launch. We post any change on this page and update the effective date. If a change materially affects how we use your data, we will tell you in the app before it takes effect and, where the law requires, ask for your consent again.
Contact
TechZoneX, the controller. For any question about this policy, a request about your rights, or a parent’s or guardian’s concern about a child:
hello@tzxlocate.comThat’s the whole policy.