Privacy policy
This policy explains what Beacon Family Locator ("Beacon") collects, why, who can see it and the choices you have. Beacon is made by RWD Industries LLC, a Texas limited liability company ("we", "us").
Beacon is a family safety app. It shares your location and emergency alerts with the people in your family circle. We never sell your data, and we never share your location with data brokers, insurers or advertisers.
What Beacon collects and why
| Data | Why | Who can see it | How long we keep it |
|---|---|---|---|
| Precise location | The live family map, Lighthouse arrival and departure alerts, and locating you during an SOS | Your circle | Live position while you share it; location history 7 days |
| Name, email, phone number, profile photo | Your account, and so your circle recognises you and can reach you | Your circle | Until you delete your account |
| Emergency evidence: audio and photos | Recorded only during an active alert, so your circle has context | Your circle | 30 days |
| Contacts (Android, optional) | Only to fill in your own name and photo from your contact card when you set up your profile; your address book isn't uploaded | No one | Not stored by us |
| Approximate location (area only) | Beacon Missing community alerts within about 5 miles. People nearby see an alert, never who is near them | Shown as counts only | Only as long as needed for the report; removed when you delete your account |
| Circle chat messages | Circle chat | Your circle | 1 year, or sooner if you delete them or your account |
| Alert history | A record of past alerts and their trails, so your circle can look back after an emergency | Your circle | Until you delete your account; never removed automatically. If a parent deletes a child's profile, the child's alerts stay with the circle without the child's name |
| Beacon Missing reports you file (photos, name, description, last-seen place) | Alerting your circle, and people within about 5 miles, to a missing person, pet, vehicle or item, or posting a pet you found so its owner can find it. Your circle is alerted straight away. Every report is then checked automatically, with no person involved, to decide whether people nearby and social media see it (see "Automated decisions" below) | Your circle; people nearby once it reaches them | While the report is open. 30 days after it's marked found, its photos, description and places (and the places and notes in its sightings) are removed; a record that it was filed and found is kept. Removed when you delete your account |
| Saying you're safe when you've been reported missing | Asking someone else in your circle to confirm, or, if nobody else can, an automatic 45-minute check: that you confirmed it's you with your phone's own lock (Beacon receives only whether it succeeded, never your face, fingerprint or passcode), which phone you used, and your phone's location, battery and connection during the check. An optional message goes to the people asked | The people in your circle asked to confirm; the person who filed the report sees that a check is running | Kept with the report's record; removed when you delete your account |
| Reports of a post ("Report this post") | Counted automatically as part of a report's risk score; if many established accounts report a post, it's hidden from people outside the family's circle | RWD Industries | Until you delete your account |
| Which of your devices sets your location (only if you choose one) | "Use this device for my location" in Settings, so your pin doesn't jump between your phone and tablet | No one | Until you change it, or sign out on that device |
| Links between a teen's account and a parent | A teen aged 13 to 17 and a parent can link their accounts, if both agree | The teen and the parent | Until either of them ends the link or deletes their account |
| Activity history (arrivals, departures, time at places) | The activity timeline for each member | Your circle | 90 days |
| Lighthouse arrival and departure events | Arrival and departure alerts | Your circle | 7 days |
| Circle join requests | Asking to join a circle, and the answer | The person asking and the circle's managers | 30 days after it's answered; 90 days if never answered |
| Intercom connection data (technical call set-up, not audio) | Connecting the live intercom during an alert | No one | 90 days after the alert is resolved |
| Your circle's phone numbers, kept on your phone | So an SOS can still text your circle when you're signed out of Beacon or have no data connection | No one. They stay on your phone, encrypted with your phone's secure key storage, and aren't included in backups | Until you sign out or delete your account |
| A notification token for each phone you're signed in on | So every phone you use gets your circle's alerts | No one | Until you sign out on that phone, the token stops working, or you delete your account |
| Each device you're signed in on: its kind and model, when it last reported, its battery, and whether location and notifications are on for Beacon | So your circle knows which of your devices your location comes from and whether an SOS will reach you, so a parent hears if a child's phone turns location or notifications off, and so Beacon can notice your phone stop reporting while another of your devices moves on | Your circle (never a device's own position) | Until you remove the device or delete your account |
| If you sign in with Apple: a token from Apple | So we can revoke Beacon's access to your Apple ID when you delete your account, as Apple requires | No one | Until you delete your account, when it is revoked with Apple and deleted |
| Battery level and charging state | Shown to your circle, and a single alert to your circle when your phone reaches 15% and again at 5% (not while charging). You can turn this off in Settings › Notification Preferences | Your circle | Only the latest reading, until you delete your account |
| Location-sharing pause | When you pause sharing, your circle sees that you paused and until when, with your last location. Raising an SOS always shares your location and ends the pause | Your circle | Until the pause ends |
| People you pick to text about a missing report | Beacon opens one message from your own phone to the people you choose with your phone's contact picker. Beacon doesn't read your address book, and the people you pick aren't uploaded | No one | Not stored by us |
| Crash reports and diagnostics | Fixing crashes (Firebase Crashlytics) | RWD Industries | Per Google's Crashlytics retention |
| Advertising ID and basic device information (adult profiles only) | Showing ads that help keep Beacon's safety features free | Google AdMob, under Google's policies | Per Google's retention |
Services we use
Beacon runs on Google Firebase (accounts, database, file storage, notifications and Crashlytics), with maps from Google Maps on Android and Apple Maps on iPhone. Weather comes from Open-Meteo, which your phone asks for the places shown on your map. Disaster alerts come from the US Geological Survey and the National Weather Service, using your approximate area only. Photos on Beacon Missing reports are checked for nudity and violence by Google Cloud Vision, and the report's text (name, description and places) may be checked for threats, abuse and personal details by Anthropic's Claude, or by Google Cloud Natural Language when Claude isn't available (and a photo by Claude when Cloud Vision isn't); none of them uses it to train its models. When you say you're safe on a report about you, Beacon asks Apple's App Attest (iPhone) or Google Play Integrity (Android) to confirm the request comes from the genuine Beacon app on your phone; they receive a one-time code, not your location or your report. Emails are sent through Resend. When you file a Beacon Missing report, you can choose to also post it to Beacon's public Facebook Page and Instagram account through Meta's API, so more people can help look. This is off unless you turn it on, and you're asked each time. A public post shows the report's photo, name, description and last-seen place to anyone, and can't be fully taken back once shared. A report about a child can be posted only by the child's parent or guardian (for a teen with a linked parent, only by that parent), and a report is posted only when Beacon's automatic check allows it (see "Automated decisions"). Emergency texts sent with Beacon Text go from your own phone's SIM through your carrier. Each provider handles data under its own privacy policy, only to provide its part of Beacon.
Automated decisions
Beacon Missing reports are moderated automatically; no person at Beacon reviews or approves them. When a report is filed, your circle is told at once. Beacon then gives the report a risk score from what it knows: whether the reporter is in the person's circle or is their parent, how old and how verified the reporter's account is, their earlier reports, how far they were from the last-seen place, whether the report has a photo and a description, duplicates, whether the person's own phone is sharing its location, reports of the post by other people, and confirmations from the person's circle. The photo and wording check above is part of it. The score decides whether the report alerts people nearby and goes to social media, appears only in the community feed nearby, or stays with your circle; content that fails the check is never shown outside the circle. The score is re-checked as things change. Every decision and the reasons for it are recorded.
If someone you know is reported missing and says they're safe, that alone doesn't close the report: someone else in their circle confirms, or Beacon's automatic check described above decides. A child's report can only be closed by the person who filed it or a parent.
When you're reported missing
Your phone's key. To make sure an "I'm safe" really comes from you, Beacon creates a key on your phone that only works after Face ID, your fingerprint or your passcode. The private part never leaves your phone's secure hardware; we keep only the public part, linked to your account and that phone, and a record of each check (whether it passed, and when). It is removed with your account.
A duress PIN. You can set a duress PIN in Settings. If you're ever made to say you're safe, typing it makes Beacon look normal on your screen while it keeps the report open and quietly alerts your circle. We keep only a scrambled version (a salted hash) on our servers and on your phone; nobody, including us, can read the PIN itself.
A location trail after a duress alert. If you use your duress PIN or safe word, your phone sends its location to your circle about every 30 seconds (less often on a low battery) for up to 2 hours, or until your circle resolves the alert. This happens even if you've paused location sharing, and it isn't shown on your own screen. The trail is kept with the alert, like any SOS trail.
Check-ins. While Beacon checks an "I'm safe", it may send you a notification with a code to enter within 5 minutes. We keep whether each code was entered and when.
Your emergency contact. You can add an emergency contact outside Beacon (a name and a mobile number). Only you can see it. If you're reported missing in a circle of two and say you're safe, the person who reported you can text that contact a one-time link, from their own phone, asking whether you're safe. That person sees your contact's name and number for this purpose only. The link works once and expires after 4 hours; the answer (yes, no or don't know) is kept with the report's record.
Blocking. You can block someone in Beacon. We keep your block list (who you blocked, and the name you saw) so they can't see your location or report you missing; it is visible only to you. A report they filed about you earlier is checked again. Your SOS alerts still reach everyone in your circle.
Editing a report. Whoever filed a report can add or replace its photos and details while it's open. Beacon checks the report again after every change, and keeps a record of each change (who, when, and what it was before and after) so decisions can be explained. A report that has been closed as found can't be edited.
If you think an automated decision about a report is wrong, contact our support team and we'll look at it.
Advertising
Beacon shows ads on adult profiles to help cover running costs, so that every safety feature can stay free. Ads are provided by Google AdMob, which may use your device's advertising identifier and basic device and network information to choose and measure ads. We don't give advertisers your location, your circle or your messages, and ads never appear during an emergency alert or while Simple view is turned on. You can limit ad personalisation in your phone's settings (iPhone: Settings › Privacy & Security › Tracking; Android: Settings › Google › Ads).
Joining a circle
No one can add you to a circle without your agreement. Someone who has your Beacon ID can only send a request; you're added if you approve it in the app. For a dependent profile, a parent or guardian who manages it approves. When someone leaves or is removed from a circle, they stop seeing that circle's locations from then on, and if they are a child or a linked teen, their parents are told.
Children and dependent profiles
You must be at least 13 to create a Beacon account. Children under 13 can use Beacon only through a dependent profile that their parent or legal guardian creates and manages from the parent's own account. By creating a dependent profile, the parent confirms they are the child's parent or legal guardian and agrees to Beacon collecting the child's information described in this policy.
- What we collect from a dependent profile: the name and photo the parent enters, the device's location while sharing is on, emergency alerts and any evidence captured during an alert, and the child's circle messages.
- How it's used: only to provide Beacon to the child's family circle: the family map, Lighthouses and emergency alerts. It is shared only with the circle the parent chooses.
- Two parents: a child can have up to two parents or guardians managing their profile. The parent who created it can add the other parent from the same circle; either can approve sign-ins and manage the profile.
- Signing in a child's phone: a dependent profile's Beacon ID alone doesn't sign a phone in. The parent approves the sign-in on their own phone, or shows a one-time code that works once, for 10 minutes.
- Never: no ads are shown on dependent profiles, no advertising identifier is collected for advertising, and a child's information is never sold or used for marketing.
- Parents' rights: a parent can review the child's information in the app, stop location sharing, delete the dependent profile at any time in Settings › Family, or ask us to do any of these by contacting us. Deleting the profile deletes its name, photo, location history and messages; emergency alerts the child raised are kept for the circle without the child's name, and reports the child filed move to the parent.
Teens aged 13 to 17 have their own account. A teen and a parent can link their accounts if both agree, and either can end the link. A linked parent is told if the teen leaves a circle, and only a linked parent can post a missing report about the teen to social media. A linked parent can't edit, sign out or delete the teen's account. Beacon doesn't store anyone's date of birth.
If we learn that we have collected information from a child under 13 without a parent's agreement, we will delete it.
Your choices and rights
- Pause sharing your location for 1 hour, 4 hours or until you resume, or stop sharing at any time in the app. A child or dependent profile can pause only if the parent who manages it allows it.
- Delete your account in the app: Settings › Delete my account. This removes your profile, location history and the evidence you created, and if you signed in with Apple, revokes Beacon's access to your Apple ID. It can’t be done while an emergency alert from you, or from someone in your care, is still active: stand the alert down first.
- Download a copy of your data in the app: Settings › Your data › Download my data (in the latest version of Beacon). You get a zip file with your profile, location history, circles and Lighthouses, alerts and evidence, messages, reports and photos, as JSON files plus your own photos and recordings. Security credentials such as push tokens and PINs are left out, and so are other people's personal details, including who filed a report about you. The download link works for about an hour and the file is deleted after 24 hours. Beacon doesn't email it for you; you can send the link to yourself from the app with your own email.
- You can also ask us for a copy of your data, to correct it or to delete it, by contacting us. We respond within 45 days.
- Depending on where you live, for example Texas, California or other US states, you may have additional privacy rights, including the right to opt out of targeted advertising. We honour these requests for everyone, and we never sell personal data.
Security
Data is encrypted in transit and stored with Google Cloud's encryption at rest. Our database rules limit who can read your profile, location and alerts to you, the people in your circles and, for a dependent profile, the parents or guardians who manage it.
Where your data is stored
Beacon's data is stored on Google Cloud servers in the United States.
Changes and contact
We'll post changes here and tell you in the app before material changes take effect. Questions: contact our support team.