What is stored on this device
Random tokens, encounter timestamps, your report tiers and reminders stay on this phone. The consumer app does not collect your name. If product counts are on, this phone may send a 90-day hash (not the raw token, not a name) so we can count unique use — turn it off below. Optional near-me location, clinic-staff email, OAuth sync and AI replies are separate paths.
Unused codes are deleted automatically after 30 days. Cancel or delete any time.
Works offline
Your timeline and PIN stay on this device. Internet is used for optional encrypted backup, map links you tap, AI replies after identifiers are stripped, the partner-notice inbox (token-hash + sealed blob + TTL), and optional product counts (day + country + event + 90-day hashed unique phone) — not lock-screen push.
Privacy security lock
Require a 4-digit PIN or Face ID / Touch ID before PACT Safe opens, so an unattended phone shows nothing.
Quick exit
If someone walks up: tap Exit, triple-tap an empty spot, or press Esc twice on a computer. The screen changes at once and the app locks.
Switch the screen to
No PIN yet: type 0000 then = to come back. Set a PIN so the app also locks.
Browsers cannot erase history. Exit replaces this page so Back does not show it, but your browser history may still list PACT Safe. For extra privacy, use a private or incognito window.
Decentralised token model
- Each device holds a random pact code. Tap New code if a screenshot should stop reaching this phone. Old scans then cannot deliver notices here.
- Links are stored as token→token pairs only. There is no named user table. The optional 90-day product-count hash cannot be reversed to a name or to your raw token.
- Reports and notices carry only a tier and a timestamp bucket — never a sender, contact date, or location.
- Records live on your device by design (local-first); the optional sync layer carries the same opaque tokens and nothing else.
Privacy-law design goals
We ask consent and design for data minimisation, purpose limitation, storage limits and one-tap erasure. Product counts are a 90-day hash you can turn off. This describes how the product is built — not a GDPR, PDPA or HIPAA certification.
- GDPR (EU): we design to minimise personal data. Optional location, clinic-staff email, OAuth sync and AI replies can still involve processing — this is not a certification.
- PDPA (TH/SG): we ask consent at onboarding, keep consumer features purpose-limited, and let you turn product counts off. This is a design goal, not a certification.
- HIPAA (US): PACT Safe is not a HIPAA covered entity. Clinic referrals carry a discount code rather than a patient file.
Anonymous product counts
Opening Care, Connect, Emergency, a visit, or a clinic button can send a count (UTC day, coarse country, event name) plus a hashed unique phone computed on this device. The raw token never leaves. Hashes delete after 90 days and are never stored with a clinic or an infection name. Used to improve care and the app, and for advertising that cannot target a person. Turn this off anytime.
- Unique phones are a 90-day hash. Clinic listing taps are counted separately and never joined to that hash.
- No background GPS tracking, ever. Maps opens in your own map app.
- Care logs are hard-deleted after 90 days. Anonymous partner links are kept up to 180 days so blood-borne look-back can run. Impact numbers shown in the app are projected / illustrative.
- The free & charity clinic directory is bundled on-device. Country/city filtering never queries a server, and the optional "clinics near me" sort reads a GPS fix inside your browser, uses it once for distance sorting, and discards it — it is never stored, uploaded or linked to your token.
On — day, coarse country, event, and a 90-day hash. No name, raw token, or health data. Helps the product and non-targeted ads.
Language
Saved on this phone