What is stored on this device
Random tokens, encounter timestamps, your report tiers and reminders. The consumer app does not collect your name. Optional near-me location, clinic-staff email, OAuth sync and AI replies are separate, optional paths.
Unused codes are deleted automatically after 30 days. Cancel or delete any time.
Works offline
Your timeline and PIN stay on this device. Internet is used for optional encrypted backup, map links you tap, AI replies after identifiers are stripped, the partner-notice inbox (token-hash + sealed blob + TTL), and optional aggregate counts (day + country + event) — not lock-screen push.
Privacy security lock
Require a 4-digit PIN or Face ID / Touch ID before PACT Safe opens, so an unattended phone shows nothing.
Decentralised token model
- Each device holds a random pact code. Tap New code if a screenshot should stop reaching this phone. Old scans then cannot deliver notices here.
- Links are stored as token→token pairs only. There is no user table, no identifier, and no way to resolve a token to a human being.
- Reports and notices carry only a tier and a timestamp bucket — never a sender, contact date, or location.
- Records live on your device by design (local-first); the optional sync layer carries the same opaque tokens and nothing else.
Privacy-law design goals
We ask consent and design for data minimisation, purpose limitation, storage limits and one-tap erasure. This describes how the product is built — not a GDPR, PDPA or HIPAA certification.
- GDPR (EU): we design to minimise personal data. Optional location, clinic-staff email, OAuth sync and AI replies can still involve processing — this is not a certification.
- PDPA (TH/SG): we ask consent at onboarding and keep consumer features purpose-limited. This is a design goal, not a certification.
- HIPAA (US): PACT Safe is not a HIPAA covered entity. Clinic referrals carry a discount code rather than a patient file.
Anonymous product counts
Opening Care, Connect, Emergency, or a clinic Maps/Call button can send aggregate counts (UTC day, coarse country, event name). No token, exposure category, health data or location is attached — and it is never joined to your device or your links. Turn this off anytime.
- Counted in aggregate only, per clinic listing — never per person.
- No background GPS tracking, ever. Maps opens in your own map app.
- Care logs are hard-deleted after 90 days. Anonymous partner links are kept up to 180 days so blood-borne look-back can run. Impact numbers shown in the app are projected / illustrative.
- The free & charity clinic directory is bundled on-device. Country/city filtering never queries a server, and the optional "clinics near me" sort reads a GPS fix inside your browser, uses it once for distance sorting, and discards it — it is never stored, uploaded or linked to your token.
On — day, coarse country and event only. No name, token or health data.
Language
Saved on this phone