Privacy Policy
Last updated: 8 September 2026
Who we are
Safve is operated as a sole trading service under the name Safve. We are the data controller for the personal data described in this policy.
Contact for data requests: hello@safve.co.uk
What we collect and why
Data you give us directly
| Data | When collected | Purpose |
|---|---|---|
| Mobile number | Sign-up; when an invited member accepts their invite | Identity verification via one-time SMS code; sending drill reminders, alerts, and notifications |
| First name | Sign-up onboarding | To identify you within your group and in SMS messages sent on your behalf |
| Group name | Sign-up onboarding | To identify your group in SMS invites and within the app |
| Safe word and duress word | Sign-up; when you rotate them | Encrypted with AES-256-GCM before reaching our database. We cannot read your safe words. Stored to support in-app verification that a member knows the current word. |
| Invitees' mobile numbers | When you send an invite | To deliver the invite SMS. Retained until the invite is accepted or expires. |
Data we generate automatically
| Data | Details |
|---|---|
| Usage events | Named actions (for example: "group created", "invite sent", "safe word confirmed") linked to your user ID, group ID, and a timestamp. No message content. No device identifiers. No IP addresses. |
| Invite status records | Whether each invite was sent, accepted, or expired. |
What we do not collect
We do not collect email addresses, location data, device identifiers, or IP addresses. We do not record the content of SMS messages sent or received outside the app.
Your safe words are never stored in readable form. They are encrypted using AES-256-GCM before leaving your device. Each group uses a unique encryption key derived via HKDF from a master secret that is never stored in the database. Neither we nor anyone with database access alone can read your safe words.
Legal basis (UK GDPR Article 6)
Performance of a contract (Article 6(1)(b)): Your mobile number, name, group name, and safe words are necessary to deliver the service. Without them we cannot authenticate you, send verification codes, administer drills, or alert your group.
Legitimate interests (Article 6(1)(f)): Usage event logging helps us understand how the pilot is working and improve the service. We have weighed this against your privacy interests and concluded that this logging (which contains no message content, no device identifiers, and no IP addresses) does not override your rights.
Who we share your data with
We do not sell your personal data. We do not share it with third parties for advertising or marketing purposes.
We use the following processors to operate the service:
- Supabase: database and authentication infrastructure. Your data is stored in the UK (London, eu-west-2 region) under a data processing agreement.
- Twilio: SMS delivery for verification codes, drill reminders, and alerts. Twilio processes your mobile number and message content to deliver SMS messages. Twilio operates from US infrastructure (US1 region). Transfers from the UK to Twilio's US servers are covered by Twilio's standard data processing agreement, which includes appropriate safeguards for international transfers as required under UK GDPR.
- Vercel: application hosting. Your requests pass through Vercel's infrastructure when you use the app.
How long we keep your data
- Account data (name, phone number, group membership): retained while your account is active.
- Safe words: retained while the group exists. Previous versions are deleted immediately when safe words are rotated.
- Invite records: retained for 30 days after acceptance or expiry, then deleted.
- Usage events: retained for the duration of the pilot. Within 90 days of the pilot ending, these records will be anonymised or deleted.
To request deletion of your account and all associated data, contact us at hello@safve.co.uk. We will action deletion requests within 30 days.
Your rights under UK GDPR
You have the right to:
- Access: request a copy of the personal data we hold about you
- Rectification: request correction of inaccurate or incomplete data
- Erasure: request deletion of your data
- Portability: receive your data in a structured, machine-readable format
- Restriction: limit how we process your data in certain circumstances
- Object: object to processing based on legitimate interests
To exercise any of these rights, contact us at hello@safve.co.uk.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe we have not handled your personal data lawfully.
Changes to this policy
If we make material changes to this policy, we will notify you by SMS before the changes take effect.