APPLICATION PRIVACY POLICY
Last Updated: October 5, 2026
1. INTRODUCTION AND SCOPE
This Privacy Policy ("Policy") is issued by BILLIONX LABS LIMITED ("we," "us," or "our"). It governs the data practices for our mobile application, GPS Phone Tracker Location (also referred to as Family Locator, the "App"), and all related services (the "Services").
About the App: Family Locator is a consent-based location sharing app for families. You may share your own device location with people you explicitly approve, and you may view the location of people who have explicitly approved you. The App also offers optional saved places with arrival and departure alerts, a location history for people who share with you, an SOS alert you can send to your circle, and a "find my phone" feature that makes a paired phone ring so it can be found.
This Policy is a legally binding agreement. By downloading, installing, or using our Services, you acknowledge that you have read, understood, and agree to the data practices described herein. If you do not agree with this Policy, you must not use the Services.
For the purposes of applicable data protection laws, including the EU General Data Protection Regulation (GDPR), we are the Data Controller of your Personal Data.
2. OUR PRIVACY COMMITMENT
Consent first: Nobody can see your location unless you have taken an explicit action to allow it. We do not look up people by phone number, and we never disclose a location on the basis of an unverified claim.
You are always in control: Sharing is off until you turn it on. While sharing is active, an ongoing Android notification is displayed. You can stop sharing, or remove any person's access, at any time and it takes effect immediately. The App does not use Android's "Allow all the time" background location permission, so after your phone restarts, after the App is updated, or if the operating system force-stops the App, sharing pauses automatically and does not resume until you reopen the App and choose to resume it — we never restart sharing invisibly.
Data minimization: We collect only what the sharing features require, and we do not sell your Personal Data.
No advertising use of location: Your precise location is never used for advertising, ad targeting, or profiling, and is never sold or shared with data brokers. To measure whether our own advertising leads to installs and subscriptions, the App uses Google Analytics for Firebase together with your device's advertising ID (see Section 3.10); your location is never part of that data.
3. DATA WE COLLECT AND PROCESS
3.1. Location Data (including collection while the App is in the background)
What we collect: The GPS coordinates (latitude and longitude) and accuracy radius of your device, together with your battery level, charging state, and ringer mode (ring, vibrate, or silent).
When we collect it: Only while you have actively turned on location sharing in the App. If sharing is off, the App does not collect or transmit your location.
Background collection: When you turn sharing on, collection runs as an Android foreground service, so your location continues to update while the App is closed or not in use. This is required so that the family members you approved can see an up-to-date location rather than a stale one. Whenever this service is running, Android displays a persistent notification with a "Stop sharing" action; collection cannot run invisibly. You can also end it at any time by revoking the App's location permission in system settings.
Paused after a restart, update or system stop: Sharing is tied to an explicit session you start in the App. If your phone restarts, the App is updated, or Android force-stops the App, that session pauses; the App shows "Sharing paused — tap to resume" and no further location is collected until you open the App and resume sharing yourself. We do not automatically restart location collection in the background under any of these conditions.
Why we collect it: Solely to deliver your location, battery and ringer status to the specific people you have approved, to generate your location history, and to trigger the arrival and departure alerts for the places you saved.
Who receives it: Only the accounts you explicitly approved. Access is directional: approving someone to see you does not grant you access to them, and vice versa. Revoking a person removes their access immediately.
History starts from when access was granted: When you approve someone to see your location, they can see your location history only from the moment that approval took effect onward, never from before — even if you had approved and later removed the same person previously. Removing and re-approving someone starts a new history window from the new approval.
Retention: Your most recent location is retained until it is replaced by a newer one. Location history points are sampled at most once per minute and are kept for 90 days, after which they are deleted automatically. History shows the time each position was measured on your phone. Deleting your account permanently removes your current location and your entire location history from our servers immediately.
Offline buffer: If your connection drops while sharing is on, the App keeps the positions measured during the outage in private storage on your phone — at most 2,000 points or 12 hours, whichever comes first — and uploads them when the connection returns. The sharing notification shows how many are waiting. The buffer is deleted when you stop sharing, lose location or notification permission, delete your account, or when the App restarts, and it is excluded from device backups.
Upload frequency: Your phone sends its location more often (about every 20 seconds) while someone with approved access currently has your live location open on their screen, and less often (about every 10 minutes) the rest of the time; it also sends an immediate update whenever you cross the boundary of one of your own saved places. This only changes how often the same location data is sent — it does not change who can see it. A start/stop server record ("sharing session") tracks each period you have sharing turned on so uploads can be matched to the right period; sharing-session records carry no location themselves and are deleted 30 days after the session ends.
Someone is watching (watch signal): When a person you approved opens your live location on their screen, our server briefly tells your phone that "someone" is watching, so it can use the faster update frequency above. This signal never identifies which person is watching, is stored for at most 1 day, and does not appear in your history.
Alerts for your saved places: For each saved place, you choose which of the people who can already see your location also receive an arrival/departure alert for that place (up to 10 people per place, up to 20 places per account). Nobody is selected by default on a newly created place — you choose explicitly. Removing someone's access to your location also removes them from every place's alert list immediately. The push notification that wakes a recipient's phone never contains your location, the place's name, or your phone number; the App then fetches the actual alert details over a secure, authenticated connection, and only confirms you still have access to that person's location. These alerts, like all our notifications, are sent on a best-effort basis and may be delayed or, rarely, not delivered.
3.2. Account and Contact Data
What we collect: A phone number and display name that you enter yourself, and a server-generated account identifier for your device.
Why we collect it: So that family members can recognise who is inviting them or sharing with them. An anonymous device identifier is created at first launch so that purchases can be validated before you enter any personal detail.
Important: Your phone number is not published, is not used for marketing, is not used to search for other users, and is never sold. Connections are established only through a one-time 6-digit invitation code that the invited person must enter.
Invitations by QR code: As an alternative to typing the 6-digit code, you can generate a QR code containing a one-time invitation token. The token is long and random, and — like the 6-digit code — expires after 10 minutes and can only be used once. Our servers store only a one-way cryptographic hash of the token, never the token itself, so the invitation cannot be reconstructed from what we store. Scanning someone else's QR code uses Google's on-device Code Scanner (part of Google Play services); the App does not request camera access to do this, the scanned image is processed on your device, and it is not stored or sent to us or to Google — only the decoded invitation text reaches the App. Sending an invitation (by 6-digit code or QR code) requires an active subscription; accepting an invitation, and sharing or viewing your own location, remain free regardless of subscription status.
Inactive anonymous identities: If you never add a phone number, never connect with anyone, and never make a purchase, the anonymous identifier created for your device at first launch is automatically deleted, together with any data linked only to it, after 90 days of existing in that state. Identities that already existed when this rule took effect are given a fresh 90-day period starting from that date, not from when the identity was first created.
3.3. Saved Places
What we collect: The name, centre coordinates and radius of the places you choose to save, and the resulting arrival and departure events.
Why we collect it: To notify you when a family member arrives at or leaves a place you saved. You can delete a place at any time, which stops its alerts.
3.4. SOS Alerts
What we collect: When you deliberately trigger an SOS (pressing the SOS button starts a visible 10-second countdown that you can cancel; the alert is sent only when the countdown completes), we record an SOS event consisting of your account identifier, the time, and a request identifier used to prevent duplicate alerts.
Location and SOS: The SOS alert itself does not embed a separate copy of your location. The people you alert are people already approved to see your location, and they view your last shared position through the normal sharing feature.
Who receives it: Only the people who are already approved to see your location. The App shows you the delivery state of the alert. SOS alerts are never delivered to strangers. Sending an SOS requires an active subscription. Seeing the sender's shared location on the map also requires the recipient's own active subscription — a recipient without one still receives the alert notification and delivery confirmation, but cannot view the sender's location until they subscribe.
Important: An SOS alert notifies your circle inside the App only. It does not contact the police, ambulance or any emergency service, it is not monitored, and delivery is not guaranteed. In an emergency, call your local emergency services.
Retention: An SOS stops being delivered and displayed after 5 minutes at the latest, or earlier when you stop it from the App. The underlying SOS records are retained while your account is active and are permanently deleted when you delete your account.
3.5. Find My Phone (Ring Requests)
What we collect: When you ask a phone to ring, we record a ring request consisting of the requesting account, the target device, the time and its status.
Double consent: A ring request requires both an approved sharing relationship and a separate, explicit "allow ring" switch that the target phone's owner has turned on for you. Either can be withdrawn at any time, which immediately blocks further ring requests.
How it works: The target device rings at full alarm volume for up to 60 seconds, even if it is on silent, so it can be found. The previous volume is restored afterwards. A ring request expires after 1 minute if the target device does not receive it, so a phone cannot ring unexpectedly from a stale request.
Retention: Ring request records are retained while your account is active and are permanently deleted when you delete your account.
3.6. Purchase and Subscription Data
What we collect: The Google Play purchase token, product identifier, and the resulting entitlement status and expiry date. We also receive real-time developer notifications from Google Play when a subscription is renewed, cancelled, refunded or revoked, so that access always reflects the true state of your purchase.
Why we collect it: To validate your subscription with Google Play and unlock paid features. We do not receive or store your payment card details — all payments are processed by Google Play.
3.7. Technical and Diagnostic Data
What we collect: IP address, device model, operating system version, app version, and the crash, performance and usage diagnostics described in Section 3.9.
Why we collect it: To operate the Services, apply abuse and rate limits, keep the App stable, and prevent fraud. Country or region may be inferred from IP address for security purposes.
Map starting point: When you open the map, our server may return an approximate area derived from your IP address by our hosting provider, used only to centre the map before your GPS position is available. It is not stored, not shown to others, not added to your location history or saved-place alerts, and not used to determine your phone's country code.
3.8. Push Notification Token (Firebase Cloud Messaging)
What we collect: To deliver SOS alerts, ring requests, saved-place alerts and "someone is watching" signals to a phone that is not currently open, the App registers with Google's Firebase Cloud Messaging (FCM) service and we store the resulting push registration token together with your account.
What the token is used for: Solely to route SOS, find-my-phone, saved-place alert and watch-signal notifications to your device. The push message itself carries only an opaque identifier — never your location, the place's name, phone number, or any other personal detail; the App then retrieves any needed content over an authenticated connection.
Deletion: The token is deleted from our servers when you turn notifications off in the App, replaced when it rotates, and permanently deleted when you delete your account.
3.9. Analytics, Crash and Performance Data (Firebase)
SDKs in the App: The App includes Google Firebase Analytics, Firebase Crashlytics and Firebase Performance Monitoring, operated by Google LLC as our processor.
What they collect: Crash logs and stack traces, diagnostic events, app performance measurements (such as start-up time and network request timing), app interaction events, device model, operating system version, app version, and pseudonymous app-instance identifiers created by the SDKs.
Collection is on by default: This diagnostic collection is required for us to operate and stabilise the App and cannot be switched off inside the App. It matches the "required" data types declared on our Google Play Data safety form.
What they do not collect: These SDKs do not receive your shared GPS positions, your location history, your phone number or your invitation codes from us. Advertising measurement is described in Section 3.10.
More information: See Google's privacy documentation at policies.google.com/privacy and firebase.google.com/support/privacy.
3.10. Advertising Measurement and Subscription Analytics
What: When you install the App from one of our Google Ads campaigns and later subscribe, Google Analytics for Firebase records that conversion so we can measure and optimise our own advertising. For this it uses the Android advertising ID, the Google Play install referrer and the app-instance identifier created by the SDK, together with subscription events: the purchase (plan, the price you were charged and the Google Play order number) and later renewals, cancellations, refunds and expiries, which our server reports to Google Analytics using the same app-instance identifier.
What it is not: We do not show ads inside the App, and we do not sell your data or share your location, phone number, contacts or invitation codes with advertising networks.
Your choices: You can delete or reset your advertising ID at any time in Android Settings → Privacy → Ads. On devices in the European Economic Area, the United Kingdom and Switzerland the App does not send advertising signals (ad storage, ad user data and ad personalisation are off).
Subscription screen configuration: We use Firebase Remote Config to adjust and test the subscription screen (for example, which plan is preselected). It receives only the app-instance identifier and basic device information, not your location.
Legal basis: Our legitimate interest (Art. 6(1)(f)) in measuring our own advertising, outside the EEA, the UK and Switzerland.
4. ANDROID PERMISSIONS WE REQUEST AND WHY
The App asks for the following Android permissions:
- Precise location (ACCESS_FINE_LOCATION) and approximate location (ACCESS_COARSE_LOCATION): to read your device position for the sharing, saved-places and history features described in Section 3.1. Requested only when you set up sharing.
- Foreground service / foreground service location (FOREGROUND_SERVICE, FOREGROUND_SERVICE_LOCATION): to keep location sharing running with a visible, persistent notification while sharing is turned on.
- Notifications (POST_NOTIFICATIONS): to show the ongoing "sharing active" notification, arrival and departure alerts, and SOS / find-my-phone notifications.
- Vibrate (VIBRATE): to vibrate the device for SOS and find-my-phone alerts.
- Modify audio settings (MODIFY_AUDIO_SETTINGS): to temporarily raise the alarm volume during a find-my-phone ring and restore your previous volume afterwards.
- Internet (INTERNET): to communicate with our servers over encrypted connections.
Libraries included in the App also declare standard system permissions that do not give access to your personal data: network state (ACCESS_NETWORK_STATE), briefly keeping the device awake to finish background work (WAKE_LOCK), re-scheduling maintenance tasks after a reboot (RECEIVE_BOOT_COMPLETED, used by Android's WorkManager — the App never restarts location sharing after a reboot), Google Play purchases (BILLING) and receiving push messages (Firebase Cloud Messaging).
The App does not request access to your contacts, SMS, call log, camera, microphone or files.
5. LEGAL BASES FOR PROCESSING (GDPR)
Consent (Art. 6(1)(a)): Collection and disclosure of your location data, including collection while the App is in the background, and the sending of SOS alerts and ring requests.
Contractual necessity (Art. 6(1)(b)): Operating your account, the sharing features, the delivery of safety notifications, and your subscription.
Legitimate interests (Art. 6(1)(f)): Security, abuse prevention, the crash, performance and usage diagnostics described in Section 3.9, and the advertising measurement described in Section 3.10.
You may withdraw consent at any time by turning off sharing or revoking Android location permission. Withdrawal does not affect processing already carried out.
6. HOW WE SHARE DATA
With people you approve: As described in Sections 3.1, 3.4 and 3.5.
With service providers:
- Cloudflare, Inc. hosts our application servers and database, which store your account, location, places, SOS, ring-request, push-token and entitlement data (privacy policy).
- Google LLC provides map rendering (Google Maps SDK), payment processing and subscription validation (Google Play Billing), push notification delivery (Firebase Cloud Messaging), on-device QR code scanning for invitations (Google Play services Code Scanner — processes the camera image on your device and does not send it to us or store it), and the crash, performance and analytics diagnostics described in Section 3.9 (Firebase Crashlytics, Performance Monitoring and Analytics), and the advertising and subscription measurement described in Section 3.10 (Google Analytics for Firebase, Firebase Remote Config) (privacy policy).
Legal requirements: We may disclose data where required by applicable law, court order, or a valid governmental request, or to protect the rights, safety and property of our users or ourselves.
We do not: sell your Personal Data, share your location with data brokers, share your data with advertising networks, or use your location for advertising or marketing of any kind.
7. SECURITY
All communication between the App and our servers is encrypted in transit using HTTPS/TLS. Requests are authenticated with a per-device secret token. Authorization is enforced on the server for every location read, every SOS delivery and every ring request, so that a person who has not been approved by you cannot retrieve your data or ring your phone even if they know your phone number. Invitation codes are single-use and expire after 10 minutes. Rate limits are applied to registration, invitation and acceptance attempts.
No system is perfectly secure. We cannot guarantee absolute security but we apply measures appropriate to the sensitivity of location data.
8. YOUR RIGHTS AND CHOICES
Stop sharing: Turn off sharing in the App at any time, or use the "Stop sharing" action in the notification.
Revoke a person: Remove any person's permission from the People screen; access ends immediately.
Withdraw ring permission: Turn off the "allow ring" switch for any person at any time.
Stop an SOS: Stop your own active SOS at any time from the App; in any case it stops being displayed after 5 minutes.
Control notifications: Turn notifications off in the App or in system settings; this also deletes your push token from our servers.
Revoke permissions: Withdraw location or notification permission in Android system settings.
Delete your account and data: Use "Delete account" in the App's Profile screen, or follow the steps on our account deletion page, or email us at the address below. This deletes your profile, your connections, your saved places and their alert-recipient selections, your stored locations, your location history, your SOS and find-my-phone records, your push notification token, your entitlement records, any positions still waiting to upload on this device, your pending QR/6-digit invitation records, your sharing-session records, and any "someone is watching" signal stored for your device.
Access, correction, portability, objection, restriction: Where applicable law grants these rights (including GDPR and the CCPA/CPRA), you may exercise them by contacting us. We respond within the period required by law. We do not discriminate against users who exercise their privacy rights.
9. CHILDREN
The Services are not directed to children under 13 (or the minimum age of digital consent in your jurisdiction), and we do not knowingly collect their Personal Data. Where a parent or guardian sets up sharing for a minor in their family, the parent or guardian is responsible for obtaining the consent required by local law and for informing the minor that their location is shared. If you believe a child has provided us data without the required consent, contact us and we will delete it.
10. LAWFUL USE ONLY
The App is designed for consent-based sharing within a family. Using it to track any person without their knowledge and consent is prohibited, may be unlawful in your jurisdiction, and violates our terms. We do not provide any covert or hidden tracking capability: the App cannot be configured to share a device's location without an active, visibly notified sharing session on that device, and it cannot ring or locate a device that has not explicitly entered an invitation code.
11. INTERNATIONAL TRANSFERS
Our service providers operate globally, so your data may be processed in countries other than your own, including the United States. Where required, such transfers rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses.
12. CHANGES TO THIS POLICY
We may update this Policy. The "Last Updated" date reflects the latest revision. Material changes will be notified in the App or by other reasonable means before they take effect.
13. CONTACT US
For privacy questions, data access or deletion requests, contact BILLIONX LABS LIMITED at support@billionx.co.