Jack: Privacy Policy

Version: 2026-10-16
Last updated: 16 October 2026

This policy explains what Jack collects, why, who receives it, how long it is kept, and your rights.

1. Who is responsible

Absolute Red
Email: aphonemyat736@gmail.com

2. In short

• We do not sell your information, use it for advertising, or use artificial intelligence on it.
• Names, contact details, locations, reports and evidence are encrypted on our server.
• Reports and evidence are encrypted, and our staff have no tool to read them.
• We do not store IP addresses or use tracking tools.
• The Help letter, your PINs and your fingerprint never leave your phone.
• You can download your data and erase your account yourself, in the app.

3. What we collect

Account: the email address or phone number you sign in with (encrypted), or an account ID from Google, Facebook or Telegram; passkeys (a public key only); a scrambled form of your backup code; your sign-ins (device name, time, and a random key the phone makes); an extra email for alerts and your Telegram chat, if you add them (encrypted).

Profile: your Case ID, the name you show (encrypted), age range, gender if you give it, region, language and settings.

What you do in the app:

• check-ins: when, and whether you chose "I'm here" or "I need help";
• your status, alerts you send, and notifications sent to you;
• your trusted contacts: the name you gave them and their email or phone (encrypted), and what each may see;
• reports, which can include another person's name and story (encrypted);
• help requests: type, urgency and your details (encrypted);
• evidence: your files, their names and notes (encrypted), size, type and a fingerprint (hash).

Location: only while sharing is on, your latest position (encrypted), also when the app is closed. Each new position replaces the last. There is no history. With the duress PIN, turning sharing off only looks done and sharing continues (see the Terms, section 8).

Outdoor mode: only while it is on, when your time ends, when your phone was last online, and when its battery first fell below 10%. Cleared when Outdoor mode ends.

Problem reports: if the app crashes, it asks before sending (you can change this in Settings). A report holds the app version, phone model, Android version, the screen, the error, the day and a note if you write one. It does not include who you are. Please do not write personal details in the note.

We do not collect your contacts, other photos, Wi-Fi or Bluetooth data, advertising IDs, or analytics. Our server uses IP addresses only briefly, in memory, to block attacks, and does not store them. Our hosting provider may keep its own logs.

4. What stays only on your phone

The Help letter, your App lock and duress PINs, your fingerprint or face (checked by Android, never seen by the app), and your App lock, disguise and display settings. Signing out wipes the Help letter.

5. Why we use it

Only to run Jack: check-ins, alerts, telling your trusted contacts, location sharing, reports, help requests, evidence and Outdoor mode; protecting your account; stopping misuse; public figures that never show who anyone is; fixing crashes; and keeping the records the law expects (your consents and an audit log).

We rely on your consent, which you give when you sign up and again if these texts change, and for the most sensitive information on your explicit consent.

6. Who else receives information

• Hosting: a cloud hosting provider. Encrypted information stays encrypted.
• Email (Google (Gmail)): your email address and our messages: sign-in codes, reminders and alerts. Alert emails never contain a name, a place or what anyone wrote. They say what kind of update it is, how urgent, and when. With "Discreet notifications" on, every email only says "You have an update".
• Telegram, if you connect it: sign-in codes and a neutral notice. Details show only when you tap "Show details", hide again after 2 minutes, and are deleted after 24 hours.
• Google and Facebook, if you sign in with them: they confirm who you are. On Android, signing in with Facebook opens the Facebook app through Facebook's login library. It starts only when you tap the Facebook button, and its automatic reporting and advertising ID are switched off.
• Map services (Esri, OpenStreetMap): map pictures come through our server, so they never see your phone.
• OpenTimestamps: only the fingerprint (hash) of an evidence file, to prove it has not changed. Never the file or who you are.
• GitHub (our private code storage): crash details only, nothing about any person.
• Google Play and Android: under Google's own policies.
• Sponsors receive nothing. Some Tool kit guides end with a "Supported by" card for an organization that helps fund Jack. Every phone gets the same cards from our server, and we do not count who sees or taps them. Opening a sponsor's website is your choice, and that website's own policy applies.

Protection organisations receive nothing: this feature is switched off.

7. Sensitive information

Jack can hold information about trafficking, exploitation, forced recruitment, abuse, health and location. We encrypt it, our staff have no tool to read reports or evidence, location is kept only while you share it, and it is never used for advertising or profiling. You can withdraw your consent by erasing your account.

8. Information about other people

You can report someone without their agreement. Give only what is needed for their safety, and only what you believe is true.

If you are named in a report: we do not tell anyone who made it, unless a court orders us to. We have no tool to read reports, so we may not be able to find or change it, but you can contact us.

9. Children

People aged 13 or older can use Jack, including people under 18. It is not meant for children under 13, and registering asks you to confirm your age. We do not check it or ask for a parent's consent. There are no public profiles, no ads based on who you are and no tracking.

10. Police, courts and governments

We give information only when the law requires it, and no more than it requires. We cannot give what we do not have: the Help letter, your PINs, your fingerprint and IP addresses.

11. Other countries

Our server and the services in section 6 may be in other countries than yours.

12. Public figures

We publish totals, such as missing-person reports by region. Numbers from 1 to 9 are hidden, others are rounded, and figures are published on a schedule, never as each report arrives, so nobody can be picked out.

13. How long we keep it

• Account, profile, check-ins, alerts, notifications, help requests, trusted contacts, extra email and Telegram: until you remove them or erase your account.
• Location: only the latest position, deleted when you stop sharing.
• Reports: until you erase your account. You can restore a withdrawn report within 7 days. A withdrawn report is kept, marked as withdrawn, so a mistake or a withdrawal made under pressure can be undone.
• Evidence: 730 days (2 years), or less if you delete it, unless under a legal hold.
• Sign-ins: 30 to 90 days, then deleted a week later.
• Consent records: kept as proof of what you agreed to. Marked withdrawn when you erase your account.
• Audit log: 6 years. It records actions such as "account erased", never what your reports say.
• Problem reports: 1 year.
• Server backups: up to 14 days. Something you erase is gone from them after that.

14. Legal hold

Rarely, we may keep evidence that would otherwise be deleted, even after you erase your account: for a court order or other legal duty, a legal claim or investigation, to protect someone's life or safety, or to stop abuse of the app. Every hold has a written reason and is recorded. When you erase your account, the app tells you if any files are held.

15. Erasing your account

In the app, under Privacy. It deletes your sign-in details, name, check-ins, trusted contacts, location, alerts, notifications, evidence (except any under a legal hold), Telegram connection and extra email, and the names and stories in reports you made about others.

What stays cannot identify you: your Case ID, age range, gender, region, status history, and the type, region and month of reports, so public figures stay correct.

With the duress PIN, erasing only looks done. Nothing is deleted, so you do not lose your information.

16. Security

Encryption on our server and between your phone and the server; no passwords to steal; our staff have no tool to read reports or evidence; a tamper-evident audit log; "Confirm it's you" before important changes such as adding a trusted contact or downloading your data; and on the phone, App lock, the duress PIN, blocked screenshots and a disguised name and icon.

No system is perfectly safe. Someone who takes and unlocks your phone may see what is on it, and a trusted contact may misuse what you share. Jack has not yet had an independent security review.

17. Your rights

You may have the right to see, copy, correct or delete your information, to object to how we use it, to withdraw consent, and to complain to a data protection authority.

In the app you can do most of this yourself: Download my data and Delete my account and data (Privacy page), and change your name, settings and trusted contacts. For anything else, email us. For your safety, we never change or delete an account because of an email alone. Some rights have limits, for example under a legal hold.

18. Changes

When this policy changes in an important way, the app asks you to agree again. Emergency features keep working while you decide.

19. Contact

Absolute Red
Privacy: aphonemyat736@gmail.com
Security problems: absolutered001@gmail.com

You can also complain to the data protection authority where you live. The English version of this policy is the binding one.