Privacy Policy — What Can Kill Me

Effective date: 9 September 2026

Who we are: What Can Kill Me, P.O. Box 300184, Escondido, CA 92030, United States. Email: admin@whatcankillmeapp.com.

This policy covers the What Can Kill Me iPhone app. The website at whatcankillmeapp.com has its own, separate privacy notice.

The short version

What Can Kill Me collects the account details you give us, the hazard reports you choose to file, and the location data attached to them. We do not run advertising, we do not use analytics, attribution, or cross-app tracking, and we do not sell your personal information or share it with anyone for their own marketing.

Some of what you put into this app is deliberately public: a hazard report is meant to be seen by other people, and that is the point of filing one. Everything else — your trusted contacts, your Alert Places, your Trip Packs, your check-ins — is private to your account.

The app is offered in the United States. See "Where the app is offered."

What we collect, and why

Account

• Email address and password. Used to sign you in. Passwords are handled by our authentication provider (Supabase) and are stored hashed; we never see them.
• Username and avatar icon. Shown next to reports you file, unless you hide your username on a report.
• Trust score, badges, and report counts. Calculated from your activity in the app.
• Your acceptance of the Terms of Use and this policy. We record which version you accepted, when, and from which app build, so we can show that you agreed and tell you when something material changes.

Hazard reports — public by design

A hazard report is a warning for other people, so it is public. When you file one we store, and other people can see:

• the hazard category, subcategory, and specific hazard, including any label you typed for "Other / Not Listed";
• the severity you chose;
• your written description;
• any photo you attach;
• the report's coordinates — either where your phone was when you filed it ("My location") or the spot you pointed to on the map;
• whether the position came from your phone or from a pointed pin;
• the time the report was filed, to the minute;
• your altitude, rounded to the nearest 100 feet, your phone's GPS accuracy as a band (good, fair, rough), and, for a pointed pin, roughly how far you were from it (close, at a distance, far away);
• the report's status and how many other people have confirmed it;
• your username, avatar, and trust score, unless you chose to hide your username on that report.

Your phone's compass heading is stored with a report but is not shown to anyone.

A "My location" report publishes where you were standing. The app tells you this on the Report screen and offers "Point on the map" instead. If you are at home, at a campsite, or at your car, point on the map.

Hiding your username does not necessarily make a report anonymous. It removes your username, avatar, trust score, and photo from what other people see. The location, time, and description stay public, and together they may still let someone work out who filed the report. Do not put anything in a description or photo that you would not want a stranger to read.

Photos. We remove embedded metadata, such as EXIF location and camera data, before a photo is stored. Photos are stored in a public bucket and are visible with the report. Do not photograph people in a way that identifies them without their agreement.

Location

We ask for your location only while the app is in use. It is used to:

• center the map on you and show how far away hazards are;
• attach coordinates to a report you file, if you choose "My location";
• attach coordinates to a safety check-in, if you choose to send one;
• check whether a new report falls inside one of your Alert Places;
• work out sunset and remaining daylight where you are — this happens entirely on your phone; the coordinates are not sent anywhere for it.

We do not track your location in the background, and we keep no record of where you have been. The only positions we store are the ones you choose to send: the coordinates on a report you file, the coordinates on a safety check-in, and the centers of Alert Places and Trip Packs you save.

Safety check-ins and trusted contacts

Trusted contacts are the names, phone numbers, and relationships (such as "Spouse" or "Friend") you enter for check-ins. They are stored in your account so they are there on your next phone, and a copy is kept on your phone so Need Help works without a data connection. By adding a contact you confirm that you have that person's agreement to receive check-in messages from you.

We never send messages on your behalf. Tapping "I'm Safe" or "Need Help" opens your own phone's messaging app with a message prepared — your status, your location, and a map link — and nothing is sent until you send it. The message goes directly from your phone to your contacts and does not pass through us.

Each check-in you send — its time, status, and location, and whether the text was sent, skipped, or not sent — is stored in your account, visible only to you under Check-in history, until you delete it or delete your account.

Alert Places and Trip Packs

The name, center, radius, and hazard filter of each Alert Place you save, and the area and contents of each Trip Pack you save for offline use. Private to your account. A copy is kept on your phone for offline use.

Premium membership

If you subscribe to Premium, we store which plan you hold and when it expires.

Payment is handled by Apple. We never receive, see, or store your card details. Subscriptions are managed for us by RevenueCat, a subscription service provider. RevenueCat processes subscription and purchase information — which product you bought, when it renews or expires, and your account identifier (the same random id our database uses for you, not your name or email) — together with the details any server sees when a phone connects to it, such as your IP address and device model. That is what lets your subscription follow you to a new phone. RevenueCat's privacy policy governs what it does with this information.

We do not use behavioral analytics, advertising, attribution, or cross-app tracking SDKs, and we do not use RevenueCat or anything else to build a profile of you.

Content reports and blocks

If you report another person's content, we store which report you flagged, the reason, your note, and your account id. If you block an account, we store the block so the app can hide that account's reports from you.

Device, network, and security information

Like any online service, our providers see the technical details of a connection: your IP address, device type, operating system version, app version, and the time of each request. Our authentication provider keeps a security log of sign-ins, sign-outs, and session refreshes with the IP address and device details, and our hosting provider keeps short-lived request logs for the app's server functions. These are used to run the service, keep it secure, and diagnose problems. We do not use them to profile or track you.

Queued reports on your phone

If you file a report without a connection, it is saved on your phone — including its description, coordinates, and photo — until the app next opens with a connection and sends it. Queued reports are yours: they leave your phone only when they are sent.

What we do not do

• No advertising, anywhere in the app.
• No analytics, attribution, crash-reporting, or tracking SDKs. (True as of this version — this section will be revised the moment one is added.)
• No selling of personal information, and no sharing of it for anyone else's marketing.
• No background location tracking.
• No third-party sign-in providers.
• No push notifications. Alerts are checked when the app is open.

How we share information

Public content. Hazard reports, with the elements listed above, are visible to every user of the app. That is their purpose.

Service providers. We share information with companies that process it on our behalf, under contracts that limit what they may do with it:

• Supabase — our database, authentication, file storage, and server functions.
• RevenueCat — subscription management (see "Premium membership").
• Apple — payment and the App Store.
• Resend — email delivery. When you report another person's content, the notification to us is sent as an email. It contains your account id, the reported report's category, severity, and description, the username of the person who filed it (if not hidden), the photo path if the complaint is about the photo, and your reason and note.

Public data sources. The app requests public data from government and scientific sources. Each of these requests includes the area of the map you are looking at, because it has to in order to answer. It does not include your identity, your account, or your exact position:

• National Weather Service (weather.gov)
• NASA FIRMS (satellite fire detections)
• National Park Service
• U.S. Geological Survey (earthquakes, stream gauges)
• Avalanche.org and its member forecast centers
• iNaturalist (species observations)
• CARTO, Esri, and OpenTopoMap (map tiles)

Where possible these requests go through our own servers, so those organizations see our server rather than your phone. Their own privacy policies govern what they do with what they receive.

Legal and safety. We may disclose information if we believe in good faith that it is required by law or legal process, or that it is necessary to protect someone's life or safety, to enforce our Terms of Use, or to protect the rights or property of What Can Kill Me or others.

We do not "sell" or "share" personal information as those terms are defined in the California Consumer Privacy Act, and we have not done so in the preceding twelve months. Disclosures to the service providers above are made for the purpose of running the service, not for advertising.

How long we keep information

• Account information (email, username, avatar, badges, trust score, Terms acceptance) — while your account exists, then deleted, except that the record of your Terms acceptance may be kept as long as we need to show that you agreed.
• Trusted contacts, check-ins, Alert Places, Trip Packs, blocks — until you delete them or delete your account. Check-ins are kept indefinitely until then; you can delete any single check-in from Check-in history.
• Hazard reports — while they are on the map. When you delete your account, your reports are de-identified as described in the next section. A report you withdraw is hidden from everyone but you; it stays in the database so you can restore it, and is de-identified when your account is deleted.
• Content reports you made about others — kept for our moderation records after your account is deleted, without your account id.
• Security and request logs — kept by our providers for a short rolling period, up to about seven days.
• Backups — our hosting provider keeps rolling backups for up to about seven days. Deleted information may remain in a backup until it rolls off.
• RevenueCat and Apple — keep purchase records under their own policies. When you delete your account, we ask RevenueCat to delete your subscriber record. Apple's receipts for your purchases remain with Apple.

Deleting your account

To delete your account, open Menu → Delete Account in the app and confirm. There is no recovery period. When you do:

• your login, username, avatar, badges, and trust score are deleted;
• your trusted contacts, check-in history, Alert Places, Trip Packs, blocks, and report confirmations are deleted;
• the description and photo on every hazard report you filed are deleted, and the photo file is removed from storage;
• the rest of each hazard report stays on the map as a de-identified warning — the hazard, its severity, its exact location, when it was reported, and its confirmation count — no longer linked to any account.

We keep the de-identified hazard record because other people plan routes around these warnings. Removing a warning silently could leave someone walking into a hazard nobody told them about, and once the description and photo are gone, what remains describes the hazard, not you.

Deletion begins immediately. Limited information may remain temporarily in backups and security logs until those roll off, as described above.

Deleting your account does not cancel a Premium subscription. Cancel it first in Settings › Apple Account › Subscriptions, or Apple will keep billing you.

Your choices and rights

You can change your username and avatar, hide or show your username on any report you filed, withdraw or restore any report you filed, delete individual contacts, check-ins, Alert Places, and Trip Packs, and delete your account, all from inside the app.

You can ask us what personal information we hold about you, ask us to correct it, or ask us to delete it, by emailing admin@whatcankillmeapp.com. Depending on where you live, you may have further rights under laws such as the California Consumer Privacy Act. We will respond to verified requests as required by applicable law, and we will not treat you differently for exercising them.

The app does not respond to "Do Not Track" browser signals, because it does not track you across other sites or apps; there is nothing for the signal to switch off. Global Privacy Control signals are honored to the extent the law requires, which today means nothing changes, because we do not sell or share personal information.

Where the app is offered

The app is offered in the United States, and our providers store your information in the United States. If you use the app from elsewhere, you understand that your information is transferred to and processed in the United States. Before offering the app in other countries, we will add the notices those countries require.

Children

The app is for adults. You must be 18 or older to create an account, and we do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has created an account, email admin@whatcankillmeapp.com and we will remove it.

Security

We use safeguards designed to protect your information: encryption in transit, hashed passwords, and database-level rules so that one account cannot read another account's private data. No system can be guaranteed to be secure, and we will not claim otherwise. If we learn of a breach affecting your information, we will notify you as the law requires.

Changes to this policy

If we change this policy we will update the effective date above. For material changes we will tell you in the app and, where the law requires it, ask you to accept the new version before you continue.

Contact

What Can Kill Me P.O. Box 300184 Escondido, CA 92030 United States

admin@whatcankillmeapp.com