GDPR-compliant alerts

Nothing that could identify anybody

Subscribing needs no account, no email address and no phone number. What a subscription actually holds is a random identifier the app generated, a platform, an app version, a language and a time zone — coarse enough that hundreds of millions of people share one. There is no name, no contact detail, no advertising identifier and no location, and there is no export that would let an operator build one. You cannot leak a list you never collected.

Draw a circle without knowing who is inside it

You place a centre and a radius on a map, and the circle travels attached to the alert. Every subscriber’s phone receives it and compares its own position locally, then decides whether to show it. No subscriber position is ever sent to us, which is why this is a design fact rather than a promise: there is no column anywhere that could hold one. Two consequences follow deliberately. A geofence only ever narrows — it cannot add somebody who did not subscribe. And it fails open: a phone that cannot work out where it is shows the alert rather than hiding it, because missing an evacuation is worse than seeing one meant for the next street.

Private means sealed, not merely unlisted

A private channel is not one that is simply missing from a directory. It requires an invite code both to subscribe AND to read anything about it, and a request without one gets exactly the same “not found” as a handle that never existed — because a different answer would let anybody confirm that a school’s or an ops team’s channel exists by guessing its name. Invite codes can carry a use limit and can be revoked; revoking is a timestamp and by default removes nobody who already joined.