Watchful Guardian — Privacy Policy
Last updated: 28 July 2026
The short version Watchful Guardian records nothing until you activate it. What it captures is encrypted on your device with a key only you hold. If you turn on iCloud backup, those encrypted recordings are also copied to your iCloud so they survive your phone being taken or destroyed, and the trusted contacts you chose can watch them. With that setting off, nothing you record ever leaves your phone. Either way the developer cannot see your location, your recordings, or your contacts — there is no server in the middle.
Watchful Guardian — “Guardian” for short — is a personal-safety and evidence app. This policy explains exactly what it collects, where that data goes, and what it never does.
Who is responsible
Watchful Guardian is developed by Daniel Doucet. For any privacy question, contact .
What Guardian collects, and only when
Guardian collects nothing at all while it is idle. It is not tracking you in the background, not recording, and not sending anything anywhere. Data is only involved when you take one of these actions.
When you activate Guardian (or a safety timer you started runs out)
| Data | Why | Where it goes |
|---|---|---|
| Your location | So your chosen contacts can find you | Sent to your trusted contacts; stored with the incident on your device |
| Audio and video | To preserve evidence of what happened | Encrypted on your device; if iCloud backup is on, an encrypted copy also goes to your iCloud and to the contacts you chose |
| Time of the incident and your note | Context for your contacts and your own log | Your device; the note is included in the alert |
| Your name and phone number | So contacts know who the alert is from | Included in the alert you send |
When you add trusted contacts
Guardian asks permission to access your address book only so you can pick people from it. It reads only the contacts you select, stores their name and phone or email on your device, and never uploads your address book.
When you connect with a contact who also uses Guardian
Guardian creates a random pairing code and publishes alerts through Apple’s iCloud (CloudKit) so that person’s device receives them instantly. Alerts are addressed by that random code — never by your phone number — so nobody can find your alerts by guessing.
When you turn on iCloud backup
Recording only to the phone doesn’t help if the phone is taken or destroyed, so Guardian can copy each recording to iCloud as it is made. Two things happen, and both are your choice to enable:
- A private backup in your own iCloud account. Apple stores it; Apple cannot read it. The encryption key is kept in your iCloud Keychain so that a replacement iPhone can still open your own recordings — without that, losing the phone would mean losing the evidence permanently.
- A copy your trusted contacts can watch. Guardian seals a copy of the key for each contact individually, using a public key their device published when they accepted your invite. Nobody else — including the developer and Apple — can open it.
Shared copies are limited in number and size, and stop being served 30 days after the incident. Deleting the incident removes them sooner. If you would rather no copy ever leave your phone, leave Back up evidence to iCloud off; recording, alerts, and the incident log all still work.
Notifications
If you agree to be someone’s emergency contact, Guardian registers for push notifications so their alert can reach you.
What Guardian never does
- No advertising. Guardian has no ads, ad SDKs, or ad identifiers.
- No tracking. Guardian does not track you across apps or websites, and does not build a profile of you.
- No selling or sharing data. Your information is never sold, rented, or shared with data brokers or marketers.
- No analytics on your movements. Guardian does not log your location for any purpose other than the alert you triggered.
- No developer access. The developer cannot read your recordings, see your location, or view your contacts. There is no server holding your data.
Where your data lives
- On your device. Recordings are encrypted with AES-GCM using a key held in your Keychain, and the incident log is stored locally.
- In your own iCloud. With iCloud backup on, encrypted recordings and their key sync through your Apple account, governed by Apple’s privacy policy. The developer has no access to it.
- With your trusted contacts. Your alert message, your location, and — if backup is on — the encrypted recordings from that incident, which only they can open.
Deleting an incident in the app erases its recordings from your phone, the copy in your iCloud, and the copies shared with your current contacts, including the keys that open them. The one case it cannot reach is a contact you removed before deleting the incident: they were already given access, so their copy remains until it ages out after 30 days.
How long it is kept
Recordings and incidents stay on your device until you delete them. Backups in your own iCloud stay until you delete the incident. Copies shared with a contact stop being served 30 days after the incident. Alert records published for a contact’s device are transient and exist only to deliver that alert. Uninstalling Guardian removes everything stored locally.
Your choices and control
- Permissions. Location, camera, microphone, contacts, and notifications can each be granted or denied in iOS Settings at any time. Denying a permission limits the matching feature; it does not stop the rest of the app working.
- Deleting evidence. Incident Log → swipe an incident → Delete, or “Delete all incidents”.
- Disconnecting a contact. Remove them in Trusted Contacts, or stop being someone’s contact under “People who alert you”.
- Deleting everything. Uninstall the app.
Children
Guardian is not directed at children under 13, and the developer does not knowingly collect information from them.
Emergency services
Guardian does not contact 911 or any emergency service on your behalf, and is not a replacement for them. The 911 button in the app simply asks iOS to place a normal phone call, which you confirm. In an emergency, contact your local emergency number directly.
Legal requests
Because the developer holds none of your data, there is nothing to hand over in response to a legal request. Data on your device or in your iCloud account is subject to your own legal protections and Apple’s policies.
Changes to this policy
If this policy changes, the “Last updated” date above changes with it, and significant changes will be noted in the app’s release notes.