Skip to content

Privacy Policy

Last updated: 28 April 2026

Safewords is a tool that lets a family or trusted group share a rotating "safeword" they can ask each other for during phone calls — to defend against AI voice-cloning scams. It is available as a web tool at safewords.io and as mobile apps for iOS and Android. Everything is designed to work entirely on your device.

What we collect

Nothing. Safewords does not collect, transmit, store, or share any personal information. There is no account, no login, no analytics, no advertising, and no telemetry.

What stays on your device

On the mobile apps:

  • Your group seeds (used to derive the rotating safeword)
  • Group names and the names you give your circle
  • App preferences (rotation interval, biometric lock, accessibility mode, etc.)
  • Optional emergency override word

Seeds and override words are stored using Android's EncryptedSharedPreferences (hardware-backed where available) or iOS Keychain. Deleting the app removes everything.

On the web tool (safewords.io):

Drill progress and reading history are saved in your browser's localStorage so you can pick up where you left off. This data never leaves your device and can be cleared at any time by clearing your browser data.

What we send over the network

Nothing. The Safewords mobile apps make no network requests. The web tool loads as static HTML/JS/CSS and makes no API calls. The only time data leaves your device is when you deliberately share it — for example, by displaying a QR code so a family member can scan it, or by sending an SMS invite using your phone's normal messaging app.

Permissions (mobile apps)

  • Camera — used only when you tap "Scan QR" to join a group. The camera is never used in the background.
  • Biometric — used only if you turn on "Require biometrics to open" in Settings.
  • SMS (optional, indirect) — when you tap "Invite via SMS", we open your default SMS app with a prefilled invite. We never send messages on your behalf.

Hosting (web)

The safewords.io site is hosted as static files. The hosting provider may collect standard server logs (IP addresses, request timestamps) as part of normal web server operation. We have no access to or control over these logs.

Third parties

None. Safewords does not embed third-party SDKs for analytics, crash reporting, advertising, or any other purpose. No Google Analytics, no Facebook Pixel, no advertising networks.

Children

Safewords is suitable for all ages. Because we collect no personal data, there is nothing to disclose under COPPA, GDPR-K, or similar regimes.

Changes

If this policy ever changes, the "last updated" date above will change. We will not retroactively expand data collection without an explicit, opt-in update.

Contact

Questions or concerns: mail@theholding.company.

Safewords is published by The Holding Company. The full source of the privacy posture above is encoded in the apps themselves: zero network calls, zero analytics, zero accounts.