Legal
Privacy policy
This policy covers StandingBy: the mobile app, the service behind it, the texts and calls it sends, the consent page at app.standingby.io, and this website. StandingBy is made by Straight A Software LLC, a Massachusetts limited liability company ("we", "us").
Two kinds of people are involved. A user installs StandingBy and sets up check-ins. A contact is someone a user chooses to be told if they stop checking in. Contacts do not need to install anything, and we hold information about them anyway. This policy explains both.
In short
- We collect what is needed to remind users to check in and to tell their contacts when they do not.
- We hold the names and phone numbers of contacts, who may never have used StandingBy.
- We never sell phone numbers or any other personal information, and never share them for marketing.
- No advertising, no tracking across other apps or websites, and no cookies or analytics on this website.
- Account and contact data are deleted within 30 days of a deletion request. Records of what we sent, and of consent and opt-outs, are kept for 4 years.
- To delete anything, email support@straightasoftware.com. Contacts can also reply STOP.
StandingBy has not been released. Until it is, the app and service are not collecting information from the public. This policy describes how they are designed to work at launch.
1. Information about users
Your account
- How you sign in. TODO: sign-in method not yet decided (for example Sign in with Apple, email, or phone number). List exactly what it collects.
- Your display name. It is included in every message we send to your contacts, so they know who the message is about.
- Your phone number, if you turn on check-in reminders by text.
The people you add
For each person you add, we store the name you give them and their phone number, as well as any circles you put them in. When you add someone, we check with a phone number lookup service whether the number can receive texts and calls. We also record whether you sent them an introduction, and whether they agreed to be contacted or opted out. See section 2.
If you pick people from your phone's contacts, the app receives only the contacts you pick. It does not read your address book.
Your profiles and sessions
- Profiles: each profile's name, check-in schedule, steps, the wait before each step, who each step contacts, and how.
- Style: whether a profile is Obvious or Disguised, and which cover story it uses. We store only the choice, so a new phone can restore it. The cover story screens themselves stay on your phone and are never sent to us.
- Sessions: when each session started and ended, your check-ins, missed check-ins, uses of SOS, the time zone the session ran in, and a record of every text and call sent, to whom, and whether it was delivered.
Profile names are never shown to your contacts.
Location
If you turn on location for a step, and allow StandingBy to use your location, the app collects your phone's location during a session. It is included in the messages that step sends to your contacts. We do not collect location outside a session, or for steps where it is off. You can turn it off for any step, or remove the app's location permission in your phone's settings at any time. TODO: confirm against the product contracts, see source comment
Your devices
To remind you to check in and to show your sessions correctly, we collect for each device:
- a push notification token,
- whether notifications are allowed, including higher-priority ones,
- app version, operating system and version, language and region, and time zone,
- your check-in gesture preference, so a new device can restore it.
When you contact us
If you email us, we have your email address and whatever you write.
2. Information about contacts
If a user added you, we hold information about you even if you have never used StandingBy.
What we hold
- Your phone number, and the name the user gave you. If more than one user added you, each has their own entry.
- Whether your number can receive texts and calls, from a phone number lookup service.
- The StandingBy number assigned to contact you.
- Introduction and consent status: whether the user sent you an introduction, and whether you agreed to be contacted or opted out.
- Consent records: when you agreed or withdrew, the exact version of the wording you were shown, whether you tapped to save our contact card, and technical details of the request such as IP address and browser type. TODO: confirm the technical fields actually stored
- Message records: each text and call we sent you, when, and whether it was delivered, along with any replies you send.
We cannot tell whether you saved our number to your contacts, and we do not try to find out.
Where it comes from
From the user who added you, from you (on the consent page or by replying to us), and from phone carriers and the lookup service.
What we tell the user about you
Whether you agreed to be contacted, whether you opted out, whether your number can receive texts and calls, and what we sent you and whether it was delivered. If you opt out, we tell the user straight away that you can no longer be reached.
What we tell you about the user
Their display name, and that they have or have not checked in. If the user turned on location for that step, their location too. TODO: see the location conflict above Never their phone number, their profile name, why they set it up, or anything about other contacts.
3. This website
standingby.io uses no cookies, no analytics, no advertising and no trackers. Fonts are served from our own site. The site is hosted by Cloudflare, which processes technical information such as IP addresses to deliver pages and protect against attacks.
If you email hello@straightasoftware.com to hear when StandingBy is available, we use your address only for that, and delete it once we have told you or you ask us to.
4. How we use information
We use information only to:
- run StandingBy: remind users to check in, contact the people they chose when a check-in is missed, and tell those people when it was a false alarm,
- show users whether their contacts can be reached,
- honour opt-outs, and keep records of consent and of what we sent,
- keep the service reliable and secure, and prevent misuse,
- answer support requests,
- comply with the law.
We do not use it for advertising, we do not build marketing profiles, and we do not track you across other companies' apps or websites.
5. Phone numbers
We never sell phone numbers, and we never share them for marketing or promotional purposes. This covers users' and contacts' numbers alike. Mobile information, text messaging opt-in data and consent are not shared with third parties or affiliates for marketing or promotional purposes.
We use a phone number only to send the texts and calls described in our text message and call terms, to check whether it can receive them, and to keep the records described above. We never use a contact's number to promote StandingBy to them.
6. Who we share it with
We share personal information only with service providers that help us run StandingBy, and only as much as they need to do it:
| Provider | What for | What they receive |
|---|---|---|
| Messaging and voice provider TODO: name | Sending texts and automated calls, receiving replies | Phone numbers, message content, delivery status |
| Phone number lookup TODO: name | Checking a number can receive texts and calls | Phone numbers |
| Apple Push Notification service (iPhone) and Firebase Cloud Messaging (Android) | Check-in reminders | Device tokens and notification content |
| Cloud hosting TODO: name | Running the service and storing data | All service data, stored on our behalf |
| Cloudflare | Hosting this website | Technical request data |
| Google Workspace | Emails you send us |
We may also disclose information when the law requires it, such as in response to a valid court order. Where the law allows, we will tell the affected person first.
If Straight A Software is sold or merged, information may pass to the new owner, who must keep to this policy or ask for permission to do otherwise.
7. How long we keep it
| Information | How long |
|---|---|
| User account, profiles, devices | While the account is open. Deleted within 30 days of deleting the account or asking us to. |
| A contact entry (name and number a user added) | Until the user removes it, deletes their account, or the contact asks us to delete it. Then deleted within 30 days. |
| Location collected during a session | Deleted within 30 days of the session ending. TODO: confirm |
| Records of texts and calls sent, and session history | 4 years, then deleted. |
| Consent and opt-out records | 4 years from when they were last relied on, then deleted. |
| Opt-out list (phone number and opt-out date only) | As long as needed to make sure we do not contact that number again. |
| Emails to support | As long as needed to deal with the request. TODO: set a period |
| Launch notification emails | Until we have told you StandingBy is available, or you ask us to delete them. |
Why some records are kept for 4 years. People can bring legal claims about automated calls and texts for up to 4 years. Records of what we sent, and of who agreed and who opted out, are how we show we acted lawfully. If you delete your account or ask us to delete your information, those records are kept but reduced to what that purpose needs: phone number, times, message type and delivery status. Profile names and other details are removed. TODO: engineering to confirm this reduction is built
Deleted information may remain in encrypted backups for up to 30 more days before it is overwritten. TODO: confirm backup rotation
8. Deleting and accessing your information
Users
You can delete your account in the app TODO: in-app account deletion (required by the App Store and Google Play), or by emailing support@straightasoftware.com. Please end any running session first. Deleting your account removes your profiles and the people you added, except for the records described in section 7.
Contacts
- To stop being contacted: reply STOP to any StandingBy text, withdraw on the consent page, or tell us any other way. This stops texts and automated calls.
- To have your information deleted: email support@straightasoftware.com with your phone number. We may ask you to confirm you control the number. We delete your entries from every user's list, and each of those users is told you can no longer be reached. We keep your number on our opt-out list so we do not contact you again, and keep the records described in section 7.
Access and correction
Anyone can ask what we hold about them, or ask us to correct it, by emailing support@straightasoftware.com. Some US states give their residents specific privacy rights. We give these rights to everyone, wherever they live, and we will not treat you differently for using them.
9. Security
Information is encrypted in transit, and access to it is limited to people who need it to run the service. StandingBy is not end-to-end encrypted: our servers must know who your contacts are and their numbers in order to contact them. No system is perfectly secure. If a breach affects your information, we will tell you as the law requires.
10. Children
StandingBy is for adults. Users must be 18 or older. We do not knowingly collect information from children under 13. If you believe we hold information about a child under 13, email support@straightasoftware.com and we will delete it.
11. Changes
If we change this policy, we will update this page and the date at the top. If a change is significant, we will also tell users in the app before it takes effect.
12. Contact
Straight A Software LLC
TODO: postal address (resident agent's office)
support@straightasoftware.com
StandingBy is based in the United States, and information is processed and stored in the United States.