Privacy
An SOS has to say where help is needed, so a report's location is shared on purpose. This page lists everything else BlueMesh keeps, where, and for how long.
What a report contains
Each report is 27 bytes: a random sender id chosen by the app, a sequence number, the location, the type (Rescue, Medical, Trapped or Supplies, or safe), the time by the sender's clock, a target (everyone), a version and a hop count. Anyone whose phone carries the report can read all of it. It contains no name, no phone number and no note.
The optional note you can add to your own SOS stays on your phone and goes to the server only from your phone, when it is online. It never travels over Bluetooth.
On your phone
- Your own reports are kept at least until they expire, 24 hours after you made them.
- Reports your phone carries for others are kept until 24 hours after they were made, then removed as space is needed.
- A short record of reports this phone already has, so a repeat isn't shown twice, is kept for 7 days.
- An SOS you started filling in but didn't send stays as a draft until you send or discard it.
- Your phone's sender id and its counter are kept for as long as the app is installed, so a new report never reuses an old number.
On the server
| What | How long |
|---|---|
| Reports, their earlier versions, uploads, alerts and offers of help | While the report is active, then 30 days after its last update. |
| Where an uploading phone was when it uploaded a report | 24 hours, then erased. It is never used as the sender's location. |
| Your latest shared position, if you turned on nearby alerts and chose to share it | Only the latest one, never a history. Deleted after 24 hours, or as soon as you turn alerts off. |
| Alert areas you saved | Until you delete them, or after 30 days without your phone checking in. |
| Your phone's notification token | Until it's replaced or Apple reports it invalid, or after 30 days without your phone checking in. |
| The profile you saved (name, age, phone, emergency contact, medical details) | Until you delete it in the app, or until your phone's anonymous identity is deleted. |
| Your phone's anonymous identity and its settings | Deleted, with everything above that belongs to it, after 400 days without your phone checking in (7 days for a sign-up that never finished). If the phone comes back later it makes a new identity, sends any SOS it still holds, and saves your profile again. Only a daily count of deletions is kept. |
| What operators did on the dashboard | 365 days. |
| Public hazard feeds (USGS earthquakes, National Weather Service alerts) | The latest copy only. |
Who can see what
The operations dashboard is invite-only, and every sign-in needs a password and a code from an authenticator app. Operators see reports, the evidence behind each one, and counts of how many phones were selected and alerted. Viewers see only an area about a kilometre across; operators see the reported pin.
No one on the dashboard, including its admins, can see where alert recipients are, notification tokens, the anonymous account behind a phone, which phone uploaded a report, or where that phone was.
Your account
The app creates an anonymous account for your phone by itself, with no email address or phone number, so it can upload reports and receive alerts. Asking for help never waits for it.
No tracking
There are no ads, analytics or third-party trackers. The app never follows your location in the background to decide who gets alerted; it uses only a recent position you chose to share or an area you saved.