Faro Privacy Policy

Last Updated: September 9, 2026

Your privacy is a core part of Faro's mission. This Privacy Policy explains what personal data we collect, how we use it, and your rights concerning that data. This policy is a legally binding part of our agreement with you, alongside our Terms of Service.

1. Who We Are (The Data Controller)

The company responsible for your data (the "data controller") is:

Evelien De Bruyne
Schepenhuisstraat 37
9000 Gent, Belgium
VAT: BE0500 581 960
Contact Email: privacy@getfaro.app
For any privacy-specific questions, you can reach us at this email address.

2. The Data We Collect

We collect only the data that is essential to provide and improve the Faro service. We have designed our systems to collect as little data as possible.

Data You Provide to Us Directly:

• Account Information: When you create your Faro account, we collect your name and email address. We also store your password in a secure, hashed format.
• Emergency Contacts: To use the service, you provide the name, email address, and phone number for your designated Emergency Contacts. You must have their permission to provide us with this information.

Data We Collect Automatically When You Use the Service:

• Precise GPS Location Data: This is the most sensitive data we handle. We only collect your GPS location data to create a location path when a safety timer is actively running. We do not track your location at any other time.
• Device and Usage Information: We may collect basic information about your device (e.g., device model, operating system, battery level) and anonymized usage analytics. This helps us troubleshoot issues and improve the app.

Data We Collect When You Visit Our Website (getfaro.app):

• Advertising and Analytics Data: If — and only if — you accept in the cookie dialog we show when you first visit, we set cookies from Meta (Facebook/Instagram), Reddit, and Google Analytics. These record which pages you view, which links you click (such as the link to Google Play), the site that referred you, your approximate location, and basic browser information. We use the Meta and Reddit data solely to measure whether our ads bring people to Faro, and Google Analytics to understand how the site is used. If you decline, none of these cookies are set and no data is sent to Meta, Reddit, or Google. The app itself does not contain any of these tools.
  This applies only to our marketing pages (the homepage and the tester feedback page). This privacy policy page, our Terms of Service, and the account-deletion, email-verification and check-in pages set no such cookies at all — which is why you are not asked to consent to anything when you land on them.

3. How and Why We Use Your Data (Purpose and Legal Basis)

Under the GDPR, we must have a valid legal reason (a "legal basis") for each way we use your data.

• To Provide the Core Service (Legal Basis: Performance of a Contract)
  We use your Account Information to create and manage your account.
  We use your Emergency Contact details to send an alert if your timer expires, which is the central function of the service you have contracted us for.
• To Provide Safety Features (Legal Basis: Explicit Consent)
  We use your GPS Location Path to include in an alert sent to your contacts. We will always ask for your explicit consent to access your location before you start a timer. You can withdraw this consent at any time through your device's settings.
• To Improve Our Service (Legal Basis: Legitimate Interest)
  We use anonymized Device and Usage Information to understand how our app is being used, fix bugs, and make improvements.
• To Measure Our Advertising and Improve Our Website (Legal Basis: Consent)
  We use Advertising and Analytics Data from our website to understand which ads and channels bring people to Faro, and how visitors use the site. This happens only after you accept in the cookie dialog we show when you first visit. You can withdraw your consent at any time using the "Cookie choices" link in the website footer, or by clearing cookies in your browser.

4. Data Sharing and Third Parties

Your trust is paramount. Our policy on data sharing is simple:

• We do not sell, rent, or trade your personal data with any third-party data brokers or for marketing purposes.
• Your sensitive GPS Location Path is shared only with your designated Emergency Contacts, and only if an alert is triggered.

To operate our service, we rely on a few trusted third-party companies ("sub-processors"). We have chosen them for their commitment to security and privacy. They are:

• Supabase: Provides our secure backend database and hosting.
• MailerSend: Delivers the email alerts to your contacts.
• Sinch: Delivers the SMS alerts to your contacts, for Standard and Premium plans.
• RevenueCat: Securely processes our subscriptions via the App Stores.
• Sentry: Helps us detect and fix crashes and errors in the app.
• Expo (EAS): Delivers app updates and push notifications.

These partners only have access to the data necessary to perform their specific function and are contractually obligated to protect it.

Advertising and analytics partners (website only). If you accept in the cookie dialog we show when you first visit, our website shares data with Meta Platforms Ireland Ltd. (see their privacy policy) and Reddit, Inc. (see their privacy policy) to measure our ad campaigns, and with Google Ireland Ltd. (Google Analytics — see their privacy policy) to understand how the site is used. For this data they act as independent controllers under their own privacy policies. If you decline, nothing is shared with any of them.

5. Data Retention and Deletion: Our Core Privacy Commitment

This is the most important part of our privacy promise to you.

The location path data associated with your safety timer is permanently and immediately deleted from our servers the moment you successfully check in as 'safe' by pressing the 'I'm OK' button. 3

If your timer expires without a check-in and an alert is sent to your emergency contacts, that timer's location path is retained for 30 days from the timer's end time — not deleted immediately — so it remains available to you, your contacts, or authorities if the situation is only recognized or escalated later. After 30 days, it is automatically and permanently deleted.

Other data, such as your account information, is retained only for as long as your account is active. If you choose to delete your account, we will permanently delete your remaining personal data in accordance with our policies.

6. Data Security

We take the security of your data seriously. We use industry-standard technical and organizational measures to protect it, including:

• Encryption of data both in transit (using TLS/SSL) and at rest.
• Use of a secure cloud infrastructure with strict access controls.

7. Your Rights Under GDPR

As a user in the EU, you have specific rights over your personal data. These include:

• The Right to Access: You can request a copy of the personal data we hold about you.
• The Right to Rectification: You can correct any inaccurate data we have about you.
• The Right to Erasure (The "Right to be Forgotten"): You can request that we delete your personal data.
• The Right to Data Portability: You can ask for your data in a machine-readable format.
• The Right to Restrict Processing: You can ask us to stop processing your data in certain circumstances.
• The Right to Withdraw Consent: You can withdraw your consent for location tracking at any time via your device settings, and your consent for website advertising cookies at any time via the "Cookie choices" link in the website footer.

To exercise any of these rights, please contact us at privacy@getfaro.app.

8. International Data Transfers

Some of our third-party service providers may be located outside the European Economic Area (EEA). When we transfer data to them, we ensure it is protected by using legal mechanisms approved by the European Commission, such as Standard Contractual Clauses (SCCs). 2

9. Children's Privacy

The Faro service is intended for users who are 18 years of age or older. We do not knowingly collect any personal information from children under the age of 18. If we become aware that we have collected data from a child, we will take steps to delete it immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes, and your continued use of the service after such notice will constitute your acceptance of the new policy.