Your location is not our product.

This deployment is operated by Beacon Project. That operator decides why and how account data is processed and is the data controller for the purposes of applicable privacy law. Beacon is open-source software; the project maintainers do not receive data from this deployment.

Privacy questions and rights requests should go to business@kaveeshkrishna.in. The operator may need to verify that you control the account before acting on a request.

Account identity. Name, email address, password hash, timezone, notification choices, MFA configuration, account creation date and sign-in timestamps. Email verification and password-reset tokens are stored as hashes.

Device and location data. Device name, manufacturer, model, Android and app versions, tracking profile, battery level, charging state, network and SIM state, plus location coordinates, accuracy, altitude, speed, heading, provider and timestamps. Geofences you create and the transition events they produce are also stored.

Remote actions. Commands you send to a device, their status, acknowledgement and any message text you choose to include. Command results may include device state needed to explain success or failure.

Security records. Sign-ins, MFA changes, session revocations, pairing, geofence transitions and account changes are written to an audit log. IP addresses are reduced to a keyed hash. User-agent strings are stored to describe sessions and may identify a browser and operating system.

Session data. A random session token is stored in an HttpOnly cookie. The server stores only a keyed hash of that token, along with the browser user agent and hashed IP address.

Email delivery metadata. Recipient, template type, provider, delivery status, provider message id, error code and latency are logged. Message bodies and one-time codes are not written to delivery logs.

Beacon does not include advertising SDKs, behavioural analytics, session replay, fingerprinting scripts or third-party tracking pixels.

• To authenticate you and protect your account and paired devices.
• To display current and historical device location to you.
• To evaluate geofences and deliver the alerts you request.
• To carry out remote actions that you initiate.
• To send transactional email such as verification and security notices.
• To investigate abuse, secure the service and maintain audit records.
• To produce an export or delete data when you ask us to.

Location tracking is user-initiated. Beacon is not intended to track a person without their knowledge or consent where that is required by law. If you use Beacon on a device you do not own, you are responsible for obtaining any necessary consent and for complying with applicable law.

Delivery metadata and account data are kept while the account exists, unless a shorter operational period applies. Location history is pruned by a scheduled job according to the deployment's LOCATION_RETENTION_DAYS setting. Audit events are pruned according to AUDIT_RETENTION_DAYS. Sessions expire automatically and can be revoked at any time.

Account deletion removes the user record and cascades to devices, location history, geofences, sessions, recovery codes and email logs. Encrypted infrastructure backups may retain copies for the operator's backup window; they are not used for normal application queries and are overwritten on the backup schedule.

This deployment depends on infrastructure chosen by its operator. It may include:

• Hosting and database. The web application and database may run on Vercel, Neon or another provider. Those providers process account and location data on the operator's instructions.
• Email. Relay and/or Resend receive the recipient address, subject and rendered message needed to deliver transactional mail. The operator chooses which providers are enabled and the per-account ordering.
• Maps. MapLibre loads style and tile resources from OpenFreeMap. Your browser connects directly, disclosing your IP address and approximate viewport. Stored location history is not sent to the tile provider.
• Push, if enabled. Firebase Cloud Messaging may receive a device push token and a notification payload used to wake the Android app for commands.
• Legal requirements. The operator may disclose data if required by applicable law, after assessing the request. The open-source project cannot access this deployment's data.

Beacon does not sell personal data, share it for cross-context behavioural advertising, or use location history to train advertising models.

Beacon uses a small number of first-party cookies: an HttpOnly session cookie, a short-lived MFA challenge cookie during sign-in, and a theme preference cookie. The Android app stores a device token and an encrypted local location queue in app-private storage. No advertising or analytics cookies are set.

Passwords use Argon2id. Sensitive fields such as TOTP secrets, fallback phone numbers and push tokens are encrypted with AES-256-GCM. Transport is protected by TLS in a correctly configured deployment. Access to the database is limited to the operator and hosting provider.

No system is perfectly secure. If you believe data has been exposed, change your password, revoke sessions and devices, and contact the operator. See the security page for reporting details.

You can update your profile and alert preferences, revoke individual sessions and paired devices, export your data as JSON, and delete your account from Settings. Depending on your location, you may also have rights to access, correct, delete, restrict or object to processing, and to complain to a data protection authority.

Some data must be retained to comply with law or resolve security incidents. The operator will explain any lawful restriction that applies to a request. You can use the export and delete controls even if you do not want to contact the operator.

Beacon is not directed at children. Do not create an account for a child without appropriate authority and consent. Material changes to this notice will be published on this page and, where appropriate, communicated by email before they take effect.