HUM — Privacy Policy

Version: 2026-10-11

1. Who we are

"HUM" (also "we," "us," or "our") is operated by Hum Ltd., a Colorado limited liability company. This policy explains what we collect, why, who sees it, and what you can do about it. It covers the HUM mobile app, the Guardian web portal, the public location-share page, and our servers.

Questions or requests: privacy@humsafety.com.

2. The short version

• HUM is a safety app, so it handles sensitive data by design: where you are, who you would call for help, and when you said you were in danger.
• We do not sell your data, and we do not use it for advertising. We run no ad network, no ad SDK, and no cross-site tracking, and we do not share your data with data brokers.
• We text you one-time codes and account notices, and we do not send marketing texts. We do not share your mobile number or your text-messaging opt-in with anyone for their marketing. Reply STOP to any text to opt out (Terms § 4.6).
• Your location is shared with the people you choose — and, if you turn on Proximity alerts, with nearby users during an alert. It is not otherwise published, and it is not sold.
• HUM does not receive or store your ID documents, biometric identifiers, or card numbers. Identity verification is handled directly by Stripe, and payments run through Apple, Google, and Stripe, as described in § 3.8, § 3.9 and § 6.
• Paying for another person's Guardian seat does not give the organization access to that person's safety data. A Guardian admin sees roster status, not location, alerts, messages, or Circle.
• You can delete your account in the app. What survives, and why, is in § 13.4 — and it is a short, deliberate list.

3. What we collect

3.1 Account and sign-in identifiers

• Your phone number — the primary way you sign in. We send a one-time code to it by SMS to verify it's you, and, if you administer a Guardian plan, account notices about that plan. How those texts work, and how to stop them, is in Terms § 4.6. Your number is also used to reach you for the safety features described below.
• A recovery email (optional) — if you add one, we store it so we can send a one-time sign-in code to it when you no longer have access to your phone number (for example, if you change carriers or numbers). Your account is tied to a stable internal identifier, not to your phone number, so a verified recovery email lets you keep your profile across number changes. We use it only to send these sign-in codes and service notices — not for marketing.
• Your name and username. Your first name (or username, if you turn off "Show my first name in alerts") is what recipients see.

Both identifiers are verified by a one-time code before they are attached to your account, and you can update them at any time from your profile. One-time codes are stored as hashes, expire in 10 minutes, and are invalidated after three failed attempts.

We do not use passwords for HUM accounts, so we keep no account-password database that could be reused elsewhere if it leaked.

3.2 Profile and safety settings

Your safety status, your alert preferences (Proximity alerts and radius, all-clear notifications, default groups, who a High Alert reaches, "verified responders only," whether your real name appears in alerts), and your display preferences.

Medical information (optional). If you fill in the Medical Info field, we store what you write so that it is available in an emergency. This is health information, it is entirely optional, and it is encrypted at rest (§ 12). Leave it blank if you would rather we did not hold it.

Your Safety PIN is stored as a salted one-way hash, not as the PIN itself.

Face ID / biometrics on your device are checked by your phone's operating system. The biometric data stays with your device and we do not receive it — we receive only a pass/fail result.

3.3 Location

• Precise location while you use the app, to place you on the map, to find nearby users, and to attach a location to an alert. The app requests location "while in use" and registers no background location task, so it updates your location while the app is open. Once you leave the app or lock your screen, your device may stop sending new locations, including during an active alert or live sharing.
• A coarse label (neighborhood, district, or city) derived from your coordinates through a third-party geocoding service, used in the notification text recipients see.
• Live location shared with specific Circle members, while that member's grant is on (§ 5.2).
• Share links — a token, the expiry you chose, and an optional label, for each live-location link you create.
• Routes — a destination, an optional origin, a label, and your estimated arrival time when you use route tracking.
• Alert and incident locations — the coordinates of a panic or high alert, and the incident record it creates (type, scenario, start and resolve times, outcome, notes you add, how many people were notified).
• Map reports you post carry the location you posted them at.

Section 5 explains exactly who sees which of these.

3.4 Your Circle and the people in it

The names, phone numbers, email addresses, and relationship labels you enter for Circle members, whether each is in your Inner Circle, and whether you have granted them live-location visibility. These fields are encrypted at rest (§ 12). When a Circle member is also a HUM user, we link the two so alerts and messages reach their account.

Please add another person's contact information only when you have their permission or another lawful basis to provide it to HUM (Terms § 5.8).

3.5 Content you create

Messages, group posts, photos you upload, map reports, group and wellness check-ins and responses, feedback you submit, and incident notes. Photos are stored in private cloud storage and served only through short-lived, signed links. Content you send to another user may remain in that user's account even if you later delete your own copy or your HUM account, as explained in § 13.4.

3.6 Bluetooth proximity

With your permission, the app scans for and advertises to nearby HUM devices so it can show nearby users and pass your safety status along without a network connection. The broadcast carries a status value, not your identity or your coordinates, and this exchange happens between devices.

3.7 Device and notification data

A push notification token for each device you sign in on, the platform (iOS, Android, or web), and basic device and app-version information used to deliver notifications and diagnose problems. Standard server logs (IP address, request time, endpoint, user agent) are kept for security and debugging.

3.8 Identity verification

If you choose to verify your identity, our provider (Stripe Identity) collects your ID document and a selfie directly from you, and checks them.

We receive only the outcome — unverified, pending, verified, or failed — a timestamp, and a session reference used to match up the provider's updates. We do not receive or store your ID document, the images, or any biometric identifier. Stripe processes and retains that material under its own privacy policy and terms.

3.9 Subscriptions and payments

• Hum+ is sold by the Apple App Store and Google Play through RevenueCat. We store the subscription's status, store, product, term, renewal date, and the subscriber identifier we use to match store events to your account.
• Guardian is billed by card through Stripe. We store the organization's Stripe customer and subscription identifiers, seat count, term, and price tier.
• We do not receive, process, or store card numbers or bank details.
• Trial ledger. So that the 30-day trial can be granted once per person, we keep a one-way keyed fingerprint (HMAC) of the phone number a trial was granted to. It is not reversible to a phone number and it is deliberately not linked to your account, so that it survives account deletion.

3.10 Guardian roster data

When an organization buys seats, its admins give us phone numbers, and optionally names and email addresses, for the people the organization wants to cover — including people who are not HUM users and may never become one. We store each entry, its status (invited, claimed, removed), and when it was claimed or last invited. Email invites carry a single-use token, stored as a hash and valid for 14 days.

The organization is the source of this data and is responsible for having the authority to give it to us (Terms § 11.1). We use it for one thing: matching a seat to an account when the person signs up, and sending the invitation the organization asked us to send.

We also keep an activity log for each organization: a record of what its admins changed in the Guardian portal (adding, re-inviting, or removing roster entries; seat and billing changes; inviting, removing, or replacing admins), and of the billing changes Stripe reports, with who made each change and when. An entry refers to a roster entry and to the admins involved. It does not record which HUM account claimed a seat, and it keeps no copy of a phone number or name — it shows each person as their details currently stand.

3.11 Safety and moderation records

• Mutes and blocks: the user IDs of both parties, the time, and the action type. We do not record a reason. Your mute and block lists are visible only to you and to HUM staff during active triage; they are not visible to the muted or blocked user. Blocking also removes any Circle link between you; unblocking does not restore it.
• Reports: your user ID as the reporter, the reported user or group, the category, your description, any context attached at the time (a specific alert, message, or group), the time, and whether you also chose to block.
• Moderation audit log: when a HUM staff member acts on a report (warn, mute alerts, suspend, dismiss, acknowledge), we record the action, which staff member took it, whether it was taken in the admin console or through our internal triage tool, the time, and any notes.
• Rate-limit flags raised when an account exceeds an alert or report limit.

3.12 Consent records

The fact, date, time, and version of the Terms you accepted, that you attested to being 18 or older, and the date you separately acknowledged § 19 of the Terms. We do not collect your date of birth.

3.13 What we do not collect

We do not record audio or video. We do not read your device's contact list. We do not track you across other apps or websites, and we do not use advertising identifiers.

4. How we use it

To deliver safety alerts. We use your real-time location to fan out panic and high alerts to your Circle, the groups you selected, and nearby users you've made eligible via Proximity alerts. The coarse label goes in the notification so recipients can decide whether to help; the precise location is shown only to recipients who open the alert in the app.

To run the safety features you turn on — check-in timers, route tracking and overdue alerts, wellness checks, group check-ins, share links, the map, and Bluetooth proximity.

To operate your account — signing you in, verifying a new number or email, keeping your profile across a number change, and syncing across your devices.

To provide and enforce plans — granting Hum+ from a subscription, a Guardian seat, or your trial; enforcing Free-plan limits; and preventing a single person from farming repeated free trials.

To enforce platform safety. We use report data, the audit log, and rate-limit metrics to identify patterns of abuse (for example, multiple reports against the same account in a short window), to take action ranging from a warning to suspension, and to apply temporary holding actions automatically when an account or group is reported by five or more distinct people within seven days, pending staff review.

To secure the service — detecting fraud, abuse of the request and alert channels, and unauthorized access.

To communicate with you — one-time codes, alert and safety notifications, Guardian invitations sent on an organization's behalf, and service notices about your account or these policies. Notifications you can turn off are listed in § 13.1. The texts we send are limited to one-time codes and account notices; we do not send marketing or promotional texts.

To improve the service. Aggregate metrics about geocoder failures, rate-limit hits, delivery failures, and report volume, used to monitor service health. These are aggregated and contain no personal data.

To meet legal obligations and to establish, exercise, or defend legal claims.

We do not use your data to train machine-learning models, to profile you for advertising, or to make automated decisions with legal or similarly significant effects. The only automated action we take is the temporary holding action described above, which is reviewed by a person.

5. Who sees what

5.1 Recipients of your alerts

When you trigger a panic or high alert, recipients receive:

• Your first name — or your username, if Show my first name in alerts is off.
• A coarse location label (neighborhood, district, or city).
• The fact that you triggered an alert, and which type.

Recipients who open the alert in the app can see your precise location while it is active, along with your name and, if verified, your badge. Who is a recipient depends on the alert: your Circle, the groups you chose, and — for public panic broadcasts with Proximity alerts on — nearby HUM users. If you have chosen "verified responders only," the public part of that broadcast reaches only identity-verified users.

5.2 People you share location with

• Circle members you have granted live-location visibility see you on the map while your location sharing is on. The grant is per person: it starts on for anyone you add straight into your Inner Circle and off for everyone else, you can change it per member at any time, and blocking someone ends it in both directions.
• Anyone holding a share link can open the public page and see your live location until the link expires or you revoke it. The page requires no account and no sign-in — the link itself is the access. The page shows your name, your position, and nothing else about your account.
• People you send a route to see your destination, your ETA, and are notified if you go overdue or off-route.

5.3 Groups you post in

Group members see your posts, photos, map reports, check-in responses, your name, and your verified badge if you have one. Map reports are visible to the group on the map for 24 hours.

5.4 Guardian organization admins

Admins of an organization that gave you a seat see: the identifier they entered (your phone number or email), the display name they entered, and whether the seat is invited, claimed, or removed. They also see the organization's activity log (§ 3.10), which records when an admin added, re-invited, or removed your entry — by that entry, not by your account. If you are an admin yourself, the organization's other admins see the changes you made and when.

They do not see your location, your alerts, your incidents, your Circle, your messages, your groups, your medical information, or any other safety data. They are not told which HUM account claimed a seat. A paid seat buys features for you; it does not buy visibility into you.

5.5 HUM staff, for safety review

Staff with the admin role can access the contents of reports about a user or group, a user's alert history and rate-limit status, their mute and block lists (in active triage only), and audit-log entries. Access is governed by an internal admin access agreement limiting staff to purpose-justified access. Staff with the admin role may not browse user data outside an active triage. HUM personnel may otherwise access personal information only when reasonably necessary for a legitimate business, security, support, safety, or legal purpose, and only to the extent their role permits. Access to sensitive safety information is restricted and subject to access controls.

5.6 Reporter identity

We do not disclose the identity of a person who filed a report to the reported user, except where disclosure is required by law. Specifically:

• We do not surface reporter identity in any system notice we send to the reported user about an action we took.
• We do not name reporters in any public disclosure of moderation actions.
• We do not name reporters in responses to data subject access requests filed by the reported user (see § 13.6).

5.7 Legal and safety disclosures

We may disclose information when we believe in good faith that it is required by law, valid legal process, or a lawful government request, or where disclosure is necessary to prevent imminent physical harm or to protect the rights, property, or safety of a user, of the public, or of Hum Ltd. Where we are legally permitted to notify you first, we will.

5.8 Business transfers

If Hum Ltd. is involved in a merger, acquisition, financing, or sale of assets, your information may transfer as part of that transaction. We will give notice before your information becomes subject to a materially different privacy policy.

5.9 What we do not do

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We do not share your safety data with employers, schools, insurers, landlords, or data brokers.

6. Service providers

These providers process data on our behalf, under contract, for the purposes below only.

Your mobile number and text messaging. We do not sell or share your mobile number or your text-messaging opt-in with third parties or affiliates for their marketing or promotional purposes. We share your number only with the service provider that delivers our messages (Twilio), and only to deliver them. If you reply STOP, Twilio keeps a record of that so no further texts are sent to the number.

Each provider handles data under its own privacy policy in addition to our contract with it. We use a mobile analytics or crash-reporting SDK only where disclosed here; at the version of this policy, we use none.

7. Location, in detail

Location is the most sensitive thing HUM handles, so this section states the rules in one place.

1. We collect location while you are using the app. The app asks for "while in use" access. It does not request or use background location.
2. Turning off location sharing does not disable alerts. Alerts carry your location whenever your device can provide it, because location is necessary to provide HUM's safety alert functionality. The Share location setting and per-member grants control continuous visibility on the map, not the one-shot payload of an alert.
3. Precise vs coarse. Notifications carry a coarse label. Precise coordinates go only to people entitled to see the alert or the map, inside the app, and to holders of a share link you created.
4. Proximity alerts control what you receive, not what you send. Turning the setting off stops alerts from nearby strangers reaching you. It does not stop your own Panic alert from reaching nearby users who have the setting on — a Panic alert is a public call for help. Use a High Alert instead if you want only your Circle and chosen groups involved.
5. A share link is a bearer key. Anyone who has it can watch you until it expires or you revoke it. Send it deliberately.
6. Revocation is immediate, for share links and for per-member grants.
7. You can turn location permission off entirely in your device settings. The app will keep working; the features that depend on location will not.

8. Sensitive information

Some of what we handle is treated as sensitive personal data under Colorado, California, and other state privacy laws:

• Precise geolocation
• Health information you enter in Medical Info
• Identity-verification data processed by Stripe on our behalf

We use sensitive personal data only as reasonably necessary to provide the features you request, secure the service, comply with law, establish or defend legal claims, and for other purposes permitted by applicable privacy law. We do not use it for advertising, profiling, or inferring characteristics about you. Medical Info is optional and can be cleared at any time. Identity verification is optional. Precise location can be withheld by declining the permission, with the consequences described in § 7.7.

9. Children

HUM is for adults. You must be 18 or older to hold an account. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete the account and its data. If you believe a minor has an account, contact privacy@humsafety.com.

10. Where your data is processed

We operate in the United States, and our providers may process data in the United States and elsewhere. If you use HUM from outside the United States, you understand that your information is transferred to and processed in the United States, where privacy laws may differ from those in your country.

11. Retention

12. How we protect it

• Encryption in transit for everything, and encryption at rest for our databases and object storage.
• Extra column-level encryption for the data that would hurt most: your Circle members' names, phone numbers, and emails, and your Medical Info. These are encrypted with keys held in a managed key service, so they are not readable from a database dump alone.
• No account passwords, so we keep no account-password database to breach. One-time codes and claim tokens are stored as hashes; your Safety PIN is stored as a one-way hash.
• Row-level security in the database, so what a request can reach is constrained by the account that made it at the storage layer, and not by application code alone.
• Private photo storage. Uploads sit in private storage, not a public bucket, and are served through short-lived signed links. Anyone who holds a photo's link can open it until the photo is deleted.
• Step-up re-authentication before destructive Guardian actions — an admin must re-prove possession of their phone, not merely hold a session.
• Purpose-justified staff access, governed by a written admin access agreement, with actions written to an audit log.

No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities as required by law.

13. Your rights and choices

13.1 Controls in the app

You can, at any time:

• Turn Proximity alerts on or off, and set the radius.
• Turn off Show my first name in alerts and use a username instead.
• Turn live location sharing on or off overall, and per Circle member.
• Turn on verified responders only (if you are verified).
• Turn off all-clear notifications.
• Revoke a share link or end a route or check-in.
• Mute or block another user.
• Leave a group, or delete your posts.
• Clear your Medical Info.
• Change your phone number or recovery email, or add or remove a recovery email.
• Opt out of text messages by replying STOP to any text from us. You will then get no sign-in codes by text, so add a recovery email first if you want another way to sign in (Terms § 4.6).
• Revoke location, Bluetooth, camera, and notification permissions in your device settings.
• Delete your account.

13.2 Access, correction, portability, deletion

You can request access to, correction of, a portable copy of, or deletion of your HUM data by emailing privacy@humsafety.com from the email on your account, or by using the in-app controls. Most of your data is directly visible and editable in the app.

13.3 State privacy rights

Depending on where you live — including Colorado, California, and other states with comprehensive privacy laws — you may have the right to: know and access what we hold; correct it; delete it; obtain a portable copy; opt out of sale, targeted advertising, and profiling with legal or similarly significant effects; limit the use of sensitive personal information; and not be discriminated against for exercising these rights.

We do not sell personal information, do not share it for targeted advertising, and do not profile users for such decisions. Because of that, we do not currently engage in processing that requires an opt-out for those purposes. Where applicable, we recognize legally required universal opt-out mechanisms, including Global Privacy Control.

We will not charge you, degrade your service, or reduce your safety features because you exercised a privacy right.

13.4 Deleting your account — what happens

You can delete your account in the app. Deletion requires that you are not in an active alert and that you re-enter your Safety PIN, so that someone holding your unlocked phone during an incident cannot erase your account.

What we erase: your name, username, phone number, recovery email, Medical Info, Safety PIN, location, and identity-verification state; your Circle; your timers, routes and share links; your messages, group posts, map reports and feedback; your group memberships; your push tokens; your pending requests and invitations; and your subscription record. Your sessions are revoked and the account cannot be signed into afterwards. Where a copy of something you sent still sits in another person's account, it is attributed to a deleted user.

What deliberately survives, and why:

• Reports other people filed about you, and the record of moderation actions taken on your account — so that someone who harmed another user cannot erase the record by deleting their account. Retention is as in § 11.
• Blocks other people placed on you — deleting an account must not undo another person's decision to keep you away from them.
• The trial fingerprint (§ 3.9), which is not reversible to your number.
• Billing and tax records, as required by law.
• Entries in a Guardian organization's activity log recording changes you made as one of its admins, so the organization keeps an accurate history of who changed its plan. They show your account as deleted, with no name.
• Copies of messages and content you already sent that live in other people's accounts.
• A stripped placeholder record that keeps your former account's internal identifier and a few non-identifying settings and timestamps (such as when the account was created and which Terms version was accepted), with every identifying field emptied, so that other people's data does not break.

Deleting your account does not cancel a Hum+ subscription. Cancel it in the App Store or Google Play first, or you will keep being charged.

A Guardian seat returns to the organization when you delete your account. You cannot delete while you are the sole admin of a group or the sole owner of an organization; hand it over or wind it up first.

13.5 How we handle requests

We verify a request against the account it concerns — usually by requiring it from the account's verified phone or email. We respond within 45 days, and may extend once by a further 45 days where the law allows, telling you why. Authorized agents may submit requests on your behalf with proof of authority.

If we deny your request, you may appeal by replying to our decision or writing to privacy@humsafety.com with "Appeal" in the subject. We will respond to an appeal within 45 days and explain the reasons. If we deny the appeal, you may contact the Colorado Attorney General or your state's attorney general.

13.6 A note on reports filed about you

Reports filed about you by other users are typically excluded from your right of access on safety grounds. Specifically:

• We will confirm whether reports have been filed against your account.
• We will tell you what actions, if any, were taken.
• We will not disclose the identity of the reporters who filed reports against you, except where required by law.
• We will not disclose the verbatim contents of those reports except where required by law.

This carve-out is necessary to maintain a functioning safety review process and to protect the safety of people who file reports against potentially abusive users.

13.7 If you are on a Guardian roster

If an organization put you on a roster and you do not want to be, ask the organization to remove you — it controls the roster it submitted. You can also write to privacy@humsafety.com and we will remove the entry and stop the invitations. Being on a roster does not create an account for you, and it gives the organization no visibility into you (§ 5.4).

14. Changes to this policy

We may update this policy. If we make material changes — anything that expands the data we collect or the ways we share it — we will notify you in the app and, where required, ask you to accept the change before you continue.

We may update our auto-action thresholds, the report categories we recognize, or the retention windows above without issuing a new version, provided the change does not materially expand the scope of data we collect or share. Substantive changes go through the notice mechanism above.

15. Contact us

• Privacy requests and questions: privacy@humsafety.com
• Legal notices: legal@humsafety.com
• Hum Ltd., Colorado, United States