HomeSafe Terms & Emergency Services Disclaimer

Last updated: November 1, 2026

These terms are between you and GenesisCipher Labs Private Limited. By using HomeSafe on an Apple platform, you agree to them.

HomeSafe is published by GenesisCipher Labs Private Limited, a company incorporated in India (“GenesisCipher Labs”, “we”, “us”). These terms are an agreement between you and GenesisCipher Labs alone. They are not an agreement with Apple, and Apple is not responsible for HomeSafe or its content. We — not Apple — are solely responsible for supporting HomeSafe and for answering any question, complaint, or claim about it. Write to us at genesiscipherlabs@gmail.com.

HomeSafe ranks route options by publicly available safety signals, including Apple Maps points of interest, time of day, street-lighting and pedestrian-infrastructure data derived from OpenStreetMap (street lighting, sidewalks and footways, pedestrian crossings, and surface quality), and weather. Legacy CloudKit community reporting is disabled in this build and no legacy community report is displayed or used in a static route score. HomeSafe is decision support. It is not a substitute for your judgement.

HomeSafe is a route-planning and location-sharing aid. Its routes, scores, alerts and estimates may be incomplete, delayed or wrong. They do not guarantee safety and are not professional advice. HomeSafe does not contact, dispatch or communicate with emergency or crisis services for you. In an emergency, contact the appropriate service directly and use your own judgment.

You control whether to place a call, send a message, share information or follow a route. Use HomeSafe lawfully and do not use it to harm, harass, mislead or track anyone without consent. You must be at least 13; if you are under the age of majority, a parent or guardian must approve your use.

visionOS journey-card edition

The current visionOS edition keeps only a destination draft or verified destination, travel mode, and departure choice in process memory. It does not request location, contacts, Motion & Fitness, microphone, or speech recognition; calculate a route or safety rating; start or monitor a live trip; submit a community report; or contact a weather, civic-data, or CloudKit provider. Its Membership tab shows HomeSafe’s in-app purchases through Apple’s own store interface, and Restore Purchases asks the App Store about purchases already made with your Apple Account; HomeSafe never sees your Apple Account credentials, Apple processes any purchase, and this edition unlocks no feature with a membership. When you verify a destination, HomeSafe sends the place query and a fixed search region for the selected city — never your device location or HomeSafe account — directly to Apple Maps, and accepts a result only inside that city’s supported service area. The journey card is not written to persistent storage: clearing it removes it immediately, and otherwise it disappears when the app process ends. If you plan a journey through Siri or Shortcuts, visionOS keeps its own record of that request, including the destination you named; clearing the journey card also asks visionOS to delete those records. The route, communication, and data-control features described below apply to the iPhone, iPad, and Apple Watch editions unless a section says otherwise.

This version covers 42 service areas: Delhi NCR, Mumbai, Bengaluru, Pune, Hyderabad, San Francisco, New York City, Los Angeles, Peninsula & South Bay, Chicago, Seattle, Boston, Miami, Dallas, Houston, Las Vegas, Toronto, Vancouver, Montréal, Barcelona, Amsterdam, London, Berlin, Rome, Paris, Buenos Aires, São Paulo, Rio de Janeiro, Perth, Sydney, Melbourne, Adelaide, Brisbane, Shanghai, Beijing, Hong Kong, Bangkok, Jakarta, Istanbul, Cairo, Milan and Cape Town, within their mapped service envelopes. Capabilities differ by city; the app shows the data available for each route. In-app route planning is withheld in Beijing and Shanghai in this build; their on-device directories and user-initiated emergency dialing remain available.

What HomeSafe does not do

What HomeSafe does

No safety app can guarantee your safety. Always trust your judgement and contact local emergency services directly when at risk. Within the United States, dial 911 directly when appropriate. Outside current HomeSafe coverage, use your device’s emergency controls or contact the local emergency service directly; HomeSafe does not guess a number.

HomeSafe is provided as-is. Scores and signals are heuristics derived from public and device-side data; they may be wrong. Do not rely on them in life-threatening situations.

Optional HomeSafe Live journey protection

HomeSafe Live is optional and requires a configured production service, Sign in with Apple, and separate journey-sharing consent. When enabled, GenesisCipher Labs receives your precise current location, accuracy, speed, travel mode, timestamps, remaining route and destination while navigation is active. Candidate routes are sent only to evaluate a possible safety reroute. This build has no live backend configured by default; unavailable or stale sources do not establish that a route is safe. Contacts, trip history, Bestie conversations, microphone audio and raw motion data are not sent to the live service.

The live service replaces active journey state instead of retaining a location history. A five-minute lease is renewed while navigation is active. Arrival, cancellation, stopping navigation or withdrawing sharing requests immediate deletion; if the phone cannot reach the service, journey data and its push registration expire after five minutes without renewal. A route-free unavailable-session receipt contains only opaque journey and account identifiers and retirement and expiry times. It expires within five minutes of the first session retirement and is never extended by repeated requests. These receipts contain no route, location or push token and are removed by account erasure or Delete all my data. Apple push notifications contain only a wake cue, with no route, incident, location or journey identifier. iOS may delay background delivery, so HomeSafe cannot guarantee advance detection or avoidance of every incident.

Fast live reports contain a category, current coordinate, radius, timestamp, observation identifier and active journey identifier. They are associated with a pseudonymous HomeSafe account for moderation and independent corroboration. Apple App Attest verifies the installation and report bytes, not GPS accuracy or whether an incident happened. A single untrusted report does not trigger automatic rerouting. Reports contain no free-text note, image, video or audio. Live reports are separate from older public CloudKit flags and are not published to CloudKit. Reports and their author identifiers are removed no later than 24 hours after the report expires; report rate-limit counters expire after one hour and event-delivery records after 15 minutes.

Sign in with Apple requests no name or email. HomeSafe stores a pseudonymous account identifier and an encrypted Apple refresh credential until account deletion, even after sign-out. HomeSafe access tokens last 15 minutes; rotating refresh tokens last seven days. App Attest public keys and encrypted Apple fraud receipts remain until account deletion, and authentication and report challenges expire after five minutes. Unfinished sign-in keeps a route-free cancellation authority in device-only Keychain. Its server binding contains only opaque challenge and account-instance identifiers and remains while that original account instance exists so offline cleanup remains possible. Cancellation authority expires after 30 days and renewal requires the same verified Apple account. Successful sign-in adoption or completed cancellation leaves only a route-free tombstone for at most 30 days. These cancellation records contain no route, location, raw Apple identifier, identity token or authorization code. Account capabilities and an opaque App Attest key handle are held in device-only Keychain; the app never obtains the attested private key. These identifiers and active-journey push tokens are used for app functionality and abuse prevention, never advertising or tracking.

Delete live protection account and Delete all my data request deletion of server-side journeys, reports, push registrations, account sessions and App Attest records. Signing out pauses sharing; successful sign-out removes ordinary local session tokens and retains only route-free deletion authority in device-only Keychain. Up to four signed-out account records may remain until you request deletion; signing out alone does not delete your server account. Delete all my data queues the current account and retained signed-out accounts for deletion through each account’s original service. Launch and foreground retry only deletion you already requested. A limited, route-free deletion capability is retained in device-only Keychain while confirmation is pending; sharing remains paused and retry continues after the app launches or returns to the foreground. Deletion authority and its server tombstone expire after 30 days; if authorization expires before confirmation, sign in with the same Apple account to renew it. An encrypted Apple credential may remain in a revocation queue for up to 30 days solely to retry Apple’s account-access revocation. A pseudonymous moderation denial identifier and reason-only audit may survive account deletion for at most 30 days to prevent abusive account recreation; they contain no report location, route, free text or raw Apple identifier. The HomeSafe Live account screen offers a separate server data export of your own account metadata, reports and current active journeys. The ordinary on-device export does not contact the live server. Live server exports exclude credentials, App Attest keys and receipts, push tokens and other accounts. Export files use the protected temporary share flow and are erased when that flow ends or privacy data is deleted.

Live protection evaluates temporary situations, never whether a person looks dangerous. Current community reports and approved official warning sources are normalized, expire and are corroborated before a meaningful safer detour is installed. Official alert polygons retain their actual boundaries. Original official warning text, publisher attribution, validity and source licence links are available in the live journey warning details. HomeSafe’s route decision remains separate from the publisher’s original warning. The separate live policy does not turn temporary alerts into permanent neighborhood ratings or modify HomeSafe’s static safety score. GenesisCipher Labs’ source collectors use fixed public regions and do not forward your coordinates or routes to alert publishers. NDMA/SACHET, provisioned IMD warnings, police feeds, traffic APIs, security cameras and collective device-motion sensing remain unavailable unless their real access, source terms and activation requirements have been verified; this release does not claim those observations exist.

Community reports

Legacy CloudKit community reporting is disabled in this build for all markets pending an authenticated Production SafetyReport schema, index, and role probe. Previously submitted records may remain in Apple’s public CloudKit until deleted; author-deletion and GenesisCipher Labs moderation, support, and deletion-request controls remain available.

Location, including in the background

Current-trip route-position uncertainty

During a live trip on iPhone or iPad, HomeSafe derives a current route-position uncertainty marker from Apple’s location readings, reported accuracy and existing Apple Maps route geometry. It helps withhold progress and turn timing when nearby route sections fit the same reading; it does not change a route’s safety score. The marker and its short caption can accompany existing current-trip snapshots for your paired Apple Watch, widgets and Live Activities. This processing creates no uncertainty history or additional provider request. Bounded working observations stay in process memory and are cleared when the trip ends. Current-trip snapshots are replaced as updates arrive and use each surface’s existing freshness and clearing rules. A display freshness limit withholds old information; it does not itself delete stored snapshot bytes. Deleting all data clears the local widget snapshot and requests Live Activity removal and a data-free Watch reset. If your paired Watch cannot receive that reset, its existing copy remains until delivery becomes available or you remove the Watch app.

On-device intelligence and arrival comparisons

Optional Apple Intelligence uses Apple’s on-device model only after checking current model availability and language support. The model selects bounded facts or structured fields; HomeSafe composes factual replies and keeps deterministic answers available. HomeSafe does not persist model-session transcripts. An unused prewarmed session can temporarily hold instructions in process memory. HomeSafe schedules removal of its cached reference after 90 seconds and refuses reuse at that age; if execution is suspended, scheduled removal waits until the app can execute. Closing Bestie or starting Delete all my data removes that app-owned cached reference and retires pending prewarm work. A delayed chat close cannot clear a later chat’s reference. Clearing consent retires prior authorization immediately; any remaining cached reference follows its original scheduled removal and cannot gain renewed authorization. Erasure and cancellation prevent retired requests and model tool calls from returning results after renewed consent. This describes HomeSafe’s cached references, not an immediate zeroization guarantee for Apple’s internal model memory. No cloud model fallback or model-session history is added.

Arrival Shift compares later qualified arrival estimates with the first qualified estimate in the current navigation session using route progress, existing accepted location observations and remaining travel time. Its comparison timestamps, durations, journey identifiers and current shift stay in process memory; no additional coordinates, destination names, route geometry or arrival history are stored. A reference older than six hours is not used and is cleared on the next admitted update. The read is withheld after ten seconds without a qualified update or when current route position is uncertain; these display limits do not erase working values while the app is suspended. Ending navigation, replacing the journey, changing mode or privacy authorization, or deleting all data clears the comparison. Resuming after process termination starts a fresh comparison. Clock disagreement can withhold the read and restart the comparison. Arrival Shift does not change route scores, check-in timing or overdue calculations and makes no additional provider or model request. An optional member action opens the existing reviewed message composer; you decide whether to send.

During a live taxi or driving trip on iPhone or iPad, the ride-to-foot handoff uses the speed, reported speed uncertainty, position accuracy and time of accepted Apple location readings on your device to notice when a ride appears to have become a walk. It keeps those values from about the last 75 seconds, whether this trip has shown sustained vehicle speed, and the latest straight-line distance to your destination in process memory; it stores no additional coordinates, destination names, route geometry or Motion & Fitness readings. It can offer walking directions for the rest of the trip; your travel mode changes only if you choose. When HomeSafe is not on screen, it may show at most two notifications per trip, without a destination, place name or distance. Ending navigation, replacing the journey, changing mode or privacy authorization, or deleting all data clears these values. Detecting and offering the handoff does not change route scores, check-in timing or overdue calculations and makes no additional provider or model request; choosing walking directions re-plans the trip like any other mode change.

During a live trip on iPhone or iPad, Quiet Handoff reads Apple’s audio-output kinds on your device. If external audio falls back to the phone or an unknown output, it pauses ordinary trip voice guidance and discards queued words. Only an exclusively wired-headphone output restores eligibility automatically; Bluetooth and shared transports do not establish private listening. Resume voice authorizes the current output kinds and waits for fresh guidance instead of replaying earlier words. It never changes your saved mute preference. Selected official warnings retain their separate spoken channel and still respect mute and privacy authorization. After HomeSafe resumes a live trip that iOS closed, it does not announce or buzz again for a selected official warning it already announced on that trip: the trip’s on-device record keeps the publisher and public event identifier of up to 16 announced warnings. These identifiers can name an issuing office or network but contain no coordinates, warning text or times, and they are removed with the trip record when the trip ends, another trip replaces it, HomeSafe discards it, or you delete all data. Quiet Handoff applies to trip guidance, not Bestie replies, VoiceOver or other system audio. Output-kind sets, the pause flag and opaque owner, generation and authorization tokens remain only in navigation process memory; HomeSafe does not read or retain audio-device names or identifiers, record audio, upload these values, or make a provider or model request for this feature. Ending navigation, replacing the journey, changing privacy authorization or deleting all data clears this working state. A trip-start voice opportunity keeps only journey, route-generation, mode, destination-identity, time and original authorization tokens in the same process memory. It expires for use after 60 seconds and can speak once from a qualified fresh location; it contains no buffered words or additional coordinates and is cleared when the journey or route is replaced, mode or privacy authorization changes, or navigation ends. Neither feature changes route scores, check-in timing or overdue calculations. Active app-owned model work and app-owned trip or Bestie speech are cancelled when their original privacy authorization retires; renewed consent does not authorize older work. Apple’s prewarm API provides no cancellation or memory-zeroization handle, so HomeSafe retires its own authorization and references without claiming cancellation of Apple’s internal resources.

When you open a feature from a membership benefit, HomeSafe keeps a temporary on-device handoff ticket with scene, market, destination, route and journey identifiers and the original authorization. These tickets are not saved or sent. A change in privacy authorization or Delete all my data retires them; clearing trip history also retires any pending Safety recap ticket.

Travel tools on iPhone and iPad

On iPhone and iPad, Plate Snap and Transit Sign Check open the camera only after you choose the camera action and grant permission. Apple Vision recognizes text on this device. HomeSafe does not save captured images to Photos or its own files, upload them, or retain a camera history. Captured image references are released after recognition completes or the camera flow ends; cancellation retires the result and does not promise immediate erasure of system-managed memory. Recognized text stays in the open tool for review and editing and is cleared when you leave it or delete all data. A number plate is not verified vehicle identity. A transit graph match establishes only mapped stop membership, not vehicle direction, current service or boarding access.

Ghost notes on iPhone and iPad let you leave a short note pinned to where you are standing. HomeSafe takes one location reading when you ask to leave a note or open notes, using location permission you have already granted; it never asks for permission or uses background location for this feature, and opening notes while the planner is on screen uses the reading the planner already holds. A note you keep stays on your device with its words, the reading’s coordinates and accuracy, a place name from the bundled city data, and when it was left and opened, until you delete it or delete all data. A note for a friend travels inside the link you choose to share: its words, the spot’s coordinates to about one metre, the reading’s accuracy, when it was left, an expiry seven days later and any name you type sit in the part of the link after “#”, which browsers do not send to a website. HomeSafe receives no copy and runs no server for ghost notes, and anyone who has the link can read the note. The genesiscipher-labs.github.io page such a link opens is static, makes no network request and only hands the link to the app. When you open a friend’s link, HomeSafe keeps that note on your device until it expires or you delete it, and shows its words only when a reading places you within about 100 metres of the spot. HomeSafe cannot verify who made a link or the name on it. Ghost notes do not change route scores and make no provider or model request. Export includes your ghost notes and Delete all my data removes them.

Driver Phrase Card uses Apple Translation after you choose a language and request translation. Translation uses on-device language models; Apple may ask you to approve a language download, which needs a connection. Apple controls language availability and any framework usage metrics under its own privacy terms. HomeSafe operates no translation server, saves no translation history, and clears its destination text and translated card when you leave the tool or delete all data. Translation may be wrong; keep the original destination visible and confirm it with the driver.

Get Everyone Home keeps the names, chosen destinations, proposed drop-off order and manually recorded arrival confirmations only in the open tool. Its distance comparison is straight-line geometry, not road directions, an arrival estimate, a safety ranking or a promise that a shared ride is available. HomeSafe cannot read Messages or receive automatic replies from friends; the organiser records a confirmation only after hearing from that person. Plate and group messages open your own Messages composer for your review to user-chosen trusted contacts. You decide whether to send; HomeSafe never sends a message automatically. Leaving the tool or deleting all data clears this working group.

Year in Motion summarizes the current-year trip counters already kept on this device. It creates no additional trip history and cannot reconstruct trips that were not recorded. A share contains aggregate counts and distances, no destination name, coordinate, route geometry or contact. Sharing is your action through the system share sheet. Clearing the journal or deleting all data removes the source for future summaries.

City and airport briefs are dated, cited offline reference facts. An absent fact is not an all-clear, and a city selection does not establish your location or jurisdiction. Source links open only when you choose them. Step-free travel review describes mapped surface tags and missing evidence; it cannot establish kerbs, stairs, slopes, usable lifts, width or a continuous accessible path. These reference tools do not change route scores or check-in timing.

Personal learning profile

Personal learning profile (aggregate walking pace, travel-time error and a bounded set of recent dimensionless ETA residuals by travel mode/time band, travel rhythm, coarse place familiarity, and check-in responsiveness) On your device Adapt walking estimates, show a private planning allowance after enough comparable arrivals, time overdue nudges more realistically, and explain your own patterns. It never changes a route’s safety score and stores no route, endpoint, timestamp, or trip identifier in the ETA residual buckets. It also keeps an on-device per-region mean travel-time error and sample count; an existing aggregate may retain India or United States as its category, and current city coverage includes India, the United States, Canada, the United Kingdom, France, Spain, Germany, the Netherlands, Italy, Argentina, Brazil, Australia, China, Hong Kong, Thailand, Indonesia, Turkey, Egypt and South Africa within the listed service envelopes. Store distribution is separate: HomeSafe is available in most countries. That regional aggregate carries no city, route, or timestamp. The whole profile is included in Export and Delete all The specified purpose you voluntarily provided the data for

Motion & Fitness

During a live walking trip, HomeSafe uses Apple’s Motion & Fitness data on your device to show measured steps, detect pace or declared-transport mismatches, improve on-device walking estimates, and support automatic pace-based Drink Mode signals. HomeSafe does not persist a raw motion history or upload motion readings. A final measured step count can remain briefly in the on-device trip summary; other live sensor state is cleared at trip end. If Motion & Fitness access is denied or unavailable, the trip continues using GPS-derived pace and estimated steps. One aggregate mean pace observation from a sufficiently sampled walking trip may update the on-device personal learning profile’s pace mean, variability, and walking-trip count; that profile is included in Export and Delete all. Route wandering is derived from live route location, not Motion & Fitness data.

Apple Watch action delivery

Apple Watch action delivery records (random request identifier, check-in/help action, tap time, tap-time opaque privacy-generation token, opaque trip token for a check-in, delivery result, and received time) — stored on your paired apple watch for delivery and receipt recovery, and on your iphone after receipt. Recover a queued wrist action or its receipt after process death, keep a delayed check-in bound to the trip shown on the Watch, and prevent duplicate WatchConnectivity deliveries from applying it twice. A versioned action can affect the phone only if it arrives within five minutes of its tap time (with up to five seconds allowed for clock skew); a missing, malformed, stale, or farther-future time is review-only before any action record, check-in, or Help handoff is created. The Watch first keeps a bounded delivery-recovery copy with at most one record per action type; a copy bearing an older privacy-generation token is erased when a reset reaches the Watch, and removing the Watch app erases its local copy. An iPhone Export or Delete all covers only records the iPhone has received; a Watch-only copy cannot appear in an iPhone export. Readable records expire individually after seven days and are removed the next time that app executes its delivery ledger; unreadable Watch bytes use the same execution-time bound. A versioned tokenless cold-start request remains review-only and is removed under that bound

Data sources

City knowledge on iPhone and iPad includes separate, read-only bundled extracts of Overture Places and Overture Transportation, limited to the app’s mapped service areas. The five Indian, 11 United States and 26 international city packs are reachable in this version. Mapped names, categories, locations and source-supplied addresses support local place and street lookup. These dated map records do not establish current opening hours, staffing, pedestrian access, incidents or safety, and never change route scores. City lookup runs on your device, makes no request to Overture or its contributors, and adds no stored search history. The city data source details offer the public data and its license notices for export without a membership; that export contains no personal searches or trips. The data retains its source licenses. Those permissions apply to the city data, not to the HomeSafe app software. Some curated place and street descriptions draw on Wikipedia articles, which are available under the Creative Commons Attribution-ShareAlike 4.0 licence; those descriptions are available under the same licence, and every article used is listed, with a link, in Settings → Data sources → Wikipedia articles. The bundled OpenStreetMap-derived street-lighting and camera survey is a Derived Database under the Open Database License 1.0 (© OpenStreetMap contributors); a copy of that database and the method used to build it are available on request at genesiscipherlabs@gmail.com. Curated descriptions and the Overture city-knowledge extracts ship for every available market: the five Indian, eleven United States and 26 international service areas.

Purchases, third-party services and liability

Premium prices and availability come from Apple’s App Store. Retry availability asks Apple for current plans again. Retrying an unresolved approval request opens Apple’s purchase confirmation for the same plan; HomeSafe does not infer that an earlier request was declined. HomeSafe receives verified purchase information from Apple, including the product, ownership and purchase dates, and price when provided, but does not receive your Apple Account credentials or card details. Pending approval and retry state stay in process memory; these controls add no HomeSafe purchase history or analytics.

Premium route trade-offs use the existing whole-route time and distance estimates and existing evidence-backed calculation components on your device. They are explanations before the engine’s other adjustments, not differences in the final safety score or predictions of personal safety. Comparing routes makes no additional map, weather or model request and adds no comparison history. Premium never buys a safer score or faster check-ins.

Third-party map, weather, communications and platform services remain subject to their own terms and availability. Any purchase is handled by Apple under the price and terms shown before purchase.

HomeSafe is provided “as is” and “as available,” without warranties to the extent permitted by law. To the extent permitted by law, GenesisCipher Labs is not liable for indirect or consequential loss, and its total liability relating to HomeSafe is limited to the greater of the amount you paid for HomeSafe during the previous 12 months or USD 50. Nothing here limits liability or consumer rights that cannot legally be limited.

These terms are governed by Indian law, without removing mandatory protections available where you live. If one provision is unenforceable, the remainder continues to apply. We may update these terms by changing this page and its date.

See the HomeSafe Privacy Policy.

Contact: genesiscipherlabs@gmail.com