Counts, never content.

What never leaves your phone

Audio is listened to and discarded on the device — no transcripts, no streams. If you explicitly opt in to evidence recording, a threat clip is captured — and it stays in the app's private storage on the phone that recorded it, is deleted automatically if you mark the incident a false alarm, and expires on a schedule you can see. Your account only ever learns that a recording exists. Camera frames are analysed on the device and thrown away unless a confirmed threat makes you choose to keep evidence. Face data, if you opt in to face recognition, is stored in your phone's secure enclave and never syncs anywhere — the account only ever holds a count of enrolled faces. Voice-prints, if you opt in to voice recognition, work the same way: an embedding of how a voice sounds, on this phone only — Halo recognises who is speaking, never what they say, and no speech is ever transcribed. Your home location stays on the phone too: the geofence is judged on-device, so your coordinates never reach your account. Raw sensor streams — accelerometer, barometer, light, magnetometer — and every learned baseline are processed live and never uploaded. Your safe word and duress word are stored only as salted hashes; the words themselves exist nowhere.

Locked beyond even our reach

Some things we hold in a form that we ourselves cannot read. Your safe and duress words are salted, one-way hashed — there is no key, so nothing can decrypt them: not us, not a court order, not a thief with a copy of the database. And the most sensitive things of all — recordings, face templates, voice-prints, your location — we solved even more simply: we never take them in the first place. What we cannot read, no one can take.

What syncs to your account — the complete list

If it isn't on this list, it doesn't leave the phone.

• Sign-in email, display names, household name, member roles, invite emails.
• Device names, platform, LiDAR yes/no, last check-in, charging state — so a phone that stops guarding is noticed.
• Every setting: sensitivities, response ladder, engine tuning, schedules, quiet hours, radio mode, opt-in flags, welfare interval.
• Safe/duress words as salted one-way hashes only — unreadable even to us.
• Familiar-sound labels with their hours and per-signal reliability tallies — labels, never audio.
• Incident records: timestamp, tier, peak confidence, signal-label timeline, sensor snapshot readings, your real/false answer, the written report if you generate one.
• Recording metadata: that a clip exists, voice or video, its length, which phone holds it, retention status. Never the clip.
• Trusted contact names, contact routes and alert delivery status.

Consent-first, never covert

The microphone indicator stays on while Halo listens — it never listens invisibly. That includes the optional sleep-listening check: if you opt in, a brief pre-arm classification runs with the indicator showing, and the audio is discarded like all the rest. Trusted contacts get a courtesy note the moment you name them, and the "summon" feature — sounding an alert on their own phone — only works if they explicitly agree, and either side can withdraw. Face recognition requires a signed acknowledgement and each person's consent. The highest response tier — "call for help" — rings your trusted contacts and household owner, who decide whether to call the police; Halo never claims to dispatch police itself, and the tier is off until you opt in. Nothing in Halo watches anyone who hasn't been told.

Guests & visitors

When Halo is disarmed, nothing listens — the microphone is simply not running. While armed, the phone's microphone indicator is on and sound is classified into labels on the device, never recorded (recording is a separate, explicit opt-in). Hosting overnight guests? Tell them Halo is on watch — and use Guest night in the on-watch panel to pause listening and the camera until you stand down, leaving doors, windows and motion sensing active. Consent is a feature, not a footnote.

Check for yourself

The app's Activity screen shows "sensing right now" — live confidence, each signal's contribution, and the last events seen — all computed on the phone in front of you. Your weekly report states the same promise and is built only from the account data described above. Every table in the backend is protected by row-level security: your household's data is readable by your household, and no one else.