Privacy Policy

Last updated October 13, 2026. Belayr is operated by twoplus11 LLC, a Missouri limited liability company.

Belayr exists to send one text message at the moment you cannot send it yourself. That means it holds a small amount of information that matters a great deal, and very little that does not. This page says exactly what it holds, who sees it, and when it is deleted.

What Belayr collects

• Your name and mobile number. Your contacts see both in an alert, so they know who it is about and can call you. Belayr texts the number only if you agree to texts.
• Your email address. You sign in with it if you set a password. Belayr emails it only about your own sign-in: a code to confirm the address is yours when you ask for one, and once it is confirmed, a link to set a password when you ask for one, a note whenever your password is set or changed, and, if you change your email, a note to the old address saying so. Nothing else is sent to it, and it is never shared with your contacts.
• Your emergency contacts. Their name and mobile number, which you provide.
• Your safe word. Stored encrypted, shown to your contacts on the alert page if you do not check in, and never displayed back to you inside the app. That is deliberate: a safe word you can look up on your phone is a safe word someone standing over you can look up too.
• Location, only while a timer is running. Any timer, walking home or showing a house. Belayr does not track you between sessions and collects nothing when no timer is armed. If you decline the location permission the timer still runs; your contacts would simply get an alert with no place attached to it.
• Timer records. When you armed, for how long, when you checked in, and whether an alert was sent.
• Showing details, if you start a timer for a showing: the address, and the prospect's name and phone number if you enter them. They are shown to your contacts on the alert page if you do not check in, and are never texted to anyone.
• A photo of the car, and one of you, if you take them when you arrive at a showing. Both are optional. Nobody can see them while your timer is running normally, not your brokerage and not us, and there is no way to view them back inside the app. They appear only if your timer actually fires: on the alert page your contacts receive, and, if you are on a brokerage's desk, to the people watching that desk. The one of you is there so whoever is looking for you knows what you are wearing today. Both are deleted on the same schedule as your location. Each is shrunk on your phone before it is sent, which also strips the location tag your camera writes into the file, so the picture we hold is not a record of where you were standing. The car photo is the one thing Belayr stores that is about somebody who is not you: if you photograph a car, you are photographing a stranger's numberplate. You can remove either before you start the timer, and you do not have to take one at all.
• Your photo and your car, if you add them to your safety profile: a picture of you, and your car's color, make, model, year and plate. Every brokerage desk you are on can see them, so the people watching know who they are looking for. Only you can change or remove them.
• Your emergency profile, if you fill it in: a description (height, hair, eyes, anything that makes you recognizable), your phone and its carrier, and anything responders should know. It is sealed. A brokerage desk you are on sees it only while an alert from one of your showing timers is live, and at no other time. Your contacts are not shown it, and you can clear it whenever you like.
• A push subscription if you allow notifications, so your phone can be reminded without a text.
• Your place on the waitlist, if you joined one: an email address, a name if you gave one, and which page you came from.
• A walkthrough request, if you send one from the brokerages page: your brokerage and email, and your name, city, headcount and what you wrote if you give them. It is emailed to the person who will reply, kept until we have dealt with it, and deleted if you ask.
• Consent records. When you agree to texts, and when a contact agrees to be your contact, Belayr records the time, the IP address and the browser's user agent. This is the proof of opt-in that carriers require.

Belayr has no advertising, no analytics trackers, and no third-party marketing tools. There is nothing here to sell and we do not sell it.

Text messages

Belayr texts only people who have agreed to it. Specifically:

• To you, only if you agree: texts are optional. Sign-up has a separate, unticked box for them, you can create an account without ticking it, and you can turn texts on or off at any time in Settings. With texts on, Belayr sends one text confirming it, a text two minutes before your contacts are notified, and a text when one of your contacts confirms, declines, stops being able to receive Belayr's messages or can receive them again, so that you are never relying on somebody who will not hear from us. With texts off, the two-minute warning comes as a notification instead, if you have turned notifications on. Either way you get a notification five minutes before a timer is due, if notifications are on.
• A reply, only when you text first: while a timer is running you can text Belayr's number a number of minutes, such as 15, to add that much time. Belayr replies once, to say it did or why it could not.
• To your emergency contacts, only after they agree on Belayr's confirmation page: one text confirming they agreed; an alert if you do not check in, press the panic button, or signal for help with a duress check-in; a text when the alert is over; a practice alert when you run a test; one text checking their number still works, if a text to them failed and you ask Belayr to try again; and a short notice when the arrangement itself changes, meaning when you add or remove a contact, change your safe word, sign in on a new device, or close your account. Those notices exist so that somebody who takes your phone cannot quietly cut your contacts out of it. They go to your contacts rather than to you on purpose: whoever just changed your safe word or signed in with your recovery code may be holding your phone, so telling that phone tells them.
• A phone call, only if a contact chose it: the confirmation page has a separate, optional box for one automated phone call about five minutes after an alert text, if nobody has stood the alert down. A contact who leaves it unticked is never called.

Message frequency varies and depends on how often you arm a timer. Message and data rates may apply. Reply STOP to any message to stop receiving them and HELP for help. Carriers are not liable for delayed or undelivered messages.

How your contacts consent

Belayr never texts a contact before they have agreed. When you add someone, Belayr sends their number nothing. The app gives you a link to send them yourself, from your own phone. It opens a page that explains exactly what they would receive, with an unticked box to agree to texts, a separate optional box for an automated phone call, and a button to decline. Only if they tick the text box and tap Yes does Belayr text them, starting with one text confirming it. Until at least one contact has agreed, Belayr refuses to arm. Declining stops everything to that number permanently and cannot be undone from the link. Belayr keeps the number on file marked declined, and only for that: it is what stops you adding it again. Somebody who wants it erased outright can write to us and say so.

Location

Location points are collected while a timer is running, of either kind, and they keep being collected after an alert fires. That is deliberate: once your contacts have been told, where you go next is the thing they most need to know, and a map that froze at the moment of the alert would be worse than no map. Recording carries on for five minutes after you check in, every time, and then stops. It has to be every time. If it stopped at once on an ordinary check-in and kept going after a duress one, the difference would be visible to anyone holding your phone, and the whole point of the wrong safe word is that it is not. Nothing captured after an ordinary check-in is kept; those five minutes are only ever stored when the check-in was a duress signal, which is exactly when a map that stops moving is worst. There is no separate location switch: decline the permission and the timer still runs, your contacts simply get an alert with no place attached to it. If an alert fires, the trail is what your contact sees on the status page, because the phone that produced it may no longer be in your hands. That page is reachable by a single unguessable link, and the link expires after seven days.

How long Belayr keeps it

• Seven days for location, and for a car photo or a photo of you, from a timer that ended normally. Nothing happened, so there is nothing to keep.
• Ninety days for location, and for a car photo or a photo of you, from a timer that triggered an alert, because that is the window in which someone may need it.
• Ninety days for a brokerage desk's record of an alert, its notes and who opened it, deleted with the alert's other data.
• Until you delete them for your account, your contacts, your safe word, your photo, your car and your emergency profile. What a brokerage desk adds about you is kept until the desk removes it, you leave the desk, or the desk closes.

Deletion runs automatically on a schedule, not on request only.

One exception, and it exists to protect you. If you delete your account while an alert of yours is still live, the account closes immediately: you are signed out, the email is free to use again, and nothing of yours is reachable. The alert itself stays up until a contact marks it resolved, or for two days at most. Your contacts were sent a link to a page showing where you were, and deleting that page out from under them while they are acting on it would put you in danger rather than protect your privacy. The rest of your data is erased as soon as the alert is resolved.

If you join a brokerage's desk

A brokerage can run a desk: a board its owner and office managers watch so they know when one of their agents does not come back from a showing. You join a desk yourself, with a code the brokerage gives you. Nobody can add you to one, and you can leave at any time, which takes effect at once. Your own Belayr, your contacts and your safe word stay yours either way.

• While a showing timer is running, the desk sees your name, the address you entered, and the clock. It never sees where you are, never sees a walk home or any other personal timer, and sees nothing from before you joined.
• If a showing timer fires (you miss the check-in, press the panic button, or give a wrong safe word), the desk sees what your contacts need: where your phone was and the route it took during that showing, who you were meeting, the photos of the car and of you, your emergency profile, and how many of your contacts were told. Never who they are. Once the alert ends safely, because you check in or one of your contacts reaches you, the desk stops seeing those details.
• At any time, the desk sees its roster: your name, the photo and car from your safety profile if you added them, and whether you have filled in an emergency profile, never what is in it. When no timer is running it never sees where you are, and nothing of your timers.
• What the desk keeps about you: it can add its own photo of you, your car as the office has it, and notes for whoever is watching. You can see all of it on your brokerage card in the app. You cannot remove what the brokerage added; ask them if something is wrong.
• The desk's record of an alert: notes its people write while handling it, and a record of who on the desk opened its details or printed them for police. You can see who opened yours, except for an alert raised with a wrong safe word, which the app never shows on your own phone.
• Screens: a desk can show its board on a television or a spare computer in its office. A screen shows who is out and any alerts, and never shows where anybody is.

Who at Belayr can see it

Belayr's operator can see what your account holds, to run the service and answer your requests: your details, your contacts, your timers and, when opened for a stated reason, a timer's location trail. It never includes your safe word. Every look and every change is recorded in an audit log, and if the operator changes your account, such as signing it out or closing it, Belayr tells you in the app.

Who else touches your data

Three service providers, all processing on Belayr's instructions and none permitted to use your information for their own purposes:

• Twilio delivers the text messages. It necessarily receives the recipient number and message text.
• Resend sends Belayr's email: the account emails described above, and a walkthrough request to the person who will answer it. It receives the address and the message.
• Microsoft Azure hosts the service and its database, in the United States.

Beyond those, Belayr discloses information only when the law requires it, and will tell you unless it is legally forbidden from doing so.

Your choices

• Turn texts to you on or off at any time in Settings.
• Remove a contact at any time in the app, which stops all messages to them.
• Reply STOP to opt out of messages on any number.
• Decline the location permission, or switch it off for Belayr in your phone's settings. The timer still runs; your contacts would simply get an alert with no place attached to it. There is no per-timer switch.
• Delete your account and everything attached to it, from Settings in the app or by writing to support@belayr.io.

Security

Traffic is encrypted in transit. The safe word is encrypted at rest. Status links are long random tokens that expire. No system is perfect, and Belayr is a small one, so it is built to fail loudly rather than quietly: its health endpoint reports honestly when it cannot deliver a message, and it is monitored.

Children

Belayr is not directed to children under 13 and does not knowingly collect their information. If you believe a child has given us information, write to us and we will delete it.

Changes

If this policy changes in a way that affects what is collected or who sees it, the date at the top changes and you will be told in the app before the change takes effect.

Governing law

This policy is governed by the laws of the State of Missouri, United States.

See also the Terms of Service.

Questions about this page: support@belayr.io