Source-backed public venue pricing
When you explicitly check group venue prices, GoKnowing can send only the public venue name, address and website to OpenAI web search, first requesting the venue’s official website or posted menu, then other sources. This separate research does not include private group messages, starting points, coordinates or documents. Response storage is disabled; provider abuse-monitoring retention may still apply. GoKnowing independently checks published price text before displaying an approximate amount, labels its unit and source dates when available, and does not invent a meal total. Sources can be undated, incomplete or out of date, and venue, branch, item and booking conditions must be confirmed directly. Research is fetched for the current view, not permanently archived in group messages, and existing provider context remains separately labelled.
Unsigned guest use and beta settings
For unsigned access, GoKnowing creates a random first-party installation identifier. The raw browser identifier is kept in an essential HttpOnly cookie; the raw mobile identifier is kept in protected device storage and sent only to GoKnowing over HTTPS when a guest-supported request needs it. The server stores an HMAC-derived value rather than the raw identifier and records whether that installation has consumed its single guest route check. The identifier is used to enforce the guest allowance, limit abuse, and protect shared provider capacity. It is not a hardware identifier and is not used for advertising or cross-service tracking.
Unsigned weather checks are accepted only through the native-app request path and are protected by request-rate and provider-budget limits. Weather coordinates are used to obtain the requested conditions and are not added to an account because no account is signed in. The public native configuration also contains whether the beta launch notice is enabled and the administrator-selected displayed user limit; it contains no administrator identity, credentials, or secret provider settings.
Trusted contacts, group chats and Corridor Watch
Trusted contacts require a single-use invitation, acceptance on the recipient's own account and confirmation by the inviter. Confirm identity using a channel you already trust. This creates a revocable, mutual account connection for Guardian SOS push; it does not continuously share your location. Readiness reveals only relevant notification setup to confirmed contacts, not delivery or guaranteed availability.
Unlike the personal planning assistant, permanent group chats store messages and AI replies encrypted on our server until the creator deletes the chat. This is not end-to-end encryption. Current members, including newly invited members, can read the group history. You choose whether future messages can enter AI context. Only an explicit @AI call sends up to 60 recent eligible messages (24,000 characters) from consenting current members to OpenAI, with response storage disabled; provider abuse-monitoring retention may still apply. Switching consent off affects future processing; replies already generated remain visible. The assistant does not access private documents, Capsules, other groups or SOS data. Starting-point snapshots are shared with the group explicitly, are used with Google Maps for meeting comparisons, and can be removed; points older than 24 hours are excluded from new comparisons. Coordinates and addresses are not automatically sent to the language model. Names and preferences that you write in consenting messages may be included.
Group names and membership metadata are stored for managing access. Google venue content is fetched for viewing rather than archived permanently in messages; proposed place IDs and votes are retained. Group notifications use generic text with no message content or coordinates and can be muted per group. Leaving removes your membership and starting point but keeps sent messages in that group's history. Completed account deletion removes your authored messages and groups you own; quotations and previously generated replies in other members' groups may remain. Account export includes your authored messages and settings, not other members' private content. Invitation tokens are stored hashed, expire after 48 hours and can be revoked.
You can hide a message only for yourself, block or unblock another member, and report one selected message or member. Blocking separates the two accounts' messages, starting points, votes and group notifications; it does not remove either account from a shared group. A report is never shown to the group. After you explicitly agree, GoKnowing stores an encrypted copy of only the selected message or reported member, the category and your optional note for restricted administrator review. Surrounding history is not included automatically. Local high-confidence rules can refuse a clearly threatening, exploitative or repetitive-spam message before it is posted; ordinary group text is not sent to a separate moderation provider. Reviewers may dismiss a report, remove the selected message, or temporarily or indefinitely restrict group posting. You can see the status of reports you submitted and export your submitted evidence, blocks, hides and current restriction. Reviewed reports are normally removed after 180 days; unresolved reports remain until reviewed. Account deletion can de-identify a report while limited evidence remains for that review, security, appeals or a legal requirement.
Opt-in Corridor Watch uses a fresh position to match the current and next sections of your selected route, checks changing traffic, matched reports and weather at most once every three minutes, and stores only the current route and latest check state encrypted—not a position history. Stop removes that watch when confirmed by the server. Unstopped watches expire after eight hours and are removed by maintenance. A paused device, unavailable provider or network can interrupt checks. Changing routes requires a new watch. Neither readiness nor monitoring is an emergency-service or safety guarantee.
Opt-in Crowd Shield and finding responders
Crowd Shield is a separate, optional form of background location use. Enroll or leave in Guardian. While enrolled and permitted by your device, your latest precise location and observation time are encrypted and used to match nearby SOS alerts within 5 km. There is no public nearby-person directory or presence history. Locations older than two minutes or with reported accuracy worse than 100 metres are excluded; uncertain radius boundaries are excluded conservatively. Maintenance clears presence older than five minutes and invitation inbox records after 24 hours. Leaving clears presence and revokes your Crowd Shield response invitations immediately when the server confirms the change.
When an enrolled user starts SOS, eligible volunteers receive a discreet notification via Apple or Firebase; its private response capability is bound to the recipient account. A volunteer sees the sender's fresh location only after explicitly responding. Choosing to share an approach sends the volunteer's fresh location, reported accuracy and available device heading to the sender. Crowd invitations expire after two hours; marking SOS safe stops disclosure. Device-heading sensors are used for directional pucks, not to identify people. Both parties can open a live rendezvous map with distance estimates and optional on-screen haptics. These cannot establish identity, exact proximity or a safe walking path.
Guardian preparation, arrival and device unlock
Appointment packs save encrypted references to your own Vault documents and user-authored checklists. Private entrance notes save coordinates and access notes you deliberately record; these are not independently verified. You may remove these items, export them, or delete the account. They remain until you do so, subject to the backup exceptions below.
Private arrival monitoring starts only after you select a Circle and expiry and confirm sharing. With permission, current GPS observations are sent to the server in the foreground or background to detect a one-minute stay near the destination. The server retains the destination, expiry and observation times, not a trail of incoming coordinates. The Circle receives one arrival check-in without coordinates. Arrival is not proof of safety. Detection may fail when GPS, the network or the operating system interrupts it. Watch records are removed after 30 days by maintenance; the posted check-in follows Circle retention.
A Guardian Test Run sends a clearly labelled test to a saved, consented contact only after confirmation. A real tracking link is included only if separately chosen. WhatsApp provider references and signed delivery statuses are retained for up to 30 days through maintenance. Provider acceptance is not proof of delivery or human response.
Life Vault device unlock registers a public cryptographic key after account reauthentication. The private key stays in the device security system and biometric operations authorize a short-lived, single-use document request. GoKnowing does not receive facial images or fingerprint templates. Account-password and two-factor verification are the fallback. An optional offline emergency card uses device-protected encryption or Keychain access control, requires device authentication to read, and is cleared when removed or signed out on that device. It is user-entered information, not a verified medical record.
Document evidence highlights point to OCR source text or a recorded source rectangle when available. Edited fields do not retain an old source claim. A highlight identifies where text was read; it does not certify its truth or a document's authenticity.
Optional Door-to-Done learning
Outcome Guard estimates the complete journey there and back, including visible estimates for parking, walking, task time, expected queue pressure, weather friction, and a safety margin. When available, automatic access estimates use mapped vehicle arrival points, mapped venue entrances, the routed walking connection between them, published parking types, expected venue activity, traffic-aware travel, and timings you explicitly saved from prior visits. Published parking information does not reveal live empty spaces; when live parking occupancy is not published, GoKnowing clearly labels the value as an estimate rather than a live reading. Completion Map is the map view of the same checked options and labels them comfortable, tight, or unlikely. Its planning confidence is a comparative readiness score, not a statistical probability or promise.
GoKnowing learns from a visit only when you explicitly choose “Improve estimate” and submit what parking, walking, and the task actually took. The stored observation contains those durations, a broad venue category, and a one-way venue reference. It does not contain the associated route, address, coordinates, assistant prompt, or continuous location. It is separated by account, is not used to train a public model, and can be deleted from Outcome Guard.
At most the newest 80 observations are kept per account. They remain until you delete learned timings or the account, subject to limited backup and legal-retention exceptions described below. If you never submit an observation, no Door-to-Done timing profile is created.
Only durations you deliberately enter, a broad category, and a one-way venue reference—not where you travelled from, the venue address, your live route, or a location history.
The short, direct answers
Not merely because you grant permission or choose Current location. A coordinate is saved only for content you deliberately save, send or share. If you explicitly start a Guardian public link or Family Circle live share and grant background access, the latest coordinate is encrypted and replaced while the app is in the foreground or background. You choose a fixed duration or until-stopped mode and can stop at any time.
Ordinary planning-assistant prompts are not added to account history. The administrator-only usage-control assistant is an exception: each encrypted conversation is retained for 24 hours from when it starts so follow-up questions work, and it can be cleared sooner. OpenAI response storage remains disabled; limited provider abuse-monitoring retention may still apply.
No. GoKnowing does not sell personal information and does not use advertising cookies.
Yes. You can schedule deletion from Profile, with a seven-day period in which signing back in can cancel the request.
This policy applies to the GoKnowing website and mobile app when you browse, create an account, plan or save journeys, contact support, or use Guardian, security, and notification features.
Information GoKnowing handles
| Category | Examples | When it is stored |
|---|---|---|
| Account | Name, email, verified mobile number when enabled, verification status, policy acceptance, profile settings | When you register, verify, or update Profile |
| Authentication | Password hash, MFA secret, hashed recovery codes, short-lived email or mobile verification challenge | For account security; never your plaintext password or plaintext one-time code |
| Saved travel | Favorites, preferences, up to 12 recent place searches, up to 30 recent journeys, day plans, commute routines, journey monitors | Only for your signed-in account; recent searches can be cleared from the search screen and other saved items can be removed from their controls |
| Places and coordinates | Origin, destination, recent-search and favorite-place coordinates, place names and addresses | Temporarily for a request, or longer when synced to your signed-in account for history or content you deliberately save |
| Communications | Contact-form message and email correspondence | When you contact GoKnowing |
| Security and operations | Device/browser label, a random first-party installation identifier stored only as a protected hash on the server, short-lived pseudonymous network hashes, login times, security events, account-access decisions, request ID, and account/provider usage counts | To protect accounts, restrict repeated free-account creation, investigate failures, and enforce fair-use limits |
| Remote notifications | Encrypted device delivery token, enabled categories, recent delivery record | Only after you opt in on a signed-in mobile device |
| On-device reminders | Destination, departure time, and the app page to open | Scheduled by your device; not added to your synced account by the reminder itself |
GoKnowing intentionally avoids placing passwords, one-time codes, private API credentials, or mobile notification tokens in browser local storage. It does not access or collect a MAC address or IMEI.
Service usage and support diagnostics
A restricted administrator can view an account email beside aggregate feature-action counts, cache hits, external-service request counts, estimated operating cost, and bounded participant-count statistics such as the size of a Meet Halfway request. When diagnosing a customer issue, the administrator can also review up to 30 days of operational records containing the time, feature, provider category, status, request count, billable units, estimated cost, and a support request identifier. These records help investigate failures, allowances, reliability, demand, caching, and cost.
Release mobile builds use Firebase Crashlytics and Performance Monitoring for privacy-filtered crashes, Android ANRs, startup, route-loading, and provider-latency diagnostics. Deliberately recorded Flutter errors include only the error type, approved diagnostic category, and filtered stack structure—not the exception message, search text, route, coordinates, messages, or documents. Firebase may also process standard app, device, operating-system, and native crash context needed to diagnose a failure. Development builds keep this collection off.
“Report a problem” sends only the description and categories you choose, build metadata, a short support reference, and an optional screenshot you explicitly review and attach. A screenshot is decoded, resized, and re-encoded to remove embedded metadata before encrypted storage. Searches, routes, coordinates, messages, and documents are never attached automatically. Open reports remain until review; resolved or dismissed reports are removed after 180 days. Account-linked reports are removed when scheduled account deletion completes.
GoKnowing also increments daily, content-free counters for search to route to navigation, planning to a selected destination, sharing to successful viewing, and optional post-journey ratings of timing, crowd, parking and arrival accuracy. Each counter contains only the UTC date, website/iOS/Android platform, approved flow or rating category, approved stage or rating, and total count. No account or device identifier is stored with these counters. A shared-view success is counted only on the first valid opening; an unseen link is counted as abandoned after it expires. Post-journey feedback does not send the route, destination or location.
These views do not contain search text, origins or destinations, route geometry, messages, documents, passwords, payment-card data, live or saved locations, shared-link tokens, or Guardian content. Content-free product-funnel and feedback counters are removed after 90 days. Account-linked daily aggregates are retained only for the active calendar month; request diagnostics are removed after 30 days. Account-linked records are removed when scheduled account deletion completes, except records that must be retained for a legal, fraud, security, or payment-reconciliation obligation.
Plan reservations and billing data
If you reserve a plan, GoKnowing stores the selected plan, period, intended platform, and notice status. A reservation does not contain payment information and can be replaced or cancelled. If subscriptions are enabled and you buy one, GoKnowing and RevenueCat process a private account-bound billing identifier, product and entitlement, platform, environment, subscription dates, renewal state, transaction amount and currency, provider references, allowance-cycle use, refund request, and webhook reconciliation state. The restricted administrator can see aggregate revenue, margin, subscription health, and the minimum account-linked information needed for support and refund review. Support credits or corrections record the allowance, signed unit change, reason category, optional case reference, validity period, administrator, and revocation state. Complimentary plan access also records the plan, whether access is temporary or remains until revoked, its dates, support reason, optional case reference, notification outcome, and administrator. It is kept separate from payment and revenue records.
GoKnowing does not receive or store full card numbers, card security codes, or native-store credentials. Reservation availability notices may be sent once when subscriptions open, once after three days, and once after seven days, then stop. Transactional support notices are sent when complimentary access is granted or revoked. Each plan link opens the selected plan for review; opening it does not charge you. Provider checkout remains responsible for the final price and explicit purchase confirmation.
Location: what happens and what does not
GoKnowing asks the browser or mobile operating system before accessing precise location. If permission is granted, coordinates can center a map, bias place suggestions, find useful places nearby, interpret “where I am,” check local conditions, calculate a journey, or support a Guardian action you explicitly start.
Granting access does not automatically track you or attach coordinates to your account. Background live sharing begins only when you deliberately create a private Guardian link and separately grant background access.
The current coordinate is transmitted only as needed for the location-based action you request. It becomes stored account data only when you deliberately save, send or share something that requires coordinates—for example a favorite place, day plan, commute routine, shared journey snapshot, monitored journey, family check-in, active Journey Timer, SOS alert or Guardian live link. A check-in or timer stores a point-in-time snapshot. During an active live-share session, fresh coordinates are encrypted and uploaded in the foreground and background. iOS displays its location indicator and Android displays an ongoing notification. The public viewer hides exact coordinates after 45 seconds without a fresh update. Each accepted update renews the normal two-hour idle timeout, so sharing continues until you stop while updates remain active; if updates cease, the link expires. The operating system, network, permission state, or location services can interrupt updates. You can refuse access and type a place instead where the feature permits, and you can withdraw permission in browser or device settings.
Natural-language assistant and voice input
When language processing is configured, the request text and limited context needed to understand it—such as favorite-place aliases or a current coordinate you already permitted—may be sent to OpenAI. Outcome Guard also sends the errand wording you submit so OpenAI can separate and classify ordered tasks; response storage is disabled, and it does not ask OpenAI to choose venues, supply locations, or invent route facts. GoKnowing requests structured planning output and permits only a bounded app-feature proposal tool, not arbitrary code execution, source-code access or unrestricted API calls. Results are validated against strict formats. Maps, weather and venue checks run through separate controlled services. App action cards prepare a feature for your review; they do not themselves send alerts, unlock documents or grant tracking consent.
If you ask for document or appointment-pack summaries in the mobile assistant, GoKnowing can fetch titles, expiry and review status from your signed-in account and show them in chat. These fetched private summaries are not added to the model conversation. Original documents retain their secure unlocking requirements.
Follow-up questions: the open assistant temporarily holds up to six recent exchanges, understood planning details, and small result references such as the selected place. Relevant context is sent with your next request so replies like “7 PM” or “walking instead” make sense. Context has a size limit, expires after 30 minutes of inactivity, and can be cleared using “New conversation.” It is held in the current view’s memory, not saved in local storage or your account database. Closing the mobile assistant or reloading the web page clears this temporary conversation; it does not sync between devices.
GoKnowing sends ordinary assistant requests with response storage disabled and does not save their prompt or response as account chat history. The private usage-control assistant is available only to an authenticated administrator and is different: GoKnowing keeps each full conversation encrypted on the server for 24 hours from when it starts, unless the administrator clears it sooner. To keep later requests bounded, OpenAI receives a compact rolling memory and at most the six latest messages—not the unlimited full history—together with the current non-secret budget, allowance, provider-usage, cache and pricing snapshot. Its OpenAI response storage is also disabled. It can propose only whitelisted numeric controls; the server validates the proposal and requires a separate administrator approval before applying it. OpenAI states that API data is not used to train its models by default unless the customer opts in, but it may retain abuse-monitoring logs for up to 30 days unless special retention controls apply. Read OpenAI’s API data controls and Privacy Policy.
Ordinary voice input starts only after you press the microphone control. Guardian voice SOS starts only after you explicitly arm your saved phrase. In the mobile app it may continue in the background with the operating system’s microphone indicator or ongoing notification, and stops when you disarm it or terminate the app. The operating system can still suspend or interrupt recognition. Speech recognition is provided by your browser or operating system and may send audio to that platform’s speech service under its own privacy settings. GoKnowing receives recognized text to detect the phrase or handle the request; it does not intentionally retain an audio recording.
Saved, shared, and monitored journeys
Account syncing stores only the features you choose to save. Recent journey history contains a summary such as origin, destination, mode, duration, distance, timing, and score—not a continuous movement trail.
A journey-sharing link contains a limited snapshot of the route result, your chosen display name, and normally expires after seven days. It does not expose your email address or account profile. Anyone who has the link during that period can view the snapshot, so share it carefully. The public token is stored only as a cryptographic hash. GoKnowing records only whether the link received a first valid view before expiry in the content-free counters described above. Journey monitoring stores the planned journey context needed to compare later timing and send the alerts you enable; you can stop monitoring at any time.
Crowd-forecast caching is shared across users to reduce repeated external requests. A cache record describes the venue and its historical activity pattern; it does not record which user requested the venue.
Guardian safety features
Guardian stores information only when you choose the corresponding feature. The private Capsule can contain emergency phone numbers and email addresses, a voice phrase, blood type, allergies, and medications. Life Vault can contain an uploaded identity or travel document, an OCR transcription, and fields you review and confirm. Family Circle can contain membership, explicit check-in status, an optional point-in-time location, encrypted shared-care task text, and each member’s latest encrypted live coordinate only while that member explicitly shares it. Journey Timer stores its deadline plus an encrypted snapshot of the chosen contacts and optional location so server maintenance can act even when the app is closed. A public-link or Circle live-share session stores only the latest encrypted coordinate while active, including in the background when permitted. A public link exposes a fresh exact position to its holder; Circle locations are available only to active members.
Capsule content, reviewed document data and originals, Circle check-ins and care-task text, active timer snapshots, and live-share coordinates are encrypted before database storage. Public capability tokens are stored only as one-way hashes. The live-link secret remains after # in the URL so it is not sent in the ordinary viewer-page request or access log. Life Vault extraction runs on the GoKnowing server with a local OCR model rather than sending the document to the assistant. Guardian does not silently expose Capsule or Vault content to the assistant.
When you trigger SOS, GoKnowing first attempts a minimal account-bound app notification if a saved contact matches a verified phone number or verified account email and that person separately enabled Guardian SOS alerts. The push itself does not contain coordinates, medical details, or Capsule content. If app delivery is unavailable, GoKnowing can fall back to configured WhatsApp delivery for a phone contact or email delivery for an email contact. A fallback message may contain the location you chose to include and a private 24-hour response link. The server stores only a hash of each response token and shows a masked contact in Response Radar. An account-bound response requires the matching signed-in account; a fallback link is available to its holder. Opening either link does not acknowledge the alert—the recipient must explicitly choose “responding” or “unavailable.” That choice does not verify identity, arrival, or contact with emergency services.
Provide another person’s phone number, email, medical information, Circle data or a live link only when you are entitled to do so and, where appropriate, have their permission. Anyone with a valid public live link can see the sender’s exact fresh location without signing in. Treat it like a temporary password and stop the session if it reaches the wrong person. Guardian background sharing is visible through the operating-system indicator or notification and is not an emergency-dispatch service.
Why information is used
- Provide the service: create accounts, calculate journeys, answer requested weather or crowd questions, sync saved content, and deliver enabled alerts.
- Personalize user choices: apply saved modes, accessibility needs, aliases, and alert preferences.
- Protect users and GoKnowing: verify email, authenticate sessions, detect suspicious access, limit abuse, and investigate security events.
- Operate and improve reliability: diagnose errors using request identifiers, measure aggregate provider use, maintain caches, and understand feature failures without logging journey text.
- Communicate: send verification, reset, security, support, and opted-in journey messages.
- Meet legal duties: respond to valid legal requests and establish or defend legal claims where necessary.
Depending on the context and applicable law, processing may rely on your consent, be necessary to provide the service you request, support legitimate security and reliability interests, or be required by law. Permission-dependent features stop when the permission is withdrawn.
Service providers and disclosures
GoKnowing does not sell personal information. It sends only the information reasonably needed for a requested feature to processors that help operate the app:
- Google Maps Platform: place-search text, coordinates and selected-place identifiers may be processed for autocomplete, place details, nearby discovery, Guardian refuge checks, and related place content. Google Maps use is subject to the Google Maps/Google Earth Additional Terms and Google Privacy Policy.
- Mapbox: map interaction, device location when enabled, origins, destinations and route progress may be processed to display mobile maps, calculate routes and provide turn-by-turn guidance. See the Mapbox Privacy Policy.
- OpenWeather: a route or destination coordinate is used to return conditions or forecasts. OpenWeather states that it does not store API-request parameters such as requested locations; see its Privacy Policy.
- Route-safety evidence providers: route-section coordinates may be sent to TomTom for traffic flow and incident data and to public OpenStreetMap Overpass services for mapped road, surface, lighting, and street-lamp attributes. Recent incident context downloads the public Dubai Police snapshot from Data Dubai, then scores route coordinates against that model locally; route coordinates are not added to the source dataset.
- Venue-activity processing: a selected venue name and address may be processed to return historical activity estimates. GoKnowing caches the resulting venue pattern to avoid repeat requests.
- OpenAI: assistant text and limited planning context may be processed as described above. Guardian documents, Capsule medical details, and emergency-contact lists are not supplied as assistant context.
- Verification and bot protection: when enabled, Twilio processes the mobile number and verification delivery status for WhatsApp or SMS verification, and Cloudflare Turnstile processes technical challenge information to distinguish people from automated abuse.
- Firebase Cloud Messaging and Apple Push Notification service: Firebase processes an app-installation notification token and the minimal alert content needed to deliver enabled Android and iOS notifications; Apple processes iOS delivery. GoKnowing encrypts registration tokens before database storage and does not place live coordinates or medical information in Guardian push payloads. See the Firebase privacy information and Apple Privacy Policy.
- Hosting, database, email, and security providers: these providers process the data needed to host the service, store account data, deliver requested messages, and protect accounts and infrastructure.
Information may also be disclosed when required by applicable law, needed to protect a person or the service, or involved in a legitimate organizational transfer with appropriate notice and safeguards. GoKnowing does not provide personal information to data brokers or advertisers.
How long information is retained
| Information | Typical period |
|---|---|
| Account and saved travel content | While the account is active or until you delete the item or account |
| Administrator usage-assistant conversation | Encrypted for 24 hours from when the conversation starts, or until the administrator clears it |
| Guardian Capsule, Life Vault, Circle, care tasks, and timers | Until you remove the item, leave or delete the Circle where applicable, or delete the account; completed timer records remain until item or account deletion |
| Group moderation reports | Open reports remain until reviewed; selected encrypted evidence and the decision are normally removed 180 days after review |
| Guardian public-link and Circle live sharing | Until the selected fixed end time or the sender stops; until-stopped sessions expire after updates cease, and expired latest-location records are removed by maintenance |
| SOS private response capability | Link access expires after 24 hours; its hashed token and masked response record are removed by maintenance seven days later |
| Recent journeys | The newest 30 entries per account, until cleared or the account is deleted |
| Email verification and reset challenges | 10 minutes, then eligible for cleanup |
| Active login sessions | Up to 30 days; revoked session records may remain for up to 30 further days for security |
| Shared journey snapshot | Normally seven days |
| Notification delivery records | Up to 30 days |
| Venue-activity cache | Refreshed after 10 days; a copy up to 30 days old may be used temporarily if the supplier is unavailable |
| Installation identifier | Normally until the essential cookie expires or the record is no longer needed for account-creation abuse prevention; account links are removed when the account is deleted |
| Per-account fair-use counts | Daily rows for the active month; removed with scheduled account deletion |
| Account-access decisions | Normally up to 400 days for security, review and dispute handling, or until completed account deletion |
| Scheduled account deletion | Seven-day cancellation period, followed by deletion through the maintenance process |
Contact messages, security events, aggregate counters, legal records, and backups are kept only as reasonably needed for support, security, recovery, compliance, or legal claims. Backup deletion may lag behind live-system deletion for a limited recovery cycle; deleted data is not restored to ordinary use. Some information may be retained longer if law requires it or a valid dispute makes it necessary.
How information is protected
Controls include strong password hashing, optional multi-factor authentication, hashed recovery codes and public capability tokens, authenticated encryption for Guardian private state, documents, check-ins, care-task text, timer snapshots and live coordinates, encrypted notification tokens, protected and secure production cookies, transport encryption, parameterized database queries, input validation, output escaping, cross-site protections, origin checks, rate and provider-usage limits, restricted administrative access, short-lived verification challenges, pseudonymous device/network identifiers, and logs designed not to include credentials or journey text.
No internet service can promise absolute security. Use a unique password, enable two-step verification when available, protect shared links, keep your device updated, and contact security@goknowing.app if you believe your account is at risk.
Your controls and privacy rights
GoKnowing provides controls to update profile information and preferences; delete favorites, day plans, Guardian documents, Capsule fields and timers; leave or delete a Circle where permitted; clear recent journeys; stop a live share, monitor or routine; cancel an on-device departure reminder; disable a remote-notification device; revoke other sessions; export account data; and schedule account deletion. Browser and operating-system settings control location, microphone, and notification permissions.
Subject to applicable legal limits, you may also request information about processing, a copy of personal data, correction, deletion, restriction or cessation of processing, and other rights available under the UAE Personal Data Protection Law. The UAE’s official portal describes rights including correction and restriction and rules for cross-border transfers in its data-protection overview. To make a request, email the privacy address below. GoKnowing may need to verify identity before acting and may retain information where law or a legal claim requires it.
Scores and automated recommendations
GoKnowing uses rules and weighted scoring to compare route efficiency, traffic, weather comfort, expected venue activity, and user-selected preferences. Best Time to Go samples a bounded set of windows, removes hours that appear closed, normalizes available signals, and changes the weights based on the priority you choose.
Guardian scores each sampled route section from the conditions actually returned by its configured evidence providers, accounts for missing information by pooling the observed result toward a neutral value, and aggregates sections by travelled distance. Evidence coverage is shown separately. Recent incident context, when loaded, is a relative concentration percentile within the official current snapshot—not an accident probability or long-term historical rate. Missing evidence is not presented as a measured danger, and a high route score does not establish that a journey is safe.
These outputs are travel suggestions, not decisions that produce legal, employment, credit, insurance, medical, or similarly significant effects. You remain in control and can inspect the factors, change preferences, choose another route or time, or ignore the recommendation.
Young users
GoKnowing accounts are not available to children under 13, and registration requires an age confirmation. A user below the legal age of majority where they live must have a parent or legal guardian review and permit use of the service. The app does not use personal information for targeted advertising. If you believe a child under 13 created an account, contact GoKnowing so access can be stopped and the information removed where appropriate.
International processing and policy changes
Some providers may process information outside the United Arab Emirates, including in countries with different privacy laws. GoKnowing evaluates the information a feature needs, limits what is sent, and uses contractual, account, and technical safeguards where appropriate. Third-party processing remains governed by the provider’s terms and privacy policy.
This policy may change when features, providers, security practices, or legal requirements change. The effective date and version appear above. Material changes will receive reasonable notice or renewed acknowledgement where applicable; the previous acceptance record remains associated with the version accepted at registration.
Common privacy questions
Does GoKnowing follow me in the background?
Only for a Guardian location feature you deliberately enable, such as a live link, Family Circle sharing, SOS response, arrival monitoring or Crowd Shield, with the required location permission. iOS displays its location indicator and Android displays an ongoing notification. Tap Stop or revoke permission to end updates; the link also expires automatically. The operating system or network can interrupt delivery.
Does GoKnowing know my Google Maps history?
No. GoKnowing sends the place and journey information needed for its own maps features; it does not receive your private Google Maps Timeline or general Google Account history.
Why can a favorite contain coordinates?
Coordinates let “Home,” “Work,” or another saved alias resolve consistently across devices and make routing accurate. A favorite is saved only when you choose to save it and can be deleted.
Can another user see what I searched?
Not through your account. A person can see only a journey snapshot or fresh live position you deliberately share while its private link is valid. Anyone with that link may open it, so treat it as private.
Are passwords or one-time codes readable by GoKnowing?
No. Passwords are stored as one-way hashes. Verification codes are also hashed and expire quickly. Support cannot retrieve your password.
Does deleting the app delete my account?
No. Removing the mobile app removes local app access but does not itself delete synced account data. Schedule account deletion from Profile or contact privacy support.
Can I use the app without location permission?
Yes. You can type an origin, destination, or area. Nearby and Current location features will be less automatic.
Are weather or crowd results personal profiles?
No. They describe a requested place and time. The shared crowd cache is venue-based and does not identify the person who requested it.
Controller, contact, and requests
GoKnowing is an independent project operated by Yosef Abougwila in the United Arab Emirates, who acts as controller for the personal information described here. Send privacy questions or rights requests to privacy@goknowing.app. Security concerns can be sent to security@goknowing.app. General support is available at support@goknowing.app. Include enough detail to identify the account and request, but never email your password, one-time code, authenticator secret, recovery code, medical details, documents, or live-location links.
Google and Apple sign-in
When you deliberately choose a Google or Apple sign-in button, that provider and Firebase process the authentication request. GoKnowing receives a signed, short-lived identity token containing a stable identifier, verified email address, provider, and any display name the provider makes available. The GoKnowing server verifies the token and then issues its own revocable session. GoKnowing does not store the provider token or request access to your contacts, files, calendars, photos, or general account history.
If the verified provider email already matches a GoKnowing account, the provider identity may be linked to that account so you do not receive a duplicate account. Existing GoKnowing two-step verification still applies. Apple may provide a private relay address when you choose Hide My Email; GoKnowing treats that relay address as the account email until you change the account through available controls.
Subscription processors and record retention
RevenueCat processes the private billing-customer identifier, product, entitlement, transaction, store, and subscription state needed to unify account access. Apple and Google process native purchases. RevenueCat Billing and its payment processor process enabled website checkout. These providers—not GoKnowing—handle payment credentials and remain authoritative for purchase, renewal, chargeback, and refund outcomes. See the RevenueCat Privacy Policy, Apple Privacy Policy, and Google Privacy Policy.
Active reservations remain until they are cancelled, replaced, converted, or no longer operationally required. Entitlement, transaction, webhook, refund, notification, and audit records may remain after cancellation or account deletion when needed for provider reconciliation, fraud prevention, tax, accounting, chargeback, consumer-rights, or legal obligations. Deleting the app or GoKnowing account does not itself cancel a provider renewal; the deletion flow warns you to manage billing first.
Optional plan news and promotions
GoKnowing sends product announcements, signup plan information, or account-specific promotions only after you separately choose to receive product emails. This choice is optional and is not required to create or use an account. You can turn it off at any time in Notification settings; doing so prevents future promotional email and promotional push delivery.
For a promotion, GoKnowing stores the campaign name, code, discount, eligible plans, periods and channels, validity dates, audience category, your account assignment, and delivery state. A specific-account campaign uses entered emails only to find eligible existing accounts; the campaign audit stores the selected count rather than copying that email list. Apple, Google, or RevenueCat remains responsible for confirming final eligibility and price. GoKnowing does not infer that a discount was redeemed merely because a link or checkout was opened.