Privacy Policy

Who we are and what this covers

NEARER STUDIOS LLC, based in Michigan, USA, operates Nearer Family. This policy covers the current private QA app and its web experience. Contact us about privacy or support at nearer.family+support@gmail.com.

Nearer helps invited people coordinate through trusted circles. Location sharing is optional. We do not sell personal information or use location data for advertising. This release has no advertising or behavioral analytics integrations.

Location: what stays here and what is shared

With your device permission, Nearer reads location coordinates, accuracy and time. A location used only to center your own map stays in app memory and is not sent to Nearer's location relay or used for automatic place discovery. Map providers still receive requests for the area you view, as explained below.

A check-in uses a fresh location when you choose to send it. If you separately enable continuous sharing, your phone collects location even when Nearer is in the background or the phone is locked. Android displays a sharing notification. Web browsers support one-time check-ins, not continuous background sharing.

Shared coordinates, accuracy and timestamps are encrypted on your device for the recipient devices you have verified. Our server relays the encrypted messages and does not have the private device keys needed to read their contents. Recipients must also trust your device to display your updates. Joining a circle or accepting these documents does not enable location sharing.

Encryption does not hide everything: Nearer can see account and circle membership, device identifiers and public keys, sender and recipient identifiers, message timing, expiration and other delivery metadata. A recipient can keep, copy or disclose a location already received. Pausing or removing someone cannot recall their copies. A compromised device or stolen key can expose data; the current encryption does not provide forward secrecy.

Saved places and automatic discovery

Places you name, their coordinates and boundaries are stored locally. If you choose private backup, Nearer also stores an encrypted account copy with a key identifier, signing public key and revision metadata. Your connected devices can restore and synchronize it using your recovery code and account access. Place names and boundaries are not shared with your circle. The server does not receive the plaintext recovery code or the account encryption key.

Keep your recovery code outside this phone and do not send it to support. Anyone with the code and accepted account access can recover your saved places. Retiring a device cannot erase information or keys it already retained. Local changes remain available when synchronization fails; deletions reach other devices only when they synchronize. Signing out does not erase mobile saved places or keys. Browser keys and local state last only for that browser session, while a confirmed encrypted cloud backup remains in the account.

You can also restore saved places through another connected device on your account after comparing the full recovery-request code on both devices and explicitly approving it. Nearer stores one current transfer record per account, including device identifiers and public keys, key and revision identifiers, a request identifier, expiration and approval state, and an encrypted key transfer. Requests expire after five minutes; expiration prevents use but does not guarantee immediate physical deletion of the record. Completing a transfer removes its encrypted key payload and retains a bounded completion record until it is replaced. The server does not receive the decrypted account key.

When automatic discovery is on, locations already collected for sharing or check-ins are also used locally to recognize stops and suggest places. Discovery is on by default; you can turn it off in Settings, which clears unsaved discovery data. It does not start location collection on its own. Discovery retains a current stop and a small set of suggested or dismissed stops. Expired suggestions and dismissals are pruned on reads and further observations after seven days; this is not a guaranteed physical deletion timer. Unsaved discovery data is not included in saved-place backup.

Account, service and support information

Firebase Authentication processes your sign-in credentials and account information. Nearer stores account identifiers, QA eligibility, account display names, device labels and platform, public encryption keys, circle names and memberships, invitations, and security/rate-limit records to provide and protect the service. Circle members can see membership and device information needed to connect with each other.

You choose your own account display name, which is shared with members of all your circles. You can change labels for devices belonging to your account; these labels are also shared circle metadata. Only a circle's owner can change its shared circle name. Account display names, device labels and circle names are visible to the service and are descriptive text, not verified identity. Saved-place names remain private to your account's encrypted backup and your devices; they are not shared circle names or labels.

Private device keys, trust decisions, authentication persistence and settings are stored using protected storage on mobile. The web app keeps its authentication, keys and app state in memory for the browser session. We keep a server record of your Terms of Use agreement and Privacy Policy acknowledgment, including your account ID, email at acceptance, each document version and content hash, server-recorded time, and app platform/build. Previous records are retained to show which documents you acknowledged. These records are included when we review an account deletion request, subject to applicable legal retention needs.

If you email support, we receive your email address, message and any attachments you choose to send. Please do not send passwords, private encryption keys or unnecessary location details. Hosting, authentication and abuse-prevention providers process network and device information, such as IP addresses and security signals. We do not include decrypted location payloads in application backend logs.

Service providers, maps and disclosures

We use Google Firebase and Google Cloud for authentication, hosting, database storage, message relay and abuse prevention. The current QA database and callable backend run in the United States (us-central1); other provider services may process information in other locations. Information sent to support is processed through Gmail.

Google Maps supplies Android maps, Apple Maps supplies iOS maps, and OpenFreeMap supplies web maps. Map services receive network metadata and requests for the viewed map region, which may reveal the area around you or a circle member. Location-packet encryption does not conceal these map requests. These services process information under their own terms and privacy policies. Maps are displayed by default.

We may disclose information available to us when reasonably necessary to comply with law, respond to valid legal process, protect people or the service, or address fraud or abuse. Encryption limits what location contents we can provide, but does not prevent disclosure of account, device, circle or delivery records we hold.

Retention and deletion

The relay stores the latest encrypted message per sender within a circle rather than a location-history feed. Shared updates expire for client validation after fifteen minutes. Expiration is not proof of physical server deletion: cleanup can be delayed, and automatic deletion configuration is not yet verified for this private QA release. New updates overwrite the sender's relay slot; pause requests remove it when the request reaches the server. Recipients may retain information independently.

Invitations are usable for fifteen minutes and are removed when redeemed or replaced. Account, membership, device, security and support records may persist until removed through administration or a verified deletion request. This QA release does not yet have a fully defined automated retention schedule for those records. We limit retention to service operation, support, security and applicable legal needs, and will explain any applicable exception when handling a request.

You can delete saved places in Places, clear unsaved discovery by turning discovery off, and contact support to request account and associated server-data deletion. Uninstalling or signing out alone does not delete your server account. We cannot remotely erase another person's copies or reconstruct your private device keys. There is no automatic in-app account deletion or data-export feature in this release.

Your choices and privacy requests

Choose whether to share, send a check-in, verify another device, or grant operating-system permissions. Pause stops new sharing from this phone; revoke location permission in system settings to prevent further location access. Turning off discovery does not pause sharing. If you no longer want to use Nearer, pause sharing and contact support for account deletion.

Email nearer.family+support@gmail.com to request access, correction, deletion or a copy of personal information we hold, or to raise a privacy concern. We may need to verify that the account belongs to you. Depending on where you live, you may also have rights to restrict or object to processing, withdraw consent, appeal a request decision, or complain to a privacy regulator. We will handle applicable requests under the laws that apply to you. Withdrawal does not change the lawfulness of earlier processing. See Privacy and deletion requests for instructions.

Children and policy changes

This private test does not offer child accounts or a verified guardian-consent process. Do not enroll a child in this release. If you believe a child has provided information, contact support so we can investigate and address it. A future family or child-account launch needs its own appropriate notices and consent process.

We will update the date and version when this policy changes and present a new notice in the app for material changes. Changes that require additional permission or consent will be presented before the new processing begins.