Vigil: Destination Alerts
Vigil collects no personal data on our end. We have no servers, and we never receive any information about you or your device.
However, the pins and saved destinations you create are stored in two places:
If you use the optional Connections feature, you also choose a display name and an avatar image to identify yourself to other users. This is a name and picture you pick — it is not required to be your real identity — and it's stored the same way as your pins: on your device and, if you're signed in to iCloud, synced via CloudKit.
The iCloud sync means your data is stored on Apple's servers as part of your personal iCloud account — but it is stored under your Apple ID, encrypted, and is only accessible by you. We have no ability to access, view, or retrieve it in any way. Apple's privacy policy governs how they handle your iCloud data.
If you prefer your data to stay only on your device, you can sign out of iCloud or disable iCloud for Vigil in your iPhone's Settings.
Vigil requires access to your location to function. Location data is used for the following purposes only:
Your location is processed entirely on-device. It is never transmitted to us or any third party. It is never logged, stored beyond the active session, or used for any purpose other than the two functions described above.
You can revoke location permissions at any time in your iPhone's Settings. Without location access, the app cannot show your position on the map or deliver alerts.
The Connections feature lets you pair with other users and, if you choose, share information with them. There are two different kinds of sharing, with different rules for each:
Display name & avatar: once a connection accepts your request, your chosen display name and avatar are shared with that connection indefinitely — this is not tied to whether an alarm is active. That connection continues to see your name and avatar until you revoke it (or revoke and block it), or until you delete your Connections data entirely in Settings. Connections has no messaging or chat of any kind — the only things ever shared are your display name, avatar, and the location/trip data described below.
Location, trip & arrival status: this is shared with a connection only while both of the following are true — your alarm is active for that specific trip or leg, and you have enabled sharing with that specific connection. This information is live and ephemeral: it is not shared in the background, it is not shared once the alarm ends, and it is never stored or retained beyond the active session.
You control which connections, if any, can see your live location for a given trip. Sharing your display name/avatar with an accepted connection and sharing your live location with that same connection are separate choices.
There is no directory or search feature for finding other users. Connections are formed only when you send someone a one-time connection code or let them scan your QR code in person — a stranger cannot look up or see your profile unless you've shared a code or QR with them directly. When you send or receive a connection request, the other person sees your display name and avatar in order to decide whether to accept; if a request is declined or cancelled, no ongoing connection is formed and no further sharing takes place.
We do not sell, rent, or trade your personal information to anyone, and we do not share it with third parties for advertising or marketing purposes. The only sharing described in this policy is the sharing you directly choose through the Connections feature, with the connections you personally approve.
You have full, granular control over each connection: you can mute a connection (silence their notifications without ending the relationship), revoke a connection (end the relationship and stop all sharing with them), or revoke and block a connection (end the relationship and prevent them from sending you a new request) — all from within the app, at any time.
If another user misuses the Connections feature — for example, through impersonation, a harassing or threatening display name, an inappropriate avatar image, or misuse of location/trip data you've shared with them — you can revoke or revoke-and-block that connection immediately, and you can also report the issue to us directly at dgendron.dev@gmail.com. We review reports as promptly as we can and will remove a user's access to Connections for violations of these policies.
If you are signed in to iCloud, Vigil uses Apple's CloudKit framework to sync your saved pins, your Connections profile (display name and avatar), and your connections across your devices. This sync happens directly between your devices and your connections' devices through your personal iCloud account.
We have no access to your iCloud data. Apple's iCloud privacy policy governs how Apple handles this data. You can review it at apple.com/legal/privacy.
What a given connection can see changes automatically as you manage that connection: revoking a connection (with or without blocking) immediately stops them from receiving any further information from you.
Separately, you can delete your entire Connections profile — including your chosen display name and avatar — at any time, yourself, in Settings → Data Management. This is self-service: no support request is needed. Deleting your profile this way is different from revoking a single connection — it wipes your Connections profile entirely, rather than just ending one relationship.
Uninstalling Vigil from your device does not delete this data. Because it's synced to your personal iCloud account, your Connections profile and connections remain there under your Apple ID until you delete them yourself. If you want this data gone before uninstalling, use Settings → Data Management first.
Vigil uses push notifications and Live Activities to alert you when you approach a destination. These destination alerts are generated and delivered entirely on your device and do not involve any external servers.
If you use the Connections feature, you'll also receive notifications when someone sends you a connection request, and when a connection departs on or arrives at a trip they've chosen to share with you. Because these notifications need to reach you from another person's device, they are delivered through Apple's push notification service via CloudKit — not through any server of our own. You can mute notifications from any individual connection at any time.
Vigil uses no third-party analytics, advertising SDKs, crash reporting services, or tracking tools. There are no third parties involved in the operation of this app beyond Apple's own frameworks.
Vigil itself has no minimum age — the core app (pins, alerts, iCloud sync) collects no data at all and is safe for use by all ages.
The Connections feature is different: because it involves sharing information with other people, you must be 16 or older to use it. We don't collect your birthdate or age anywhere in the app. Instead, when you set up a Connections profile, you're asked to confirm that you meet this age requirement before you can proceed, and we may also take into account Apple's Declared Age Range signal where it's available. If we become aware that a user under 16 is using Connections, we will remove that user's Connections access and data.
Because Vigil has no servers or accounts, nearly everything described in this policy already lives on your own device and in your own iCloud account, so you already have direct access to it. You can view or correct your Connections display name and avatar at any time in Settings, and you can delete any or all of it at any time via Settings → Data Management, as described above.
If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with similar data protection laws, you also have the right to lodge a complaint with your local data protection authority if you believe your data has been mishandled.
Your pins, Connections profile, connection, and location data are processed and stored through Apple's CloudKit infrastructure, which may store or process data in countries other than your own. If you use an iCloud account based in mainland China, Apple operates this infrastructure locally through its China partner, as described in Apple's own privacy policy. We have no separate servers of our own anywhere — all of this is governed by Apple's handling of your iCloud account.
If this privacy policy changes in the future, the updated version will be posted at this URL with a revised effective date. We will not retroactively change how any previously collected data is handled — because we don't collect any.
If you have any questions about this privacy policy or how Vigil works, you can reach out at: