Privacy

Three kinds of people use HALO, and we treat them differently:

• The phone user — the person the HALO Phone belongs to. Usually a supported adult; sometimes a young person. Most of the data on this page is about them.
• Guardians — the one, two or three people who set the phone up and look after it through this dashboard. Typically parents or a legal guardian, deputy or attorney.
• Family and carers — people in the Circle who can chat and call with the phone user but cannot change settings or see where the phone is.

Everything below is shown to the phone user on the phone, in words and symbols matched to how they communicate. Guardians see exactly the same list here.

Where the phone is

A location fix now and then, and whenever a guardian presses Locate now. Guardians can draw saved places (home, college) and be told when the phone arrives or leaves. Kept for 30 days, then deleted automatically.

Phone calls

Who was called or called in, when, for how long, and whether it was missed. Only calls to people in the phone's contact list ring; unknown numbers are silenced and stored as a scrambled hash, never as the number itself. Kept for 90 days.

App use

Which allowed apps were open each day and for how long. Not what was done inside them.

Battery and check-ins

Battery level, whether it is charging, when the phone last spoke to us, and any check-in or SOS the phone user presses (with the location at that moment).

Circle chat and calls

Voice notes, photos and short texts sent inside the Circle app, and who video-called whom and when. Each thread is between the phone user and one person. A guardian can read a thread only if that thread is set to shared; private threads stay private.

Setup choices

The apps allowed, the people who can be called (names, numbers, photos), quiet hours, schedules and screen-time limits, the profile chosen, and the names and passwords of WiFi networks the phone should join.

Guardian accounts

The email address each guardian, family member or carer signs in with, and a display name. Sign-in is by emailed code; we never store a password.

HALO is deliberately narrow. The phone does not, and cannot be switched to, collect any of the following:

• The content of any message outside the thread rules above. A private thread is never read by guardians or by us.
• Call audio or video. Calls are carried live and are not recorded.
• Keystrokes, or anything typed into any app.
• Screenshots or screen recordings.
• Web browsing. If a guardian allows a browser app, we record only that the app was open, not what was viewed.
• Text messages (SMS). The phone does not use SMS.
• Medical or diagnostic information. Profile presets describe what a person can do with a phone, not why.

We use this data for one purpose: to run a phone that keeps its user in touch with the people who care about them, and keeps everyone else out.

• Guardians, family and carers: we process your account details to provide the service you asked for (performance of a contract).
• The phone user: we rely on legitimate interests — the phone user’s own safety and connection, and the guardians’ interest in looking after them — balanced against the phone user’s privacy by collecting little, keeping it briefly, and telling them plainly what is shared.
• Best interests: where the phone user cannot decide about the phone for themselves, guardians act in that person’s best interests in the spirit of the Mental Capacity Act 2005: the least restrictive option, explained at their level, and reviewed as their independence grows. HALO is built so that the direction of travel is always less monitoring, not more.

We do not sell data, share it with advertisers, or use it to build profiles.

• Equal standing. Every guardian sees the same information and has the same controls. One guardian cannot hide anything from another.
• Two to delete. Deleting the phone and all of its data needs two different guardians to confirm when the phone has more than one guardian.
• Safety alerts go to everyone. An SOS, a missed check-in or leaving a saved place is sent to every guardian, whatever the chat privacy settings say.
• A record of decisions. Changes to the profile are logged so guardians can see what was changed and when.

Family members and carers join the Circle by invitation from a guardian. Their access is narrow:

• They see only their own chat thread with the phone user, and their own calls.
• They cannot see the phone's location, call history, app use, settings or other people's threads.
• Carer membership can be given an end date and expires automatically. Guardians can remove anyone at any time.

Under UK data protection law you can ask to see the data we hold, get a copy, have it corrected or deleted, restrict or object to how we use it, and complain to the Information Commissioner (ico.org.uk). These rights belong to the phone user as well as to guardians; someone acting for the phone user can exercise them on their behalf.

The quickest route is inside the dashboard:

• Download everything — open the phone, then Privacy & data, and press Download everything. You get a single file containing all of the phone’s data.
• Delete the phone — on the same page, type the phone’s name to confirm. With two or more guardians, a second guardian confirms. Everything about the phone is then removed.
• Anything else — email support@halophone.co.uk. We will check you are who you say you are and respond within one month.

Location

30 days, deleted automatically.

Call records

90 days, deleted automatically.

App use, battery, check-ins, alerts

While the phone is linked to a guardian account.

Circle chat

Until a participant deletes it or the phone is deleted.

Setup choices and contacts

While the phone is linked.

Guardian and Circle accounts

Until you close your account or are removed from the Circle.

Support messages

Up to two years, so we can follow up.

Deleting the phone removes its data from our live systems straight away. Backups cycle within 30 days, after which the data is gone from those too.

We do not run our own data centres. These companies process data on our behalf, under contracts that require them to keep it safe and use it only for us:

Supabase

Database, file storage (photos and voice notes) and sign-in codes.

Vercel

Hosts this dashboard and the halophone.co.uk website.

Google Firebase

Wakes the phone up when a guardian changes a setting, sends a nudge or starts a call. Carries no personal content beyond a short notice.

Google Play (managed)

Optional. Installs and updates allowed apps on the phone remotely.

Agora

Carries video and voice calls between the Circle app and the phone in real time. Calls are not recorded.

Resend

Sends emails: sign-in codes and the weekly digest.

Some of these providers operate outside the UK. Where that happens we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.

• Everything travels over encrypted connections.
• Access rules are enforced in the database itself, so each person can only ever read what their role allows.
• The phone has no account of its own. It talks to our servers with a device token issued when it is first set up.
• Photos and voice notes live in private storage and are served through short-lived links.
• WiFi passwords are stored so the phone can join the network. Only guardians of that phone can see them.

HALO is designed for supported adults. It can also be used for a young person, in which case the guardian must be their parent or legal guardian. We do not knowingly create accounts for anyone under 18 as a guardian, family member or carer.

If we change what the phone shares, we will update this page and tell guardians by email before the change takes effect. The date at the top tells you when it last changed. Our terms of use sit alongside this page.