LilithWhat stays on your phone
- Your trusted contacts' names and phone numbers.
- Your check-in history, alert history and incident reports.
- "My record", if you use it: encrypted with a key that never leaves your phone, and opened only with your Safety PIN. It's never uploaded; you can export it yourself.
- If you turn them on: your learned heart-rate ranges; the places and times Lilith has learned, and the home you set (locked behind your Safety PIN; visits deleted after 60 days); and how you answered Lilith's "are you okay?" prompts (deleted after 180 days).
- Heart-rate, sleep and workout data read from Apple Health, and heart rate and wrist movement sent from your Apple Watch to your iPhone. Lilith never writes to Apple Health and never sends Health data anywhere.
- What listening hears: sounds are recognized on your phone, and nothing is recorded, stored or sent.
What leaves your phone, and when
| When | What | To whom | Kept for |
|---|---|---|---|
| You sign in | An anonymous ID from Sign in with Apple | Lilith's server | While your account exists |
| You add a trusted contact | Their phone number and your name, to send them one text saying you added them (they can reply STOP) | Lilith's server, then our SMS provider | The number isn't stored; only a one-way code, to avoid texting them twice and to honor STOP |
| An alert is sent (SOS, a silent or duress alert, "I feel off", or Lilith is near-certain something is wrong after you didn't answer "are you okay?") | Your name, your location, the alert message, an optional medical note you wrote, and your trusted contacts' phone numbers | Lilith's server, which texts your contacts through our SMS provider (Twilio) | Alert records 90 days (numbers kept only as the last 4 digits), unless you choose to keep an alert |
| During an alert | Your location, about once a minute for up to 2 hours, shown to your contacts on a private page; whether each contact tapped "I'm on it" | Lilith's server | With the alert. Each contact's link stops working after 12 hours |
| During a normal alert, if you allowed the microphone | Audio evidence, recorded only after a loud spoken notice that recording has started, for at most 30 minutes | Lilith's server, encrypted | 90 days, unless you choose to keep it |
| Optional "Alert my contacts even if my phone is off" | Each check-in's deadline, your starting location, your name and contacts, and who you're meeting if you said (encrypted). While it runs, a small update every 2 to 10 minutes: Lilith's estimate of the chance something is wrong, which kinds of signs it noticed (never audio or words), battery level, whether you're moving, and whether you're somewhere unfamiliar or marked unsafe (not where) | Lilith's server | Deleted when the check-in ends |
| Optional "Help Lilith get smarter" (off by default) | Rounded, anonymous summaries of situations and how they turned out, including your answer to "what set it off?" from fixed choices. Never location, places, exact times, your account, your device, audio, or anything you typed | Lilith's server, not linked to you | Used to train detection models |
| You write to us through this website | What you choose to send: your message, and a name and email address if you give them | Lilith's server, encrypted. We get an email notice that a message arrived, without its contents (sent through Resend) | Deleted a year after we've dealt with it, two years at most |
Your trusted contacts receive a text message with your name and location only when an alert is sent.
Listening features
- Listen for distress (on unless you turn it off): when there's a sign of trouble, Lilith listens briefly on your phone for things like screaming or breaking glass. Hearing nothing helps too: it makes a false alarm less likely. Nothing is recorded, stored or sent.
- Also understand nearby speech (off by default): when signs are stronger, Lilith turns up to a minute of nearby speech into text on your phone to judge whether it sounds like a threat or a call for help. The text is discarded immediately; only that judgment is kept, on your phone. This may be unavailable in some states.
This website
This website has no cookies, analytics, trackers or ads, and loads nothing from other companies. The contact form is the only thing that sends anything, and only what you type. We don't keep your IP address.
What we never do
- Sell your data, or use it for advertising or tracking.
- Share it with anyone except as described above (our hosting provider Render, SMS provider Twilio and email provider Resend process it on our behalf), or when required by law.
- Send Health data, learned places or routines, your record, or listening results to our server.
Your choices
- Every optional feature can be turned off in Settings; turning off routines deletes everything learned about your places.
- "Reset" options delete learned heart-rate ranges and prompt history.
- Deleting the app deletes everything stored on your phone.
- To delete your account and server data, or to ask what we hold, write to us and choose "My data and privacy".