ClearSixWhat exists, and what it looks like to us
Readable by us
- A made-up name, a base, a language and the day the member last used the app
- When an account was created, and whether the member confirmed they serve (not how or with which address)
- Help requests: base, type of helper, urgency and times
- Which helper each conversation is with, its time limit and its dates
- Which privacy rules and Safety Locate choices the member accepted, and when
- Public encryption keys and device type (phone system) for each device
- For a Safety Locate use: the helper, the base, the reason code, the times and the number of updates
Stored, but locked
- The member's name, rank, unit and phone number, locked on the phone with a key we never receive
- Messages and voice notes on their way to the other phone. They are deleted once delivered, or after 30 days
- Location updates during Safety Locate, deleted when read and no later than 72 hours after the event
What does not exist
- Message history. It lives only on the two phones in a conversation.
- Check-in answers. They stay on the member's phone unless the member sends them to a helper, encrypted.
- Locations. Our server never sees where anyone is.
- .mil email addresses. We use the address once to send a code and do not save it.
- IP addresses in our logs, contacts, advertising ids or location history.
- Call audio. Calls are encrypted between the two phones.
Why we cannot open it
The keys that open messages and member details are made on the member's phone and never leave it. We do not have a master key. So even if we were ordered to, we could not read a conversation or learn a member's name.
Legal demands
If we receive a legal demand, we can only provide the readable data listed above. Our full policy for legal demands is being written with counsel and will be published here before the apps launch.