Exposure Radar

Legal

Privacy Policy

Effective September 30, 2026

What Exposure Radar does with your information, in plain terms. Exposure Radar is an iPhone app, called “Exposure” on your Home Screen, made by Allison Bowman, an individual developer. In this policy, “I” and “me” mean Allison Bowman.

The short version

  • There’s no account or sign-up. The app has no ads, no analytics, no crash reporting and no other third-party code. It doesn’t track you across other companies’ apps or websites. Nothing is sold.
  • Your location history, the Apple Health data the app reads, the events you plan and your scores are stored on your iPhone.
  • Some features need a lookup over the internet. The app sends only what each lookup needs: place coordinates to Apple Maps, a location rounded to about 1 km to Apple Weather and the U.S. Federal Communications Commission (FCC), and a county or state code to the U.S. Centers for Disease Control and Prevention (CDC).
  • If you turn on Family & Friends, your scores are encrypted on your iPhone before they’re sent to a relay I run. I can’t read them.
  • I have no readable copy of your location, your Health data or your scores.

If you live in Washington, Nevada or Connecticut, the Consumer Health Data Privacy Policy also applies. It describes the same practices in the form those states’ laws require.

What the app uses, and where it’s kept

The app processes the following on your iPhone and stores it in the app’s private storage, which is protected by iOS data protection. Like other app data, it’s included in your iPhone backups if you back up to iCloud or a computer.

Location

The places you visit: their coordinates, when you arrived and left, and the name and type of place the app looks up. The app gets these from iOS Location Services, in the background when you allow “Always”. It uses them to calculate your exposure. You can see and edit your places in the app, and delete them.

Bluetooth

While the app is open, it counts nearby Bluetooth devices with a strong signal (roughly within a few meters) as a measure of how crowded a place is. Only the count is kept. No device identifiers are stored.

Apple Health

With your permission, the app reads resting heart rate, heart rate variability, respiratory rate, sleeping wrist temperature, blood oxygen, sleep and steps from Apple Health. It only reads. It never writes anything to Health. It uses this data only to calculate immune readiness and readiness on your iPhone. Health data is never used for advertising or data mining, and it’s never sold.

Calendar

If you connect your calendar, the app reads your upcoming events to suggest ones to plan for. iOS calls this permission “Full Access”, but the app only reads your calendar and never changes it. It keeps an event’s title, dates and location only for the events you choose to plan.

Scores and strain signals

From the data above, the app calculates your daily exposure index, 7-day exposure, immune readiness, readiness and strain signals. These are estimates, and they are inferences about your health. See how they’re calculated.

Notifications

The app schedules its reminders and alerts on your iPhone.

What leaves your iPhone

Some features need information from outside your phone. Here’s what the app sends, to whom, and why. Every request uses an encrypted HTTPS connection.

  • Apple Maps

    What
    The coordinates of places you visit. If you plan an event whose calendar entry has an address but no map location, that address too.
    Why
    To look up the name and type of each place (for example, a restaurant or a clinic), and to find where a planned event is. Maps shown in the app also load from Apple.
    Handled by
    Apple, under Apple’s Privacy Policy.

  • Apple Weather

    What
    The location of places you visit, rounded to about 1 km.
    Why
    To get the temperature and humidity, which the app turns into a measure of how dry the air is.
    Handled by
    Apple, under Apple’s Privacy Policy.

  • FCC county lookup

    What
    A location rounded to about 1 km, sent to the FCC’s Census Area API (geo.fcc.gov). This covers places you visit and the locations of events you plan.
    Why
    To find the county.
    Identifiers
    None are sent. Like any web request, the FCC’s server sees your IP address.

  • CDC wastewater data

    What
    A county or state code, sent to data.cdc.gov.
    Why
    To download public wastewater data for that area.
    Identifiers
    No personal data is sent. Like any web request, the server sees your IP address.

  • Family & Friends relay

    What
    Only if you share: your shared status, encrypted on your iPhone. See Family & Friends.
    Handled by
    Me, through Cloudflare, my hosting provider. Neither of us can read it.

  • App Store

    What
    Purchases and subscription status.
    Handled by
    Apple. I don’t receive your payment details or your Apple Account identity.

Family & Friends

Family & Friends is optional. Nothing is shared unless you turn it on and send someone your invite link.

What’s shared

Your display name, readiness, 7-day exposure, immune readiness, a status word, whether you have a strain signal, a short headline, and the last 30 days of those scores. Your places and raw Health data are never shared.

How it’s protected

Your iPhone encrypts this status with AES-256-GCM, using a random key created on your phone. The key is only in the invite link, in the part after the “#”. Browsers and apps never send that part to a server, so neither I nor Cloudflare can read your shared scores.

The relay stores only the encrypted data, a random share ID, a hash of the secret token your phone uses to update it, and the time of the last update.

Who can see it

Anyone who has your invite link can read your shared scores. Send it only to people you choose. People who view your scores don’t need a subscription.

Stopping and deletion

  • When you stop sharing, the encrypted data is deleted from the relay and old links stop working. If you share again, the app makes a new link.
  • Delete all data in the app also deletes it from the relay right away.
  • If your shared status isn’t updated for 60 days, it’s deleted automatically.

Hosting

Like any website, Cloudflare, my hosting provider, processes IP addresses and request details to deliver and secure the relay. I don’t use them to identify anyone, and I don’t keep separate logs.

What I don’t do

  • I don’t require an account.
  • I don’t show ads. The app has no analytics, crash-reporting or other third-party SDKs.
  • I don’t track you across other companies’ apps or websites.
  • I don’t sell your information or share it for targeted advertising.
  • I don’t use Health data for advertising or data mining.
  • I don’t receive your location, Health data or scores in a form I can read.

How long data is kept

  • On your iPhone: until you delete it in the app (Settings → Delete all data, or Clear location history) or delete the app.
  • On the relay: until you stop sharing or use Delete all data. If neither happens, for example because you deleted the app, it’s deleted automatically once it hasn’t been updated for 60 days.
  • Support emails: only as long as I need them to help you and to keep a record of your request.

Your choices

  • Withdraw consent at any time by turning off Location, Bluetooth, Health, Calendars or Notifications access for Exposure in iOS Settings. Features that need that access stop working.
  • Delete your data with Settings → Delete all data (everything, including your shared status) or Settings → Clear location history (places only). Deleting the app also removes its data from your iPhone.
  • Stop sharing in Settings → Family & Friends.
  • Your Apple Health data stays in Apple Health. The app never writes to Health, so you manage that data in the Health app.

Your privacy rights

Depending on where you live, privacy laws give you rights over your personal information. States with such laws include California, Washington, Nevada, Connecticut, Colorado and Virginia, among others. These rights generally include:

  • knowing what personal information is collected, and getting a copy;
  • correcting it;
  • deleting it;
  • opting out of its sale, of sharing for targeted advertising, and of certain profiling;
  • limiting the use of sensitive information, such as health data and precise location;
  • appealing a decision about your request;
  • not being treated differently for using these rights.

Here’s how they work with Exposure Radar:

  • Your data is on your iPhone, not with me, so you can act on it directly. Everything the app has is shown in the app. You can edit your places, and delete your data as described above.
  • Shared data on the relay is encrypted so that I can’t read it, and I can’t link it to your name or email. Stopping sharing or using Delete all data removes it right away.
  • There’s nothing to opt out of. I don’t sell personal information, share it for targeted advertising, or use it for profiling that has legal or similarly significant effects.
  • Sensitive information, such as health data and precise location, is used only to provide the app’s features.
  • Questions, requests and appeals: email support@human-memory.ai. I’ll respond within 45 days. If I can’t do what you ask, I’ll explain why and how to appeal. If you disagree with the result of an appeal, you can contact your state attorney general.
  • Where the law allows, someone you authorize can make a request for you.

If you live outside the United States, your local laws may give you similar rights. The same in-app tools and contact address apply.

Children

Exposure Radar isn’t directed to children under 13, and I don’t knowingly collect personal information from children. The app keeps its data on the user’s iPhone, and I don’t receive readable personal information from it.

Security

  • Data the app stores on your iPhone is protected by iOS data protection.
  • Family & Friends data is end-to-end encrypted with AES-256-GCM. The key never reaches the relay.
  • Every network request the app makes uses HTTPS.

No system is perfectly secure. If you think an invite link has reached the wrong person, stop sharing in the app. That deletes your shared data and makes old links useless.

This website

This website has no accounts, ads, analytics or tracking cookies. Cloudflare, which hosts it, processes IP addresses and request details to deliver and secure the site. I don’t use them to identify anyone, and I don’t keep separate logs. Its fonts are served from this site too, so your browser doesn’t contact any other company.

Emailing support

If you email me, I receive your email address and whatever you write. I use them only to answer you and handle your request. Please don’t include health details unless they’re needed to help you.

Changes to this policy

If I change this policy, I’ll post the new version here and update the effective date. For significant changes, I’ll also tell you in the app before they take effect. I won’t start collecting or sharing health data in a new way, or for a new purpose, without asking for your consent first.

Contact

Allison Bowman
support@human-memory.ai