FestBound is a private field-test application for invited festival crews. It helps consenting members exchange encrypted last-known locations and a small set of preset status messages when cellular service is intermittent. It is not a public social network, does not guarantee continuous tracking, and is not an emergency-response service.
The app processes precise location, capture time, GPS accuracy, a preset status, and a pseudonymous sender identifier. It also processes a stable Sign in with Apple subject, random installation identifier, device public key, private crew membership, role, routing identifiers, and keyed session-token hashes. The service does not ask for or store a participant's Apple email address or name.
Precise location and preset-status payloads are encrypted on the sender's iPhone with a key shared through the private invitation. The mailbox stores routing metadata and opaque encrypted bundles; it cannot read coordinates, capture times, accuracy, preset contents, crew keys, or local display names. Current invited crew devices can decrypt crew updates.
Information is used only to authenticate invited devices, create and join a private crew, deliver encrypted updates, display honest freshness and accuracy, diagnose the pilot, enforce expiration, and support participants. FestBound does not sell personal information or use it for advertising, cross-app tracking, data brokerage, public discovery, or automated profiling. Infrastructure providers, Apple, and TestFlight process data only as needed to provide those services or when legally required.
Routine location payloads expire no later than 12 hours after capture or at the event deadline. Preset messages expire at the event deadline. The service is designed to delete the event, memberships, invitations, and opaque bundles within 24 hours after that deadline. Refresh-token families expire within 90 days. Event-scoped records, diagnostics, local names, configuration, membership, and crew-key material are erased on the iPhone at the event deadline or sooner when a participant chooses Erase Event Data.
Sharing is off until the participant explicitly starts Festival Mode. Participants can deny location or camera access, use foreground-only location, stop sharing, discard undelivered updates, erase event data, leave the private crew, and end pilot participation. Camera access is used only to scan a private invitation QR code; images are not uploaded or retained by FestBound. Display names entered for friends remain on that iPhone.
FestBound uses device-only Keychain storage, authenticated encryption, expiring one-time invitations, application-level acknowledgements, and bounded retention. No system can guarantee security or delivery. A stale or unknown marker is historical information, not proof of a person's current location. Contact event staff or emergency services immediately when help is needed. The private pilot does not knowingly enroll anyone under 18.
A monitored privacy and deletion email will be published here before TestFlight distribution. Material policy changes will be communicated to participants before a new build or pilot phase processes information under those changes.
