Last updated: October 12, 2026
Your privacy is the entire point of bail.out This policy explains exactly what we collect, what we don't, and why.
iCloud identifier. bail.out uses the iCloud account already on your device and receives an anonymous iCloud user identifier from Apple. We use it only to link the plans, answers, and requests you create. We never see your email or Apple ID.
Your display name. The first name you enter in the app. It's shown to friends where your identity is the point: guest lists, location votes, and emergency bail.outs and answers. It is not attached to your anonymous attendance answers.
Your phone number (optional). If you save your own number in Profile, it's kept on your device and used in CloudKit lookups so plans and emergency bail.outs sent to that number can reach you. To deliver emergency alerts, CloudKit also keeps it in the push subscription for your device.
Plan content. Event names, dates, optional locations, and the phone numbers of guests you invite are stored in our Apple CloudKit database so they can sync across your devices and reach invitees.
Votes. When you cast a vote, the choice is stored as a record in CloudKit so the count can be aggregated. The app only ever queries the count. Even with raw database access, votes are not tied to displayed user identities in the UI.
Emergency bail.out. When you send one, we store your display name, the names and phone numbers of the friends you picked, when it expires (30 minutes), and whether it's open, done, or cancelled. When a friend answers, we store their display name and their answer ("heading out" or "staying"). No location, ever.
Notifications. Reminders are scheduled locally on your device. To deliver live updates and emergency bail.out alerts, Apple CloudKit keeps push subscriptions for your device: which of your plans to watch, and your saved phone number for emergency alerts.
Contacts. Used only to populate the invite picker. The picker reads contact names and phone numbers on your device. We do not upload your contacts. Only the phone numbers of guests you actually select get sent to CloudKit so the invitees' apps can find the event.
Notifications. Used for event reminders, to alert you when a plan you're part of changes (for example, gets cancelled), and to deliver emergency bail.outs and answers.
iCloud. Required. bail.out uses Apple's CloudKit to sync plans across devices and to deliver real-time updates.
This is the core design promise of bail.out and we take it seriously:
When a plan uses location voting (guests vote on which venue to go to), those votes are intentionally visible. Everyone in the plan can see who voted for which location. This is by design — picking a restaurant is a preference, not a secret. Location votes are stored in CloudKit and attributed to your display name.
You can delete any plan you created from the home screen (long-press → Delete). This permanently removes the event, guest list, and all associated votes from our CloudKit database — no action needed on our end.
To delete everything at once, go to Profile and tap "Delete Account." This permanently deletes the plans you created, your answers and place votes, the emergency bail.outs you sent and the answers you gave, your name, and everything bail.out stored on your device.
For plans you were invited to but did not create, your phone number may remain in those plans' guest lists. To remove that data, email bail.out.app.official@gmail.com with the subject "Delete my account" and we will remove your records within 7 days.
bail.out is not directed at children under 13. We don't knowingly collect data from anyone under that age.
If we make material changes, we'll update the "Last updated" date and notify users in-app on next launch.
Questions, concerns, or deletion requests: bail.out.app.official@gmail.com