1. Who this agreement is between
This agreement is between you — the person using the Duress EVAC app — and Duress Pty Ltd (ABN 11 613 710 026), an Australian company with registered office at 420 St Kilda Road, Melbourne VIC 3004. In this document "we", "us" and "our" mean Duress Pty Ltd. "The app" means Duress EVAC on iOS or Android and the closely related web pages it uses, including the confirm-safe link in messages we send you.
If you use the app on behalf of an organisation — a school, an employer, a venue operator — separate terms apply between us and that organisation. Those organisational terms do not change what this document says about you as an individual.
You must be at least 13 years old to install the app on your own. A parent or guardian may use it on behalf of a child, and a school or employer may nominate you as an emergency contact for a student or a co-worker where they already hold your details for that purpose. Section 10 covers what those invitations look like and how to decline them.
2. What the app does
The app is a coordination tool for emergencies and safety. It is not a substitute for the emergency services (see §7). There are four things you might do with it, and you can do any of them or none. Each is opt-in and each is turned on the first time you use that surface.
You can receive alerts for places you follow — a school, a workplace, a shopping centre — where the app tells you when something is happening there and lets you pause, stop or opt out at any time. You can ask for help nearby when you are in trouble, whether that is a medical emergency, a missing person, or a hazard at a venue, and the app can broadcast that ask to nearby people who have opted in to be asked and to nearby venues that have opted in to receive. You can help someone nearby, if you have opted in, by receiving a notification when somebody near you asks for help; accepting means you are willing to try, not that you have committed to a role (§4 covers this). And you can receive missing-person alerts as a specific procedure scoped to a venue that has opted in to run it (§5).
3. The consent model
Three commitments run through everything that follows.
Every alert type is opt-in. You are not enrolled in anything by installing the app. You choose which places you follow, whether you want to be asked to help nearby, whether you want missing-person alerts, and whether you want to receive emails or text messages as well as push notifications. You choose per channel and you can change any of these at any time from your account settings in the app.
Every message we send carries a way to stop. Email carries an unsubscribe link. Text messages carry a stop link, because STOP by keyword is not available on the alphanumeric sender identifiers we use — that is a carrier-side limitation, not a preference of ours. Push notifications are governed by your phone's own settings. Pausing a place stops both alerts and drill notices from that place without you having to unfollow it. There is one deliberate exception: pausing a place never suppresses a genuine live emergency there, because pausing at 3pm and being on fire at 4pm cannot mean silence.
We do not read your address book. The app does not ask for your phone contacts. If you have granted contacts access to another app, that access does not reach us. The mechanism organisations use to invite people from an emergency-contact list they already hold is described in §10 and is different in kind: the organisation is the sender and the data holder, not us and not you.
We do not build a location trail of you. As a rule, we do not store continuous location. There are three narrow exceptions, and each carries the same three properties — you opt in, you can stop, and we do not keep the data. A visitor or contractor signing in at a site may opt in to share position for the length of that visit, which is off by default; if you decline, you still receive every alert and still count in the safety numbers, because declining must never degrade your safety. During a nearby-help ask, we compute a coarse, neighbourhood-sized proximity bucket at the moment somebody asks, so that we can answer "does anyone within a few hundred metres carry a reliever?" — nothing about your location is stored between asks and once the ask ends, position is erased. And when you confirm you are safe, you may optionally attach where you are, but you may confirm safe without attaching anything.
We never sell, share or monetise location data.
4. Helping someone nearby — the civilian responder framework
If you opt in to being asked to help nearby, an ask may reach you when somebody within a set distance requests help. This section states, plainly, what accepting means.
Accepting is not a job and it is not a promise. You may accept and change your mind; you may accept and be too far away; you may accept and reach the scene after somebody else. None of that is a breach of anything. You act at your own discretion and your own risk. We do not train you, license you, supervise you or vouch for anyone else who accepts, and we make no warranty that anybody else who accepts is competent, present or trustworthy. Nothing in this app authorises you to enter private property, override a security instruction, or attempt anything you are not comfortable with. Do not go into danger for us — the app will never instruct you to approach a scene that is unsafe, and if a place feels wrong, leave.
Location sharing during a response is incident-only. While an ask is open we share your position with the sender for as long as you are en route; when the ask ends — resolved, cancelled or timed out — your position is erased from the record and the map, and cannot be written back to it afterwards.
Helping in a real emergency, especially one that did not end well, can be hard afterwards. The evidence on volunteer responders is clear that bad outcomes produce measurable distress and that training reduces it. We will provide access to independent aftercare information, and we will never turn the number of asks you accepted into a score, a badge or a leaderboard.
Good-Samaritan protections vary by jurisdiction and by circumstance. We do not offer a legal opinion on whether a protection applies to a given action. Nothing in these terms limits any protection you would otherwise have.
Always call 000 first, or your local emergency number. The app is a way to summon nearby help in addition to the emergency services, not instead of them.
5. Missing-person alerts
Missing-person is a specific procedure, scoped to a venue that has opted in — a shopping centre, a school, an aged-care facility. It is not a public broadcast in the AMBER Alert or Silver Alert sense, and it is deliberately narrower than either.
You receive missing-person alerts only if you have opted in to help nearby and the alert is inside the geographic scope of a venue that runs the procedure. You see a description or a generated avatar, never the child's photograph — real photographs go only to verified venue security and to police, flagged as restricted. Sightings never obligate you to approach anyone; the app will never instruct you to approach the person being looked for. A sighting is a pinged location and a description, nothing more, and trained venue security and, where required, police take it from there. Where a parent supplies a reference photo, that photo seeds a generated illustration and never becomes a face-recognition input — §14 covers this.
6. Route recommendations and maps
We do not choose a route for you and tell you to take it. We show you where an assembly point is on a map and print a distance. Where turn-by-turn is genuinely useful — a parent driving to a reunification point — we open a deep link into your phone's own maps app, whether that is Apple Maps or Google Maps, and it routes you under your existing relationship with that vendor.
We do not send your position to Google, Apple or any other routing service. Your phone's own maps app may, but that is between you and them, under the terms you have already accepted with them. We do not warrant any route your phone's maps app suggests. Where an organisation has authored an evacuation instruction that names a preferred exit or a step-free route, that is a decision-support message written by a person who knows the building — it is the organisation's instruction to you, not our recommendation. You assume the risk of following any route: we do not calculate routes and cannot be responsible for the consequences of one you follow.
7. Emergency information disclaimer
The app is a coordination tool, not a substitute for the emergency services. Always call 000 in Australia, 999 in the UK, 911 in the US, or your local emergency number first — every help-ask screen in the app leads with this instruction.
Delivery of any message is best-effort. Push notifications depend on your device having connectivity, sufficient battery, notifications enabled and the operating system permitting delivery. We honour the responses we get from Apple and Google, but we cannot guarantee that any specific message reaches any specific device at any specific time. The app also does not detect emergencies — it relays them once a person or an organisation raises one.
8. What we collect, and what we do not
We collect only what is needed to run the four things listed in §2. Your email address or phone number is collected at sign-in so we can confirm it is you when you sign in from a new device. Your device's push notification token is collected so we can send you push notifications. The places you follow are collected so we can send you alerts from those places. Your presence at a site, where you opt in and sign in, is collected so the site knows to count you in a drill or an emergency. Optional carriage flags (for example, "I carry a reliever") are collected so a site's emergency control team can find you during an incident — this is visible only to that team and never appears in a compliance report. Confirm-safe responses are collected so the site knows who is accounted for. And any voluntary text you type — a description, a message — is collected because you typed it.
What we do not collect: we do not build a location trail; we do not read your address book; we do not run face recognition, store face embeddings, or re-identify you across frames or devices; and we do not transmit the content of camera frames from any camera feature in the app. One narrow exception applies to camera use, and it is described in §14.
The Privacy Policy sets out each category of personal information in more detail and names the sub-processors that help us deliver the service.
9. What we do with what we collect
We use your data to run the four surfaces in §2, and we do not use it for anything else. We do not sell your data. We do not share it for advertising or marketing. We share it with the organisation you have chosen to follow only to the extent that organisation needs to run its drills, incidents and reports — for example, that you confirmed safe at 10:34, or that you are on site. An organisation never receives your address book, your other follows, or anything about you from outside its own site. We may share data with law enforcement or a regulator where we are required by law and the request is valid.
Signed compliance reports are retained for seven years by default for organisations on paid plans; free-plan retention is thirty days. The Privacy Policy sets out the specific retention periods for each category of your personal data.
10. The emergency-contact bulk invite
You may receive an invitation to follow a place — most commonly your child's school or your employer — that was sent because that organisation already holds your details as an emergency contact. The invitation is from the organisation, not from us. It is sent in the organisation's name, on a registered sender identifier where text messages are used, and we act as the organisation's processor for the message. The invitation is transactional, not marketing: it exists so that you can receive alerts about the emergencies you nominated yourself to be contacted about, through a channel better suited to the moment.
Declining is one tap, honoured immediately, and recorded so the organisation cannot re-invite you. No response is not consent — silence means nothing happens, and if you do not accept, your details are deleted from the invitation pipeline after 30 days. You gave the organisation these details for exactly this reason, and we do not do anything with them beyond delivering that invitation and, if you accept, connecting you to the place you are already an emergency contact for.
11. Safe mode
The app has a safe mode. What safe mode looks like on your phone is deliberately not published, because publishing the disguise defeats it.
On iOS 18 and later, safe mode is a guided setup that walks you through the operating system's own Hide App feature. Earlier iOS versions get an honest fallback that the setup describes in full. On Android, safe mode swaps the app's icon and label for a different, working app. The Apple and Google review teams are informed of the feature through private review notes, which is a requirement of both stores.
We do not disclose safe mode's appearance in marketing, on our website, or in press, and if you enable it, please do not screenshot it publicly either — every disclosure erodes the protection. Safe mode exists because a person whose partner controls their phone must be able to carry the app without carrying evidence of it.
12. Push notifications and Critical Alerts
Where iOS grants us the Critical Alerts entitlement, we use it only for a genuine live emergency at a place you follow. Critical Alerts override the ringer switch and Do Not Disturb, and we bind ourselves to this in our own code: never for a drill (a drill uses ordinary notifications), never for marketing (we do not send marketing pushes at all), and only for the audience the emergency is actually for — a lockdown notice for a school will not wake the whole city. Android's high-priority notifications are used with the same discipline.
The iOS Critical Alerts entitlement is granted case by case by Apple. Where we do not have it, we will not send a payload that pretends to it.
13. Accessibility
We commit to WCAG 2.2 AA as a target across every screen in the app, and to the principle that every alert is perceivable through at least two of sound, sight and touch, and confirmable without any particular one.
Specifically, no state is indicated by colour alone; nothing flashes faster than three times per second, so the app does not risk triggering photosensitive seizures; the alert and the all-clear carry distinct, learnable haptic signatures so a deafblind user can tell them apart by touch; confirm buttons are labelled "I am safe" and "I need help", never yes/no; and every image and every icon control has a text alternative. If you use the app and find something that is not accessible, tell us at the address in §19 and we will treat it as a bug.
14. Camera features and the vision layer
The camera features in the app — the missing-person crowd scan and any incident-streaming preview — run on your device. Video frames are not written to storage and are not transmitted. The only file that ever reaches a third party as part of these features is a reference photograph you deliberately attach to a missing-person alert, and only where you have consented, at that moment, on that screen, for that photograph to seed an avatar. The avatar is generated by an image-generation service and the reference photograph is used only as the seed for that generation. It is not a face-recognition input and it is not retained by us beyond the generation.
We capture three axes of consent for a missing-person photograph — whether responders see the real photograph, whether security and police may hold it, and whether we may keep it for later model improvement — and consent to any one does not imply consent to another.
15. Termination
You may stop using the app at any time. Deleting the app from your device is enough for us to stop sending you push notifications; to stop the emails and text messages as well, use the unsubscribe or stop link, or your account settings in the app.
To ask us to delete your account entirely, follow the deletion flow in the app or write to us at the address in §19. When you delete an account, we redact rather than physically delete records that are part of a signed compliance report, because deleting a person from a report changes an already-issued attestation and is not lawful for us to do. Redaction removes your identifying details from the record while leaving the count itself intact, and the Privacy Policy describes this in more detail. An organisation whose place you follow may also remove you from its roster, which stops the alerts from that place and does not affect anything else.
We may suspend or terminate an account where the app is being used to harm somebody — to stalk, to harass, to spoof an emergency, or to defeat the safety of another user. We will state the reason in writing where we lawfully can.
16. Warranty, liability and indemnity
We take reasonable care to make the app available and to keep it working. We do not warrant that the app will be uninterrupted or error-free, and we do not accept responsibility for its usability with any of your devices or applications. §7 states what the app is and is not: it is a coordination tool, not a substitute for the emergency services, delivery of any message is best-effort, and the app does not detect emergencies.
Australian Consumer Law is paramount
Nothing in these terms excludes, restricts or modifies any right or remedy you have under the Australian Consumer Law that cannot lawfully be excluded, restricted or modified. If a term of this agreement would otherwise be unfair within the meaning of section 24 of the Australian Consumer Law, we will not apply that term without taking steps to mitigate any unfairness.
If we supply you with services that are subject to a non-excludable Consumer Guarantee, our liability for failing to comply with that Guarantee is limited to, at our option, supplying the services again or paying the cost of having the services supplied again. Where we supply you with goods that are subject to a non-excludable Consumer Guarantee (other than certain guarantees about ownership and undisturbed use), our liability is limited to, at our option, repairing, replacing or supplying equivalent goods, or paying the cost of doing so.
Our liability to you
Subject to the Australian Consumer Law and to the paragraph below, we accept liability for direct loss to the extent it is caused by our negligence or our breach of these terms, on ordinary principles of law. Our aggregate liability for any event, or any series or combination of events, that gives rise to such loss will not exceed the fees you have paid us in the month in which the event occurred. Because the public app is free for individual users, that cap will typically be zero, and to that extent our aggregate liability to you for all claims and losses arising in connection with these terms or your use of the app is nil.
Subject to the Australian Consumer Law, our liability for consequential loss — including economic loss, business interruption, loss of revenue, loss of profits, loss of data, and loss of goodwill — is excluded to the fullest extent the law allows.
Nothing in this section limits any liability that cannot lawfully be limited, including liability for personal injury or death caused by our negligence, or for fraud or wilful misconduct.
Your reimbursement to us
You will reimburse us for any loss we suffer in connection with your use of the app in a way that breaches a law or infringes the rights of another person — for example, deliberately raising a false alert, using the app to stalk, harass, threaten or defraud somebody, or breaching a third party's intellectual property or privacy rights. This does not apply to the extent that we contributed to the loss by our own negligence, breach of any law, or breach of these terms.
17. Governing law
These terms are governed by the laws of Victoria, Australia — the state in which our registered office is located and the same governing law as our other Duress products. You and we submit to the exclusive jurisdiction of the courts of Victoria. If you use the app from outside Australia, additional local rules may apply and nothing in this document overrides a right you have under a mandatory law where you live.
18. Changes to these terms
We may update this document. Where a change materially affects you — a new data use, a new fee, a change to what safety-critical features do — we will notify you in-app, and by email if we hold an email for you, at least 14 days before it takes effect. Continued use of the app after that date is acceptance of the change. If you do not accept, you may stop using the app under §15 and no fee attaches to doing so. The current version and effective date are shown at the top of this document.
19. Contact
For general support, write to support@duress.com. For anything to do with your personal data — access, correction, deletion, complaint — direct it to our Privacy Officer at the same address. By post, our address is:
Duress Pty Ltd
420 St Kilda Road
Melbourne VIC 3004, Australia
20. Related documents
The Privacy Policy is the detailed statement of what we collect, how we handle it, and your rights over it, and is published alongside these terms. A separate Organisation terms agreement governs any organisation that operates a site or venue on the platform; those terms do not change what this document says about you.