Continuous location is the most privacy-sensitive thing whoot. does. What is captured, the guardrails that bound it, the control each individual holds, and how long any of it is kept.
Precise, continuing location of an identified person is the most privacy-sensitive processing in this product. It is also what turns the incident map from a record of where people were when they tapped acknowledge into a live picture you can dispatch from. Both of those are true at once, which is why the capability is bounded as tightly as it is — and why it's worth understanding exactly where the edges are.
Only inside an active, non-drill emergency alert, and only for people that alert reached. There is no shift mode, no duty mode and no path anywhere in the platform that accepts a coordinate outside one. Every single position write re-checks that the alert still exists, is still active, and that the person is still on the room it belongs to.
Both do the same job under the same rules, but they behave differently in one important way.
On the page, sharing takes an explicit tap and the browser's own permission prompt. Neither can be pre-set or bypassed by an administrator, and the tap is recorded with a timestamp.
In the apps, each person has a switch to object to background location sharing. It lives on their account rather than on a handset, so it survives a reinstall, a new phone or a wipe — and it is enforced on the server, not merely honoured by whichever client happens to be running. Everyone is shown an explainer describing what actually happens before it takes effect for them.
Movement history is kept for 30 days by default. Change it in Settings → General — a stadium running weekly events and a site under a statutory review period have genuinely different answers, and both are right. There is deliberately no keep forever option: an unbounded setting would quietly become a permanent tracking archive, which is the outcome a retention period exists to prevent.
Expiry removes only the intermediate points between positions — the granular breadcrumb trail. It shortens the movement trail on a replay. It never erases the incident record:
You are the data controller for everything captured about your own people. Before you turn live location on for a real incident, make sure you can point to a completed data protection impact assessment, that your staff have been told what is captured and when, and that your privacy notice and terms describe it. whoot. gives you the guardrails, the audit trail and the retention control; the transparency is yours to provide.