Privacy-first by design
How we protect you
We help unhoused neighbors in the Antelope Valley without surveilling them. No central database that sorts people into categories. No login or ID to find help. We reach people the tracking-based system can't — because we don't track them.
If you're looking for help
You can use this without being tracked
You do not have to create an account, give a phone number, or show an ID to find what's open near you. The resource map works for everyone, with nothing to sign up for.
We don't add you to a database, score you, or sort you into a category to decide what you deserve. There is no risk-score, no profile that follows you, and no list your name gets added to when you ask for help.
When you do choose to share something — like an email so a real person can write back — that's the only thing we use it for. You decide what to share, and you can use the map and the basics without sharing anything at all.
What that means concretely
- The resource map needs no account, no phone number, and no ID.
- Emergency help stays open here no matter what — it is never gated behind a sign-in or a flag.
- We never store a domestic-violence label on anyone. If you need that kind of help, we connect you to the specialists who handle it safely — and we keep no record of it.
- There is no behavioral tracking on these pages: no ad trackers, no analytics watching what you tap.
If you fund or partner with us
Why this reaches people the tracked system misses
Many coordination systems require a person to be entered into a central record — classified, counted, and tracked — before they can be helped. For someone who has been failed by institutions, or who has a reason to stay out of a database, that entry point is exactly where they walk away.
Guardians is built the other way around. The lowest tier of help asks for nothing. No one has to be legible to a database to get a meal, a resource, or a referral. That's not a slogan — it's the architecture, and it's why we can reach neighbors a record-first system structurally cannot.
This is also why it is hard to copy. A system whose funding depends on the data it collects cannot simply remove that data. Our differentiator is a choice we made about what NOT to hold.
The architecture, honestly
- No central classification database. We don't store domestic-violence status, substance-use history, or criminal history anywhere — several of these are blocked in code, not just policy.
- Domestic-violence routing is referral-only and off-platform. We hand off to the specialist agencies; their protected database operates at their boundary, not ours. We hold no survivor classification.
- Data minimization by default. The contact form's name field is optional; an email is used only to reply. Where a benefits packet would need a Social Security number, the platform is designed so it never has to hold one.
- No surveillance layer. No third-party behavioral analytics is installed on the site, and we don't hand user data to law enforcement absent a warrant.
The difference
Two ways to run a coordination layer
A record-first system
- Be entered into a central record before you can be helped
- Be classified, scored, and tracked over time
- Sensitive labels stored in one place
- Help can be gated behind a sign-in or a flag
Guardians of the AV
- Find help with no account, no phone, no ID
- No score, no profile that follows you
- Sensitive routing handed off, never stored
- Emergency help always open, regardless of status
The record, not a hypothetical
We didn't invent the risk we design against.
The surveillance version of 'homeless tech' already exists — and it has already harmed the people it catalogued. Here's the documented record, and how we're built to be its opposite.
Facial recognition sold to identify unhoused people — then breached.
A company called ODIN Intelligence sold police a tool to identify unhoused people, with a database that labelled them. In January 2023 it was hacked — spilling people's photos, reports, and Social Security cards.
How we're built to be the opposite
We use no facial recognition, keep no central identity database, and attach no labels. There is nothing to breach because we never collect it.
Privacy watchdogs warned the government about this 20 years ago.
EPIC told HUD that federal homeless-tracking guidelines were “highly privacy-invasive” — a system of tracking it likened to those imposed on people convicted of crimes.
How we're built to be the opposite
We designed out the exact data — Social Security numbers, birthdates, central registries — that the watchdogs flagged.
Humanitarian aid proves impact without a database of recipients.
Research with the International Committee of the Red Cross builds aid that “must avoid generating databases with recipients' data and creating digital traces.”
How we're built to be the opposite
Our credits prove what was funded and what was redeemed — provenance and accountability — without ever building a database of the people who received them.
Privacy, proven — not just promised
Five claims, and exactly where each is true.
Claim
No surveillance identity.
How it's proven in our system
No biometrics, no facial recognition, no condition or risk profile, no per-recipient case file. Sign-in holds only a minimal record (an email); SMS is disabled.
Claim
No sensitive intake.
How it's proven in our system
The benefits and document wizards store only which checklist items you ticked, in your own browser (sessionStorage) — no Social Security number, income, immigration, or health data, and no database write.
Claim
No domestic-violence classification.
How it's proven in our system
Migration 0050 removed the 'dv-survivors' value and dropped the related constraints; the only DV-related field anywhere is a yes/no flag on a help post, never on a person. DV is referral-only, off-platform.
Claim
Aggregate-only impact.
How it's proven in our system
The public ledger counts credits with a head-only query — it returns numbers, never rows. No individual is traceable.
Claim
Data expires.
How it's proven in our system
The contact form keeps minimal fields, stores no IP, and is built to purge anything older than 180 days.
| Claim | How it's proven in our system |
|---|---|
| No surveillance identity. | No biometrics, no facial recognition, no condition or risk profile, no per-recipient case file. Sign-in holds only a minimal record (an email); SMS is disabled. |
| No sensitive intake. | The benefits and document wizards store only which checklist items you ticked, in your own browser (sessionStorage) — no Social Security number, income, immigration, or health data, and no database write. |
| No domestic-violence classification. | Migration 0050 removed the 'dv-survivors' value and dropped the related constraints; the only DV-related field anywhere is a yes/no flag on a help post, never on a person. DV is referral-only, off-platform. |
| Aggregate-only impact. | The public ledger counts credits with a head-only query — it returns numbers, never rows. No individual is traceable. |
| Data expires. | The contact form keeps minimal fields, stores no IP, and is built to purge anything older than 180 days. |
Each row maps to a real line in our schema or code. Where we go further: read The Guardian Standard.
Read it yourself
Where these commitments live
We'd rather you check than trust us. The promises on this page are written down where they can be quoted back to us — and several are enforced in the code and the database, not just in a policy document.
We measure success by neighbors reached and helped — never by how many people we got into a database.