Generated 2026-08-13
What we check before a release
Garly is asked to notice a fall, to keep watching with the screen off, and to tell somebody where a person is. Software that makes those promises should be able to show its work.
This page is produced by running the checks, not by describing them. The numbers below come from the run that generated the page, on the day printed above. Nothing here is typed by hand.
2079checks passed
0failed
50suites run
What each suite guards
Almost every one of these exists because something went wrong first — usually on a real phone, before anybody else saw it.
| What it guards | Result |
|---|---|
| The apps ship only what the stores allow | 3 passed |
| Garly never appears inside a black box | 13 passed |
| A shared journey can always be stopped | 8 passed |
| The app does what the release notes claim | 4 passed |
| Armed is not the same as working | 12 passed |
| The iPhone keeps watching with the screen off | 15 passed |
| The page and the iPhone app agree on what exists | 11 passed |
| The bridge behaves at runtime, not only on paper | 12 passed |
| The server keeps each account separate, and deletion means deletion | 92 passed |
| The assistant's safety behaviour: what it must never say, and what it must always do. | 190 passed |
| needs a headless browser (playwright) | not run here |
| Programme arithmetic: limits, eligibility, and the cases it has to refuse. | 25 passed |
| The Android web view is HTTPS-only and origin-restricted, the camera is never granted, and the microphone only after the person allows it. | 0 passed |
| Every dialogue can be dismissed, and none of them traps the person behind it. | 25 passed |
| The nine evolution stages advance on real milestones, not on time spent in the app. | 45 passed |
| The app's language follows the person, and no screen falls back to English silently. | 19 passed |
| Screens hold together at small sizes, and nothing important scrolls off the edge. | 35 passed |
| needs a headless browser (playwright) | not run here |
| The app opens even when the billing service does not answer. | 8 passed |
| Eligibility and limits, checked on the server rather than trusted from the app. | 80 passed |
| These endpoints answer correctly, including for input that does not exist. | 24 passed |
| Progress counters record what actually happened, and cannot be inflated. | 46 passed |
| The server's endpoints answer what they promise, including when the input is wrong. | 60 passed |
| Insights are drawn from what the person told Garly, and never invented. | 71 passed |
| Facts are saved when stated, not deduced from behaviour. | 33 passed |
| Garly's tone stays consistent, and stays safe when the subject is not. | 104 passed |
| The preview account cannot reach or alter real accounts. | 42 passed |
| Nothing protective sits behind a purchase, and a purchase that fails leaves no half state. | 127 passed |
| Plan limits are enforced on the server, not trusted from the app. | 37 passed |
| Usage counting is per account and survives a restart. | 44 passed |
| An empty answer from the model never reaches the person as an empty bubble. | 22 passed |
| Where a test clip exists it is encrypted with a hardware key, never uploaded, and removed after 24 hours. | 72 passed |
| Crash reporting carries technical detail only — no names, contacts, places or conversations — and the advertising identifier stays off. | 44 passed |
| Walking and running are not mistaken for an emergency, and an emergency during a walk still fires. | 21 passed |
| The stop button for a live journey is reachable from wherever the person happens to be. | 20 passed |
| Every string on the website exists in every language it claims to speak. | 59 passed |
| Switching language does not lose the conversation or reset the person's settings. | 16 passed |
| The privacy policy and terms are complete in every translated language. | 106 passed |
| talks to the live model provider, so its result depends on a third party | not run here |
| A database upgrade keeps existing accounts intact and can be applied twice without harm. | 10 passed |
| needs a headless browser (playwright) | not run here |
| No screen shows a control that does nothing, and no prominent line contradicts a quiet true one. | 100 passed |
| needs the API running locally | not run here |
| A share link that was closed stays closed, and cannot be revived. | 50 passed |
| Android purchases are verified against Google before anything is granted. | 40 passed |
| Payout arithmetic, including the cases where it has to refuse to pay. | 53 passed |
| The PIN is never stored as text: the server keeps a separately salted one-way hash. | 29 passed |
| Private screens stay closed until the PIN is entered, on every route into them. | 26 passed |
| Wrong PIN attempts are counted and limited across devices, not only on one phone. | 47 passed |
| The PIN lock counts wrong attempts, spaces them out, belongs to one account, and never traps somebody at an unlock screen with no PIN to enter. | 46 passed |
| needs a headless browser (playwright) | not run here |
| Garly answers in the language it was spoken to. | 41 passed |
| needs a headless browser (playwright) | not run here |
| When an SOS ends, everything it started is shut down — no sensors and no sharing left running. | 11 passed |
| The app keeps to the rules both stores impose on this category. | 44 passed |
| Subscription state is read from the store, and expiry is honoured. | 37 passed |
| Walk mode starts on the phrases people actually use, survives the app closing, and ends when they arrive. | 0 passed |
What this page is not. Passing checks do not make software correct. They record the mistakes we already know how to make, and stop those particular ones from coming back. 7 suites could not run in the environment that generated this page, and they are listed above with the reason rather than left out.
Reading the code yourself
The Android and iPhone clients are published at github.com/GarlyTeam/garly, along with the security checks that run against them.