Privacy Policy

Who is responsible

Moustapha DRAME, 87 quai des Queyries, 33100 Bordeaux, France.

For any question or request about your data, write to hello.nasafe@gmail.com. We answer at the same address.

What is collected

Some of it is essential to the service, some is optional and marked as such. Nothing is collected without your knowledge.

• Identity: first name, last name, and a profile photo if you add one.
• Contact: your WhatsApp number, which serves as your identifier, and optionally a local number usable on site. Guides also provide an email address.
• Health, entirely optional: medical conditions, allergies and blood group. This information exists to be shown to a first responder, and for nothing else.
• Location: latitude, longitude, accuracy and timestamp. It is sent even when the app is closed, which is what allows a guide to find you if you are no longer able to open your phone.
• Device: a notification identifier, the make, model and system version, used to diagnose phones on which alerts fail to arrive.
• Usage: your group, your answers to roll calls and your SOS alerts.

Why it is collected

Each piece of data serves one precise function. None is used for advertising, and none is sold.

• Letting your guide know where you are and who is missing at roll call. That is the purpose of the service, and what you accept by joining a group.
• Sending an SOS alert to your guide, with your position at the moment you trigger it.
• Showing your health information to a first responder. This data is only processed if you provide it: leaving it empty prevents no other function.
• Sending you a sign-in code over WhatsApp.
• Fixing failures, from technical reports that contain none of your health data.

Who receives it

Your data is visible to the guide of the group you joined, and to that guide alone. No other pilgrim sees your location or your health information.

Four technical providers are involved, each for a single task:

• Twilio receives your phone number, to send you the sign-in code.
• Expo receives your phone's notification identifier, to deliver alerts to it.
• Google receives your position when a map is displayed, and crash reports from the app.
• Render hosts the server and the database.

Where it is kept

The servers and the database are located in the United States, in Virginia. Your data is therefore transferred there and stored there.

Traffic between your phone and the server is encrypted.

For how long

Your locations are deleted automatically after thirty days. That deletion is performed by the server, with no human involvement.

Other data is kept for as long as your account exists. You may request its deletion at any time, and that deletion is permanent.

Your rights

You may ask to see your data, to correct it, to have it deleted, or to object to its processing. If you have provided health information, you may withdraw it without affecting the rest of the service.

One address for all of this: hello.nasafe@gmail.com.

If our answer does not satisfy you, you may contact the data protection authority of your country.

How it is protected

Traffic travels over an encrypted connection. On your phone, the token that identifies you is kept in the system's secure storage, not in plain text.

Administrative access is password protected and is not reachable from a guessable address.

No system is infallible. Should a breach occur and concern you, you would be informed.

Minors

NaSafe is for adults only. The app is not intended for minors and does not knowingly collect their data. If you find that an account belongs to a minor, write to us and it will be deleted.

Changes

This page may change as the app changes. The date at the top shows the last update. A change that would widen the use of your data would be signalled inside the app, not only here.