Privacy Policy — SafeOn Personal Safety

1. Data Controller

This Privacy Policy applies to the SafeOn mobile applications (iOS and Android) and cloud backend services. SafeOn is developed and operated with primary operations based in Vaasa, Finland.

Data Controller: SafeOn Technologies / Vinod Sukunimetön

Location: Vaasa, Finland (European Union)

Official Correspondence: safeon.support@gmail.com • business@safeonapp.eu

2. Core Principle: Zero 24/7 Continuous Tracking

SafeOn is engineered on a strict data-minimization philosophy. Unlike lifestyle tracking or social surveillance applications:

SafeOn does NOT track, record, or monitor your location during normal daily life.
There is no background tracking daemon running when you are not actively using emergency or walk features.
There is no API allowing family members, friends, or third parties to query your location on demand.
Location coordinates are only accessed and transmitted when you explicitly: (a) Arm a "Walk Me Home" timer, or (b) Trigger an Emergency SOS or Secret SOS session.

3. Information We Process

A. Account Credentials: User email address and authentication tokens authenticated securely through Firebase Authentication.

B. Safety Circle Contacts: Phone numbers and email addresses of contacts you designate as Trusted Contacts or Emergency Contacts.

C. Ephemeral Location Telemetry: Latitude, longitude, horizontal accuracy, and timestamp collected only during an active walk or emergency session.

D. Optional Emergency Medical Profile: Critical health notes (e.g. blood type, allergies) entered voluntarily and encrypted for emergency circle viewing during an active SOS.

4. Physical Server Location & Subprocessors

All personal user data, active sessions, and location telemetry are hosted and stored strictly within the European Union:

API Backend Service

Render Services • European Union (EU)

PostgreSQL Database

Supabase EU • European Union (EU)

5. Automated Data Retention & Auto-Purge Schedule

In accordance with Article 5(1)(e) of the GDPR, location telemetry is subject to strict automated retention policies:

Location Coordinates (GPS): Automatically and permanently deleted after 30 days via backend retention cron (`purgeExpiredLocationData`).
Encrypted SOS Medical Snapshots: Automatically purged after 72 hours following alert resolution.
Abandoned Inactive Sessions: Automatically closed after 24 hours.

⚠ Statutory Emergency Disclaimer

SafeOn is an independent peer-to-peer personal communication tool. It is NOT an emergency dispatch agency and is NOT a replacement for official government emergency services (such as 112 in Finland and the EU). In any acute life-threatening emergency, medical crisis, or crime in progress, always call 112 directly.

7. Your Rights Under GDPR

Under European privacy law, you retain full rights to: