Privacy Policy

1. Information We Collect

1.1 Information You Provide Directly

• Account Information: Full name, email address, phone number, and password when you register.
• Profile Information: Profile photo, bio, and any edits you make to your public profile.
• Emergency Contacts: Names, phone numbers, email addresses, and relationship type of people you designate to receive SOS alerts.
• Friend & Family Network: Names, email addresses, and relationships of trusted contacts you link for location sharing or monitoring.
• Posts & Content: Text, images, and videos you upload when reporting incidents or interacting with the community feed.
• Bank Account Details: Bank name, account number, and account name that you submit to receive earnings withdrawals (processed by our backend; not stored on your device).
• Support Communications: Any messages you send to our support team.

1.2 Information Collected Automatically

• Precise GPS Location: Latitude, longitude, and accuracy timestamp — collected when you create location-tagged posts, view the Nearby feed, activate SOS, use Friend/Family monitoring, or enable Lost Phone mode. See Sections 4, 5, and 6 for full detail.
• Device Push Token: A unique token assigned by Google (FCM) or Apple (APNs) that allows us to send you push notifications.
• Session & Device Metadata: Device type, operating system version, app version, session timestamps, and IP address at login — used for account security and session management.
• Usage Data: Features you interact with, pages you visit, and engagement actions (likes, comments, views) on posts — used to improve the app and calculate your content earnings.
• App Crash & Performance Logs: Diagnostic data generated when the app encounters errors, used solely for debugging.

1.3 SOS Emergency Data

• Real-Time Location: Precise GPS coordinates transmitted every 5–10 seconds during an active SOS session.
• Audio Recordings: Microphone audio captured and streamed (or uploaded) during an active SOS session as evidence for emergency contacts or authorities.
• Video Recordings (Premium): Camera video captured and streamed during active SOS sessions for Premium subscribers.
• Session Metadata: Start time, end time, duration, cancel reason, and transmission status of each SOS session.

1.4 Biometric Data

If you enable biometric login (Face ID / Touch ID / Fingerprint), your credentials are stored using the operating system's secure enclave (iOS Keychain or Android Keystore). This data never leaves your device and is never transmitted to our servers.

1.5 Data We Do NOT Collect

• We do not collect or store payment card numbers — subscription payments are handled entirely by the Apple App Store / Google Play via RevenueCat.
• We do not build advertising profiles or sell your data to third-party advertisers.
• We do not scan your contacts list or address book without your explicit action.

2. How We Use Your Information

We use your information only for the following purposes:

2.1 Core Safety Services

• Activate and manage SOS emergency alerts and dispatch location updates to emergency contacts.
• Enable Friend & Family location sharing and monitoring features.
• Support Lost Phone mode by transmitting device location to your account.
• Display nearby community incident posts relevant to your current area.

2.2 Account & Identity Management

• Create, authenticate, and maintain your account.
• Enable secure login with password, email verification, optional two-factor authentication (2FA), and optional biometric login.
• Manage active sessions and allow remote sign-out from other devices.

2.3 Community & Content Features

• Display your posts to other users within the relevant geographic area.
• Calculate and credit engagement points and earnings from verified community posts.
• Facilitate earnings withdrawals to your Nigerian bank account.

2.4 Notifications & Alerts

• Send push notifications about nearby incidents, emergency alerts you are a contact for, and important app updates.
• Send email or SMS alerts to your emergency contacts when you trigger an SOS event.

2.5 Safety & Fraud Prevention

• Detect and prevent fraud, abuse, spam, and violations of our Terms of Service.
• Review flagged posts through our moderation system.
• Protect your account from unauthorised access.

2.6 Product Improvement

• Analyse anonymised and aggregated usage patterns to improve app features and performance.
• Debug crashes and performance issues using diagnostic logs.

2.7 Legal Compliance

• Comply with applicable Nigerian laws, including the Nigeria Data Protection Act (NDPA) 2023.
• Respond to lawful requests from law enforcement or courts.
• Meet obligations under the Apple App Store and Google Play Developer Programme Policies.

4. Location Data & Background Tracking

4.1 When We Access Your Location

Owl App accesses your device location in the following specific circumstances:

• Creating Posts: When you report an incident and choose to add a location tag.
• Viewing Nearby Incidents: To show you community posts relevant to your area (can be disabled in Privacy Settings).
• SOS Emergency Mode: Continuous precise tracking begins immediately when you activate SOS and continues until you cancel. This also operates when the app is in the background or minimised.
• Friend & Family Monitoring: When you have been granted permission to monitor a trusted contact's location, or have granted them permission to monitor yours — see Section 5.
• Lost Phone Mode: When you activate Find My Device, the app transmits your device's GPS location from the background at regular intervals — see Section 6.

4.2 Background Location Access

4.3 Location Display on Posts

• When you tag a post with your location, your post shows an approximate area name (e.g., "Ikeja, Lagos") — not your exact GPS coordinates.
• You can disable the location display on posts entirely in Privacy Settings. Your location will still be used to determine which users see the post, but will not be shown publicly.

4.4 SOS Location Precision

During active SOS sessions, exact GPS coordinates (latitude, longitude, accuracy) are shared with your designated emergency contacts. This precision is essential for safety and cannot be reduced during SOS.

4.5 Your Location Controls

• Disable the Nearby incident feed (no location access for discovery).
• Hide your location display on all posts.
• Manage Friend/Family location sharing permissions per individual contact.
• Deactivate Lost Phone mode to stop background GPS transmission.
• Revoke location permission entirely via OS Settings (disables location-dependent features).

6. Lost Phone / Find My Device Mode

6.1 What This Feature Does

If your phone is lost or stolen, you can activate Lost Phone Mode from another device via your Owl App account. Once activated, the app on the lost device begins transmitting its GPS location to our servers at approximately one-minute intervals, even when the app is closed or the screen is locked.

6.2 Data Collected in Lost Phone Mode

• GPS Location: Latitude and longitude transmitted every ~60 seconds.
• Remote Audio: You may optionally activate a remote microphone stream from the lost device to help locate or assess the situation.
• Session Persistence: Lost Phone mode survives app restarts — the mode remains active until you explicitly deactivate it from a signed-in device.

6.3 Important Notice

6.4 Who Can Access This Data

Location and audio data from Lost Phone mode is accessible only to the signed-in account holder. It is never shared publicly.

7. Data Sharing & Disclosure

7.1 What Is Publicly Visible

• Posts you create (text, images, videos) — visible to all Owl App users.
• Your public profile (name, profile photo, trust score).
• Approximate location area tag on posts (if enabled).
• Your public comments and reactions on posts.

7.2 What Is NEVER Shared Publicly

• Exact GPS coordinates from your device.
• SOS recordings, location tracks, or session data.
• Friend/Family location data or audio streams.
• Lost Phone mode location data.
• Emergency contact names, phone numbers, or email addresses.
• Your personal email address or phone number.
• Bank account details.
• Biometric data (stored only in OS secure enclave on your device).

7.3 Third-Party Service Providers

We share limited data with the following trusted service providers solely to operate the app. Each provider is contractually bound to use your data only for the described purpose.

We do not sell, rent, or trade your personal information to any third party for advertising, marketing, or commercial profiling purposes.

7.4 Legal Disclosures

We may disclose your information when we have a good-faith belief it is required:

• In response to a valid court order, subpoena, or other lawful legal process.
• To comply with a request from Nigerian law enforcement or a regulatory authority.
• To protect the rights, property, or safety of Owl App, our users, or the public, where permitted by law.
• To prevent or investigate fraud, security threats, or abuse on the platform.

Where legally permitted, we will notify you before disclosing your data to government entities.

7.5 Business Transfers

In the event that Owl App is acquired, merged with another company, or its assets are transferred, your data may be transferred as part of that transaction. We will notify you via in-app notification and email at least 30 days before any such transfer, and you will have the right to request deletion of your data prior to the transfer.

8. Data Security

8.1 Technical Safeguards

• Encryption in Transit: All communication between your device and our servers uses HTTPS (TLS 1.2+) and secure WebSocket (WSS). Mixed-content HTTP connections are blocked.
• Encryption at Rest: Sensitive data stored on our backend servers is encrypted at the storage level.
• Biometric & Keychain Storage: If you enable biometric login, your credentials are stored exclusively in your device's operating system Keychain (iOS) or Keystore (Android) and never transmitted to our servers.
• Access Controls: Server-side access to user data is role-based. Employees can only access data strictly necessary for their function, and all access is logged.
• Authentication Security: Passwords are hashed and salted before storage. The app supports two-factor authentication (2FA) via email OTP. JWT access and refresh tokens are rotated on each use.
• Session Management: You can view and remotely revoke active sessions on other devices at any time via Security Settings.

8.2 SOS-Specific Security

• SOS recordings and location tracks are stored in isolated, access-controlled storage separate from general app data.
• Access to any SOS data is strictly limited and requires elevated authorisation.
• SOS data is never used for advertising, analytics, or any purpose other than emergency response.

8.3 Important Limitations

Note: No system can guarantee absolute security. While we implement industry-standard safeguards, we cannot guarantee that unauthorised access, disclosure, alteration, or destruction of your data will never occur. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and the relevant Nigerian data protection authority (NDPC) within 72 hours of becoming aware.

8.4 Your Responsibilities

• Use a strong, unique password for your Owl App account.
• Enable two-factor authentication (2FA) in Security Settings.
• Keep your device OS and the Owl App up to date.
• Do not share your login credentials with anyone.
• Use the "Sign Out All Sessions" feature if you suspect unauthorised access to your account.

9. Your Rights & Controls

Under the Nigeria Data Protection Act (NDPA) 2023 and general privacy best practice, you have the following rights regarding your personal data.

9.1 Right to Access

• View your profile, posts, SOS history, and emergency contacts directly within the app.
• Request a complete export of your personal data. We will provide it in JSON format within 30 days.

9.2 Right to Rectification

• Edit your profile information, emergency contacts, and friend relationships at any time within the app.
• Contact us for corrections to data you cannot update directly.

9.3 Right to Erasure (Delete Account)

• Delete individual posts at any time.
• Request full account deletion from Profile → Settings → Delete Account, or by emailing us.
• Upon account deletion, all personal data will be permanently erased within 30 days and removed from backup systems within 90 days.

Exception: Data subject to an active court order or law enforcement legal hold may be retained for the duration required by law.

9.4 Right to Restrict or Object to Processing

• Disable the Nearby feed to prevent location-based content processing.
• Hide location display on posts.
• Opt out of product-improvement analytics by contacting us.
• Disable push notifications via device OS settings.

9.5 Right to Data Portability

• Request a machine-readable export of your data (JSON format).
• You are free to use this data with other services.

9.6 Right to Withdraw Consent

• Withdraw consent for Friend/Family location monitoring by removing the relationship in the app.
• Revoke location permission at any time via OS device Settings.
• Disable biometric login in Security Settings (credentials are immediately deleted from the device Keychain/Keystore).

To exercise any of these rights, email us at privacy@owlapp.ng. We will respond within 7 business days.

10. Data Retention

10.1 Active Account Data

• Profile & Account Information: Retained for as long as your account is active.
• Community Posts: Retained while your account is active; deleted within 30 days of account deletion.
• Location History (Friend/Family): Retained for 90 days, then automatically purged. You can delete it manually at any time.
• Usage & Activity Logs: Retained for 12 months for security monitoring, then deleted.
• Push Notification Token: Retained while you have the app installed and deleted when you sign out or uninstall.

10.2 SOS Data

• SOS Audio/Video Recordings: Stored for 90 days (free plan) or as configured for Premium subscribers, then automatically deleted unless you explicitly save them.
• SOS Location Tracks: Stored for 90 days then purged.
• SOS Session Metadata (start/end time, contacts notified): Retained for 1 year for your safety records.
• Legal Hold: SOS data related to an active law enforcement investigation will be retained for the duration of the legal requirement.

10.3 Lost Phone Mode Data

• Location data transmitted in Lost Phone mode is retained for 30 days or until you deactivate the mode, whichever comes first.

10.4 Deleted Account Data

• Personal Information & Posts: Deleted within 30 days of account deletion request.
• Backups: Removed from all backup systems within 90 days.
• Aggregated, Anonymised Analytics: May be retained indefinitely as it cannot be linked to you.
• Legal Hold: Data subject to a court order may be retained for the legally required period despite an account deletion request.

11. Children's Privacy

Owl App is intended for users aged 13 and older. We do not knowingly collect, use, or disclose personal information from children under the age of 13. If you are under 13, do not register for or use this app.

If you are a parent or guardian and believe your child under 13 has provided us with personal information, please contact us immediately at privacy@owlapp.ng and we will delete that information as quickly as possible.

For users aged 13–17: We strongly recommend that a parent or guardian review this Privacy Policy with you, particularly sections relating to SOS, location sharing, and Friend/Family monitoring. Users under 18 should enable these features only with parental awareness and consent.

Because Owl App requests camera, microphone, and background location access — which are sensitive permissions — we encourage parents to use device-level parental controls to manage minors' access to these features.

12. International Data Transfers

Owl App is operated primarily for users in Nigeria. However, our backend infrastructure is hosted on Railway (railway.app), which may store and process your data on servers located outside Nigeria (including regions in the United States or Europe).

Additionally, some third-party services we use (see Section 7.3) operate globally:

• RevenueCat — subscription management (United States)
• Google (Firebase, Maps) — push notifications and maps (global infrastructure)
• Apple Push Notification Service — iOS push notifications (global infrastructure)

When your data is transferred internationally:

• All data is encrypted in transit using TLS and at rest on our backend.
• Third-party providers comply with applicable international data protection standards.
• We maintain contractual data processing agreements with our service providers to ensure your data is protected to a standard equivalent to Nigerian and internationally recognised privacy laws.
• Your rights described in Section 9 apply regardless of where your data is stored.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our app features, legal obligations, or data practices. When we do:

• We will update the "Last Updated" date at the top of this page.
• For material changes — such as new categories of data collection or new third-party sharing — we will notify you via an in-app notification and, where possible, via email at least 14 days before the changes take effect.
• For minor changes (e.g. clarifications, reorganisation), the updated policy will be published in the app and on our website.
• Your continued use of Owl App after the effective date of a change constitutes your acceptance of the updated policy. If you do not agree with the updated policy, you may delete your account before the changes take effect.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.