Privacy Policy

1. Who this policy covers

Sawa24 is a family driving-score and safety app. This policy covers everyone with a Sawa24 account: parents, adult family members, and children added by a parent. "Family" means the group created in the app by a parent, who invites other members.

The formal legal entity responsible for this policy (an individual founder, or a company to be formed) has not yet been finalized. That, and the entity's registered details, will be confirmed and published here before Sawa24 leaves beta -- still under legal review.

2. What we collect and why

We collect only what the product needs in order to work:

• Phone number -- to create your account and verify it's you, with a one-time code.
• Name / display name -- so your family can identify you.
• Location (GPS points while driving, live location, geofence centres) -- to detect trips automatically, compute your driving score, warn about speeding and nearby speed cameras, show your family where you are only while sharing is on, and power the SOS feature.
• Motion and speed data during trips (accelerometer/gyroscope, about 25 samples a second while driving) -- to detect harsh braking, harsh acceleration and phone handling while driving, which feed into your driving score.
• Trip summaries and scores (distance, duration, sub-scores, events, tips) -- the core product: your driving score and history, shown to you and your family.
• Device information (model, OS version, app version, push token, battery level) -- to send you notifications and to diagnose app/OS issues.
• Consent records (which version of this policy, or of the in-app consent text, you agreed to, and when) -- a record that you agreed, and so we know when to ask again after a change.

What we do not collect: we have no advertising SDK, no analytics SDK, and no third-party tracker. We do not sell or rent your data to anyone. Location is never used for advertising.

3. Family sharing -- how it works and what consent means

Sawa24's entire premise is that a family can see each other's driving. Because that's sensitive, here is exactly how consent and visibility work, matching what the app actually does:

• Every member explicitly consents before any location tracking starts -- an adult consents for themselves; for a child, the inviting parent records guardian consent when creating the child's invitation.
• The person being monitored always sees exactly what the parent sees -- the same trip history, map, scores and events. There is no hidden or reduced view. This is a deliberate product decision we do not compromise on.
• A visible sharing indicator is always shown whenever your location is being shared. Sharing is never silent.
• A child cannot turn sharing off. An adult member can, and when they do, every parent in the family is notified -- so turning sharing off is visible to everyone, not a private toggle.
• A parent can remove a member from the family, which immediately revokes that member's access to family data and stops sharing.

Whether guardian consent alone is a sufficient legal basis for processing a minor's precise location and motion data in every market we operate in is still under legal review, particularly for markets with specific rules on children's data. This section will be updated as that review completes.

4. How long we keep data (retention)

• Raw trip traces (the detailed GPS/motion recording of a trip): 30 days, then automatically and permanently deleted.
• Trip summaries, scores, and a simplified route: kept as long as your account exists -- this is the core product history.
• Live location: not stored as history beyond what's needed to show your current position on the family map; each update replaces the last.
• Account data, after you delete your account: a 7-day grace period (you can cancel deletion in that window), then permanently and irreversibly deleted.

Exact retention periods are still subject to final legal review in some markets.

5. Encryption and security

Anything location-shaped (trip traces, routes, live location, geofence centres) is encrypted at rest with a key unique to your family, before it's ever stored -- a copy of the database alone is not enough to read anyone's location history. All traffic between the app and our servers is encrypted in transit (TLS). We never log raw coordinates, addresses or phone numbers -- only counts and IDs, for debugging.

6. Who else sees your data

We use a small number of service providers to run Sawa24. None of them use your data for their own purposes -- advertising, analytics or resale. They process it only to provide their specific service to us, under contract.

• Hosting (Hetzner Online GmbH): sees encrypted data at rest; our servers run in Hetzner's data centre in Helsinki, Finland.
• SMS verification (Twilio, a US company): sees your phone number at the moment we send you a login code, in order to deliver it.
• Push notifications (Expo/EAS, a US company): sees your device's push token and a minimal "there's a new alert" message with no location or names in it -- the app fetches the actual details directly from our server once you open the notification.
• Map tiles (currently OpenFreeMap, planned to move to a self-hosted tile server before public launch): sees the map area your app requests tiles for while you're looking at a map.

For users outside the EU, data may be processed on servers located in Finland. Whether this requires additional safeguards or disclosure under local data-protection law is still under legal review -- we're treating this as an open compliance question, not a settled one.

7. Your rights

• Export your data: in Settings, request an export; you'll get a downloadable file (your trips as structured data, plus GPS tracks) within a day, available for 24 hours.
• Delete your account: in Settings, request deletion. You get a 7-day grace period to change your mind; after that, deletion is permanent and irreversible.
• Correct your information: update your profile in the app at any time.
• Ask us a question about your data: email [email protected].

Additional rights that may apply in specific markets (for example, the right to lodge a complaint with a named regulator) are still being confirmed.

8. Children's accounts specifically

A child's account is created by their parent, who records their consent to Sawa24 recording the child's trips and location. The child never enters a phone number to sign up -- they use an invitation link bound to their device, created by the parent. Everything in section 3 above (transparency, the visible indicator, not being able to disable sharing) applies equally to child accounts.

This section is intentionally short while the guardian-consent legal review noted in section 3 is pending.

9. Changes to this policy

If we materially change what we collect, why, or who we share it with, we'll show you the updated in-app consent text again and ask you to re-affirm it before you continue using the app.

10. Contact

[email protected]

A registered contact address may be required in some markets once our legal entity is finalized; this section will be updated then.