Privacy Policy

The entity responsible for your personal data:

Our Data Protection Officer (DPO) can be contacted at dpo@aruga.io.

Account information (you provide directly)

• Email address
• Password (stored hashed; we never see the raw value)
• Full name, nickname, username
• Mobile number (Philippine format)
• Date of birth
• Address (region, city, barangay)
• Profile photo (optional)

Safety and service data (generated by use)

• Friends list, mute list, SOS alert data
• Geographic coordinates during alerts
• Push notification tokens
• Custom category and message during alerts

Technical data (automatically collected)

• Authentication attempt records (for rate limiting)
• Device type, operating system, app version
• Approximate IP address (for security monitoring)

What we do NOT collect

• We do NOT collect your location continuously, only during active SOS alerts
• We do NOT read your messages, contacts list, photos, or camera roll
• We do NOT track your browsing on other apps or websites
• We do NOT sell your data to advertisers
• We do NOT use third-party advertising trackers

• Service delivery to provide SOS alerts, location sharing, and notifications
• Authentication and security to verify your identity and prevent fraud
• Account management to maintain your profile, settings, and preferences
• Communication for service emails (verification, password reset, security)
• Compliance with Philippine law
• Improvement via aggregated, anonymized usage (we never identify you in analytics)

Under the PH Data Privacy Act, we process your data based on:

• Consent — explicit consent during signup and for specific features
• Contract — processing necessary to provide the Service you signed up for
• Legitimate interests — fraud prevention, security, and Service improvement
• Legal obligation — when required by Philippine law
• Vital interests — to protect life and limb during emergencies

Your trusted contacts

When you trigger an SOS alert, we share your name, location, alert details, custom message, and tracking link with friends you have added.

Anyone with your tracking link

If you share a tracking link, anyone with that link can view your live location and alert details until you resolve the alert.

Service providers

• Google / Firebase — authentication, database, push notifications (asia-southeast1 region)
• Vercel — web hosting for aruga.io, track.aruga.io, auth.aruga.io
• Resend — transactional email delivery
• Expo Push Service — mobile push notification routing
• HaveIBeenPwned — password breach checking (k-anonymity, password never leaves your device in identifiable form)

Future service providers

• PayMongo — payment processing for Aruga Pro subscriptions
• Semaphore — SMS delivery in the Philippines

We do NOT

• Sell your personal data to anyone
• Share your data with advertisers
• Trade your data with data brokers

Your data is primarily processed in Google Cloud's asia-southeast1 (Singapore) region. Some providers (Vercel, Resend) may process data in the US or EU under appropriate safeguards.

• Active accounts: data retained while your account is active
• Resolved SOS alerts: kept for 90 days, deleted after 1 year
• Auth attempts: kept for 30 days
• Deleted accounts: personal data removed within 30 days of deletion
• Backups: may persist in encrypted backups for up to 90 days

• Encryption in transit (HTTPS / TLS)
• Encryption at rest (Firebase / Google Cloud)
• Password hashing (Firebase Auth)
• Strict Firestore Security Rules
• Rate limiting on authentication attempts
• HaveIBeenPwned breach check (k-anonymity API)
• Optional 2-step verification (coming soon)

Under the PH Data Privacy Act, you have the following rights:

• Right to be informed about what data we collect and how we use it
• Right to access a copy of your personal data
• Right to correct inaccurate information
• Right to object to certain processing activities
• Right to erasure via Settings → Delete Account
• Right to data portability in a portable format
• Right to damages if your rights are violated
• Right to lodge a complaint with the National Privacy Commission at privacy.gov.ph

To exercise any of these rights, contact us at privacy@aruga.io. We will respond within 30 days.

Aruga is intended for users 13 years and older. We do not knowingly collect data from children under 13. If we discover such data, we will delete it promptly. For users between 13 and 17, parental or guardian consent is required.

When you trigger an SOS:

• Current GPS coordinates are captured and stored in the alert record
• Your location is shared with trusted contacts and anyone with the tracking link
• Your location remains visible until you mark yourself “Safe”
• The final location is preserved in alert history for your reference

You can revoke location permissions at any time in your phone's Settings, but doing so will prevent the SOS feature from working.

We send push notifications for:

• SOS alerts from your friends
• Account security events
• Service updates and important announcements

You can disable push notifications in your phone's Settings, but you will miss SOS alerts from your friends if you do.

Our websites use minimal cookies necessary for authentication and session management. We do not use third-party advertising cookies or trackers.

We may update this Privacy Policy from time to time. Material changes will be communicated via in-app notice, email, and notice on aruga.io for at least 14 days before changes take effect.