Privacy policy

1. Who is the data controller?

[Company name AS] (organisation number [000 000 000]), [address], is the data controller for the personal data processed in Checka. Questions about privacy can be sent to personvern@checka.no.

2. What data we process

About you as a user

• Account: sign-in with Apple (iPhone) or Google (Android) – we receive a user ID and an email address from Apple or Google (Apple may give us an anonymous forwarding address) – as well as your first name and phone number.
• Trusted contacts you add: name and phone number.
• Sessions: type of situation, start time, confirmations and events, the interval between confirmations, and – if you fill them in – the place and who you are meeting.
• The outcome of the Safe PIN: whether you confirmed that all is well, or whether a silent alert was triggered. Never the code itself.
• Location (GPS) during active sessions, with accuracy and time, and the phone’s battery level.
• Device: an installation ID, platform, app version and push token for notifications.
• Subscription: status and expiry date from the App Store or Google Play. We never see your card details.

About trusted contacts

• Name and phone number entered by the user.
• Whether the contact has accepted or declined, and whether the contact has pressed “I’ve seen the alert”.
• When the contact’s link was last used.

3. Location – when and why

Checka only collects your location while you have an active session. When you end the session, collection stops. Outside sessions, we never collect your location.

One exception: If a silent alert has been triggered and the session appears to have ended on the phone – so that everything looks normal to others – your location may still be sent for up to 3 hours, so that your trusted contacts can help you. You are told about this before you start using Checka.

Your trusted contacts only see your location if you have chosen to share it during normal sessions, or if you don’t confirm that all is well or you trigger a silent alert. Your location is never used for advertising, profiling or marketing, and it is never sold.

4. Safe PIN

Your Safe PIN is stored only on your phone, in the phone’s secure storage, and is never sent to us. The app checks the code on the phone and sends only the outcome – “confirmed” or “silent alert” – to the server.

5. Purposes and legal basis

• Providing Checka to you – sessions, confirmations and alerts to your contacts: contract (GDPR Article 6(1)(b)).
• Location and sharing with trusted contacts: consent (Article 6(1)(a)), which you give in the app and can withdraw. In the event of an alert, the processing may also be necessary to protect your vital interests (Article 6(1)(d)).
• Safety messages to trusted contacts: legitimate interest (Article 6(1)(f)) in being able to alert the people you have chosen. The contact can decline at any time.
• Security, prevention of misuse and troubleshooting: legitimate interest (Article 6(1)(f)).

6. How long we keep your data

• Precise location from normal sessions is deleted 7 days after the session has ended. You can choose between 1 and 30 days yourself in the app.
• Incidents – a missed confirmation or a silent alert: the location and the event log are kept for 30 days after the session has ended, so that you and your contacts can see what happened.
• Sessions you delete from your history are removed once they are no longer needed for safety reasons (incidents after 30 days).
• The log of notifications sent (time, channel and status) is deleted after 90 days.
• Links for trusted contacts expire: invitation links after 180 days, alert links after 7 days.
• If you delete your account, everything is deleted immediately. If an incident is still open, it is kept for up to 72 hours for the safety of your trusted contacts – after that, everything is deleted.

7. Who we share data with

We only share data with the trusted contacts you have chosen yourself, and with suppliers (data processors) that operate the service for us under a data processing agreement:

• Supabase – database and sign-in. The data is stored in the EU (Stockholm, Sweden).
• Vercel – hosting of the website for trusted contacts.
• Twilio – sending SMS messages and voice calls.
• RevenueCat, Apple and Google – subscriptions and payment.
• Expo – push notifications to the app.

The map on the page for trusted contacts is loaded from OpenStreetMap. When the map is shown, OpenStreetMap sees the contact’s IP address and the map area shown. Links to Apple Maps and Google Maps only open if the contact taps or clicks them.

Some suppliers may process data outside the EEA, for example in the US. Such transfers are then safeguarded by the EU’s standard contractual clauses (SCCs) or the EU–US Data Privacy Framework. We never sell personal data, and the website has no analytics or tracking tools.

8. If you are a trusted contact

You don’t need the app or an account. Your number is only used for safety messages from Checka about the person who added you – never for marketing. You can decline, or stop being a trusted contact, via the link in the SMS. You will then receive no further alerts.

The link contains a long, random code after the “#” character. That part of the address is not sent to our servers as part of the address, and we only store a cryptographic checksum (hash) of the code.

9. Your rights

• Access and data portability: You can export all your data from the app.
• Rectification: You can change your name, phone number and contacts in the app.
• Erasure: You can delete individual sessions and your entire account in the app. Account deletion is immediate – except for an open incident, which may be kept for up to 72 hours for the safety of your trusted contacts.
• Withdrawing consent: You can turn off location sharing, end sessions and remove trusted contacts at any time. This does not affect processing that took place before you withdrew your consent.
• Removing contacts: When you remove a trusted contact, the contact’s links stop working.
• Objection and restriction: You can object to processing based on legitimate interest.
• Complaints: You can complain to the Norwegian Data Protection Authority, Datatilsynet (datatilsynet.no). Feel free to contact us first.

Trusted contacts can request access or erasure by contacting us.

10. Security

• All traffic is encrypted (HTTPS).
• Each user only has access to their own data, protected by access control in the database.
• Link codes are only stored as hashes, expire and can be revoked.
• We never log link codes or the content of the status page.

11. Changes

If we make significant changes to this policy, we will let you know in the app before the changes take effect.

12. Contact

personvern@checka.no. See also the terms of use.