SafeCity Privacy Notice

A production deployment must publish the legal name, registered address, privacy contact, Grievance Officer, grievance email, and applicable postal address of the person or organisation that determines why and how SafeCity personal data is processed.

SafeCity must not be publicly distributed until these details are complete and operational.

This notice applies to the SafeCity mobile app and personal data processed for monitoring, SOS, evidence, support, privacy-rights, and security functions. It does not govern a mobile operating system, telecom carrier, SMS app, mapping provider, or emergency service acting for its own purposes; those parties provide their own notices.

SafeCity does not collect a contact list, advertising identifier, account password, payment data, or continuous video. The repository contains no advertising SDK, data sale, or targeted-advertising flow.

The intended production basis for monitoring audio, motion, location, optional behavior baselining, incident evidence, and associated identifiers is free, specific, informed, unconditional, and unambiguous consent through clear affirmative action. Operating-system permissions are separate controls.

The current prototype does not yet fully meet that intended design: onboarding requires all listed permissions and combines several purposes. Production must split optional processing, default optional features off, and correct map disclosures before relying on this consent model.

Emergency-contact details are voluntarily provided to prepare an SOS message. You should inform the contact. SafeCity does not silently send the message; the system composer requires you to press Send.

Personal data may be handled by the following parties:

1. Mobile operating-system provider: permissions, protected keys, notifications, camera, microphone, motion, and location.
2. SMS and telecom providers and chosen recipients: message content and included location after you press Send.
3. External mapping applications: coordinates when you deliberately open or share a map link.
4. OpenStreetMap Overpass endpoints: exact current coordinates when Safety Navigator requests nearby places and lighting.
5. OpenStreetMap routing: exact origin and destination when you request a walking route.
6. CARTO: viewed map-tile area and ordinary network metadata.
7. SafeCity anonymous-risk aggregation: only after separate opt-in, an approximate 500 m cell, hourly bucket, trigger category, and rotating deduplication token.
8. Authorities: only where disclosure is legally required and documented by the production operator.

No SafeCity-hosted evidence upload, cloud monitoring inference, advertising SDK, or analytics SDK exists in this repository.

Supported inference stays inside the phone. Operating-system, SMS, telecom, and mapping providers may process data outside India under their own arrangements. Before production, the operator must inventory each transfer, comply with applicable restrictions or localisation rules, and publish countries and safeguards. Raw monitoring audio must not be moved to an unreviewed remote service without a new data-flow, security, notice, processor, and consent review.

• Ordinary monitoring windows and inference results remain in volatile memory and are discarded.
• The rolling 15-second tail is discarded when monitoring stops unless a confirmed SOS encrypts it as evidence.
• Optional behavior profiles are bounded encrypted aggregates and are deleted when the feature is disabled or cleared.
• Incidents and evidence follow the 1–90 day period selected in Settings, with earlier deletion available.
• Contacts and consent records remain until removed, consent is withdrawn, or app data is erased.
• Queued anonymous-risk reports and accepted aggregate input are retained no more than 30 days.
• Longer retention is permitted only where law requires it and the operator documents and segregates the record.

The current architecture includes:

• SQLCipher encryption for durable mobile metadata;
• random 256-bit database and evidence keys in platform-protected storage;
• AES-GCM encryption for incident evidence;
• app-private files and deletion of temporary plaintext capture files;
• in-memory monitoring audio with no inference network request or audio cache;
• an app-bundled model and local fusion rules;
• bounded local retention and individual/bulk erasure;
• coarse-cell conversion, rotating tokens, and minimum crowd thresholds for optional risk zones.

Production still requires secure signing, dependency and model provenance review, key lifecycle controls, vulnerability management, incident response, and periodic mobile security testing.

The production Data Fiduciary must maintain an incident-response process that can notify affected people without delay, explain likely impact and protective steps, notify the Data Protection Board of India as applicable, provide required details within the prescribed period, and investigate and prevent recurrence. A named 24×7 operational owner must be published before release.

Subject to applicable law, you may:

• request a summary of personal data and processing activity;
• request applicable identities of other fiduciaries and processors;
• correct, complete, or update personal data;
• erase data no longer required by purpose or law;
• withdraw consent as easily as it was given;
• raise a grievance; and
• nominate another person to exercise rights after death or incapacity.

Local access, correction, and erasure controls are described on the Data Rights page. The operator must publish and staff a verified request and grievance process before public distribution. Do not send unencrypted incident evidence through ordinary email.

Use Settings → Legal and your data → Withdraw consent and erase data. SafeCity stops monitoring and deletes this installation's contacts, sessions, incidents, locations, queued anonymous reports, anonymous secret, consent records, optional learned profiles, and encrypted evidence, then returns to onboarding. Withdrawal does not affect lawful earlier processing or retention required by law.

This build is restricted to people aged 18 or older and does not implement verifiable parental consent. It must not be offered to a child until qualified counsel reviews the use case and the operator implements the required parental-consent, due-diligence, child-wellbeing, tracking, and behavioral-monitoring safeguards.

Production consent and notices must be clear, accessible, and available in the language choices required by applicable law. The app includes English, Hindi, and Bengali interface strings, but professionally translated legal notices and accessibility testing remain release work.

The version and effective date appear above. If a change materially alters personal-data categories, purposes, recipients, or choice, SafeCity must present the updated notice and obtain fresh consent before the new processing begins. Product and legal teams must keep the app, website, store disclosures, and actual deployment aligned.

This deployment template was prepared for readiness under India's Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025. It is not legal advice or a compliance conclusion.

• Digital Personal Data Protection Act, 2023 — MeitY
• Digital Personal Data Protection Rules, 2025 — MeitY
• Commencement notification G.S.R. 843(E) — MeitY