Privacy Policy

01 Who We Are

RU Unalive? is a safety check-in application developed and operated by The K Hub ("we", "us", "our"). We are the Responsible Party as defined under POPIA, responsible for determining the purpose and means of processing your personal information.

Our Information Officer is registered with the Information Regulator of South Africa as required under POPIA.

02 Scope of This Policy

This policy applies to all personal information collected through:

• The RU Unalive? Android mobile application
• Our Firebase backend services (authentication, database, cloud functions)
• This website hosted at ruunalive.cookedlabs.co.za
• Email notifications sent to your ICE (In Case of Emergency) contacts

This policy does not apply to third-party websites, apps, or services that may be linked to from within our app, including Google Maps links included in alert notifications.

03 Information We Collect

3.1 Account Information

When you register and use the app, we collect:

• Email address — required to create and identify your account
• Display name — optional, used to personalise your experience
• Profile photo URL — optional, if provided via Google Sign-In
• Authentication method — email/password or Google OAuth
• Account creation timestamp
• Firebase Cloud Messaging (FCM) token — used to send you push notifications on your device

3.2 Check-In Data

Each time you perform a check-in, we collect and store:

• Timestamp of the check-in
• GPS latitude and longitude coordinates — captured at the moment you check in
• Reverse-geocoded physical address — the human-readable address derived from your GPS coordinates
• Optional notes you choose to include with a check-in

Location data is only captured at the moment you tap the check-in button. We do not continuously track your location in the background.

3.3 Check-In Configuration

• Your chosen check-in interval (e.g. every 24 or 48 hours)
• Your last check-in time and next deadline
• Your current safety status (active, warning, overdue)

3.4 ICE Contact Information

For each emergency contact you add, we store:

• Contact name
• Contact email address (if email alerts are enabled)
• Contact phone number (if SMS alerts are enabled)
• Relationship to you (optional, e.g. "Parent", "Friend")
• Notification preferences (email and/or SMS)
• Timestamp of when the contact was added

3.5 Alert Logs

When an automated alert is triggered, we log:

• The time the alert was sent
• Which ICE contacts were notified
• The location data shared in the alert

04 Purpose of Collection

We collect and process your personal information only for the following specific purposes:

• Safety check-in service — to provide the core functionality of recording and tracking your daily check-ins
• Emergency alerts — to notify your ICE contacts with your last known location if you fail to check in within your configured window
• Push notifications — to remind you before your check-in deadline expires
• Authentication — to verify your identity and secure your account
• Service improvement — to diagnose technical issues and improve app reliability

We do not use your personal information for advertising, marketing profiling, or sale to third parties.

05 Lawful Basis for Processing

Under POPIA, we process your personal information on the following grounds:

• Consent — You provide explicit consent when you register for the app, enable location permissions, and add ICE contacts. You may withdraw consent at any time by deleting your account.
• Legitimate interest — Processing is necessary to fulfil the core safety purpose of the application, which you have voluntarily chosen to use.
• Contractual necessity — Processing is necessary to perform the service you have requested under our Terms of Service.

Provision of your email address and location data (at the time of check-in) is mandatory for the core service to function. Display name, notes, and ICE contact relationship fields are voluntary.

06 How We Share Your Information

6.1 Your ICE Contacts

When an automated alert is triggered, your ICE contacts will receive:

• Your name and the time elapsed since your last check-in
• Your last known GPS coordinates
• A Google Maps link to your last known location

This is the primary purpose of the app and the sharing you consent to when you use the service.

6.2 Service Providers (Operators)

We use the following third-party service providers who process data on our behalf as Operators under POPIA:

• Google Firebase (Google LLC) — cloud database, authentication, cloud functions, push notifications, and hosting. Data is processed under Google's Privacy Policy and Data Processing Addendum.
• Email delivery provider — used to transmit alert emails to ICE contacts. No personal information beyond what is included in the alert email is retained by this provider.

All our service providers are bound by appropriate data processing agreements and are contractually required to maintain confidentiality and security of your data.

6.3 Legal Requirements

We may disclose personal information if required to do so by law, court order, or other legal process, or where we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

We do not sell, rent, or trade your personal information to any third party for their own use.

07 Cross-Border Transfers

Your personal information is stored and processed using Google Firebase infrastructure, which may be located outside the Republic of South Africa, including in the United States of America and other countries.

These transfers are made in compliance with POPIA Section 72. Google LLC is subject to the EU-US Data Privacy Framework and maintains appropriate safeguards including Standard Contractual Clauses and binding corporate rules. By using the RU Unalive? app, you consent to the transfer of your personal information to these jurisdictions.

Where data is transferred internationally, we take reasonable steps to ensure it receives protection equivalent to that required under POPIA.

08 Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with the service. Specifically:

• Account data — retained for the lifetime of your account and deleted within 30 days of account deletion
• Check-in history — retained for the lifetime of your account; you may manually delete individual records in-app
• ICE contact records — retained until you remove them or delete your account
• Alert logs — retained for 12 months then automatically deleted
• Push notification tokens — refreshed automatically; stale tokens are removed within 60 days

When you delete your account, all personal information stored under your profile is permanently deleted from our systems within 30 days, except where retention is required by law.

09 Security Measures

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, destruction, or disclosure, including:

• Encryption in transit — all data transmitted between the app and our servers uses TLS/HTTPS encryption
• Encryption at rest — data stored in Firebase Firestore is encrypted at rest by Google's infrastructure
• Authentication controls — access to your data requires authenticated credentials; Google Firebase Authentication is used to manage access
• Firestore security rules — database access rules ensure each user can only access their own data
• Principle of least privilege — our Cloud Functions access only the data required to perform their specific task

While we take all reasonable precautions, no method of electronic storage or transmission is 100% secure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the Information Regulator as required under POPIA within the prescribed timeframe.

10 Your Rights Under POPIA

As a data subject under POPIA, you have the following rights:

• Right of access (Section 23) — you may request a copy of the personal information we hold about you
• Right to correction or deletion (Section 24) — you may request that we correct inaccurate information or delete your personal information
• Right to object (Section 11(3)) — you may object to the processing of your personal information on legitimate grounds
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time. This will not affect the lawfulness of processing before withdrawal
• Right to complain — you have the right to lodge a complaint with the Information Regulator of South Africa

How to Exercise Your Rights

To exercise any of these rights, contact our Information Officer at info@thekhub.com. We will respond within 30 days of receiving your request. We may need to verify your identity before processing your request.

Information Regulator Contact

If you are not satisfied with our response, you may lodge a complaint with:

11 Children

The RU Unalive? application is not directed at children under the age of 18. We do not knowingly collect personal information from persons under 18 without the consent of a parent or guardian. If we become aware that we have inadvertently collected personal information from a child under 18 without appropriate consent, we will delete it promptly.

If you believe we have collected information from a minor, please contact us immediately at info@thekhub.com.

12 Cookies & Website Analytics

Our website (ruunalive.cookedlabs.co.za) is a static informational site. We do not currently use cookies, tracking pixels, or third-party analytics tools on this website. No personal information is collected simply by visiting this website.

The mobile application itself does not use cookies. Firebase may use session tokens for authentication purposes — these are functional tokens required for the app to operate and are not used for advertising or tracking.

13 Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last updated" date at the top of this document
• Notify registered users via email or an in-app notification

Your continued use of the app after any changes constitutes your acceptance of the updated policy. We encourage you to review this policy periodically.

14 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal information, please contact our Information Officer:

We take all privacy queries seriously and will respond within 30 days of receiving your written request.