Privacy Policy
1. Overview
Privacy is a core promise of NearNeighbours. We store as little as possible, run no tracking, show no ads, use no analytics and never sell data. All content data of the app is processed in the EU region europe-west1 (Google Cloud).
2. Controller
Bauer & Keller Ltd
Georgiou Karaiskaki, 11-13, CARISA SALONICA, Flat/Office 102
Pervolia, 7560, Larnaca, Cyprus
Email: support@bk-technologies.com
3. Data collected when visiting this website
This website is served via Firebase Hosting by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). When you access it, the hosting service technically records server log data:
- IP address of the requesting device
- date and time of access
- requested URL and HTTP status code
- browser type, version and operating system (user agent)
- amount of data transferred
This data is processed solely to ensure technical operation and to defend against attacks. Legal basis: Art. 6(1)(f) GDPR (legitimate interest). It is not combined with other data sources. Google acts as a processor; more information: firebase.google.com/support/privacy.
4. Cookies and tracking
This website uses no cookies, no JavaScript, no local browser storage, no Google Analytics, no social media pixels and no other tracking technologies whatsoever. No usage profiles are created. The same applies to the app: it contains neither an advertising nor an analytics SDK.
5. Contact by email
When you contact us by email (support@bk-technologies.com), we process your email address and the content of your message solely to handle your request. Legal basis: Art. 6(1)(b) GDPR (pre-contractual or contractual measures) or Art. 6(1)(f) GDPR (legitimate interest). The data is not shared with third parties and is deleted once no longer needed, at the latest after 3 years.
6. Data processing in the NearNeighbours app
The app uses the Google Firebase platform (Google Ireland Limited) as a processor. All services below are, where regionally configurable, pinned to the EU region europe-west1.
6.1 User account & sign-in (Firebase Authentication)
- Data processed: email address, unique user ID (UID), authentication tokens, time of last sign-in, IP address at sign-in. When signing in with Google or Apple, we receive the basic data you share there (email address, name if provided).
- Sign-in methods: email link (“magic link”), Google Sign-In, Sign in with Apple. We do not store a password for these methods.
- Purpose: secure login and session management.
- Legal basis: Art. 6(1)(b) GDPR (performance of contract).
6.2 Profile & neighbourhood groups (Cloud Firestore)
- Data processed: display name, group memberships, group name, group address with coordinates (the neighbourhood address entered when creating a group), invite codes.
- Purpose: presentation within the group, assignment of alarms, pinning the neighbourhood on the map.
- Visibility: this data is only visible to members of your group; access is restricted to verified group members via Firestore security rules.
- Legal basis: Art. 6(1)(b) GDPR.
6.3 Alarms & location
- Data processed: alarm type, optional short description, timestamp, status (active/resolved/false alarm), confirmations by other members – and optionally your location (latitude/longitude).
- Location only at the moment of the alarm: your location is captured exclusively at the moment you raise an alarm, only if you have granted the system location permission, and serves solely to pin the alarm on the neighbourhood map. There is no permanent location log and no background location tracking.
- Legal basis: for location, Art. 6(1)(a) GDPR (consent via the system permission, revocable at any time in system settings); otherwise Art. 6(1)(b) GDPR.
6.4 Incident chat & photos (Cloud Firestore, Cloud Storage)
- Data processed: chat messages and quick replies in the incident chat, optionally taken or selected photos.
- Automatic deletion: chat messages are deleted automatically 30 days after being sent (Cloud Function
deleteOldMessages). - Legal basis: Art. 6(1)(b) GDPR; for photos Art. 6(1)(a) GDPR (consent via the camera/photo permission).
6.5 Push notifications (Firebase Cloud Messaging)
- Data processed: device token (FCM token), your setting for which alarm types may reach you urgently.
- Purpose: delivery of emergency push notifications and all-clears – the core purpose of the app.
- Legal basis: Art. 6(1)(b) GDPR.
6.6 Address search (Nominatim / OpenStreetMap Foundation)
- When you type an address into the search field while creating a group, or pick a point on the map, the input or coordinate is transmitted to the Nominatim geocoding service of the OpenStreetMap Foundation (St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom) to obtain address suggestions or the address for a coordinate.
- The transfer is user-initiated; we only store the address you select. Privacy information: osmfoundation.org/wiki/Privacy_Policy.
- Legal basis: Art. 6(1)(b) GDPR.
6.7 Map display (Esri, CARTO)
- For the neighbourhood map, the app loads map tiles from third parties: satellite imagery from Esri (“World Imagery”, Esri Inc., 380 New York Street, Redlands, CA 92373, USA) and street maps from CARTO (CARTO DB Inc., based on OpenStreetMap).
- When the map is loaded, your IP address is technically transmitted to the respective tile server. Content belonging to your group (alarms, positions) is not transferred to the map providers – only the visible map area is requested.
- Legal basis: Art. 6(1)(b) GDPR (map display as a core feature).
6.8 App integrity (Firebase App Check)
To protect against abusive access, Firebase App Check verifies the integrity of the app instance (iOS: App Attest/DeviceCheck by Apple; Android: Play Integrity by Google). No usage profiles are created. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in securing the service).
7. Recipients and processing on our behalf
The recipient of the data is Google (Firebase: Authentication, Firestore, Cloud Functions, Cloud Messaging, Storage, App Check, Hosting) as a processor under the Google Cloud/Firebase data processing terms. In addition, the services named in 6.6 and 6.7 (OpenStreetMap Foundation, Esri, CARTO) receive the technical data described there. No data is shared for advertising or analytics purposes; we do not sell data.
8. Transfers to third countries
Content data is stored in the EU (europe-west1). Individual services may transfer data to third countries: Google and Apple are certified under the EU-U.S. Data Privacy Framework and additionally use Standard Contractual Clauses (Art. 46 GDPR). When Esri map tiles are loaded, your IP address may be transmitted to servers in the USA. For the United Kingdom (OpenStreetMap Foundation), an EU adequacy decision is in place.
9. Retention periods
- Incident chat messages: deleted automatically 30 days after being sent.
- Profile, group and alarm data: until you delete your account or leave a group.
- Alarms you raised remain visible in the history of your former groups after account deletion (with time, alarm type and the display name you used back then), so the remaining members can review past incidents – details on the account deletion page.
- Server log data is kept only as long as required for operation and security.
10. Your rights (Art. 15–21 GDPR)
- Access (Art. 15): what data we hold about you
- Rectification (Art. 16): correction of inaccurate data
- Erasure (Art. 17): deletion of your data, unless retention is required
- Restriction of processing (Art. 18)
- Data portability (Art. 20): data in a machine-readable format
- Objection (Art. 21): against processing based on legitimate interest
- Withdrawal of consent (Art. 7(3)): at any time with effect for the future, e.g. by revoking the location permission in system settings
Please send requests to: support@bk-technologies.com
You also have the right to lodge a complaint with a data protection supervisory authority. Responsible for Bauer & Keller Ltd:
Office of the Commissioner for Personal Data Protection, Nicosia, Cyprus, dataprotection.gov.cy
11. Deleting your account and data
You can delete your account and all associated data completely at any time – directly in the app under Settings → Privacy → Delete account & all data (Cloud Function deleteAccount), or by email, even after you have uninstalled the app. All options and what exactly gets deleted are described on the account deletion page.
12. Data security
Access to group, alarm and chat data is restricted to verified group members via Firestore security rules and additionally protected against unauthorised clients by Firebase App Check. All transfers are TLS-encrypted; this website is served exclusively over HTTPS.
13. Updates to this policy
We update this privacy policy when the app or legal requirements change. The current version is always available on this page.