Privacy Policy — Msewu

1. Who we are

Msewu is provided by Saifullah Ahad, Dhaka, Bangladesh. Contact www.saifullah.ai@gmail.com or visit saifullah.ai.

2. What Msewu does

Msewu builds maps of informal local transport from journeys riders choose to contribute. It also lets riders publish landmark notes and photographs for inferred stops. Msewu is not a live rider tracker and never shows another rider's location.

3. Information processed on your device

• Location and motion: after you tap I GOT ON, the app uses precise/coarse location plus accelerometer, gyroscope and step evidence to record the route and bridge brief GPS gaps. Motion sensor samples are not uploaded.
• Encrypted journey vault: pending route points are encrypted with Android Keystore AES-GCM. You can review or delete a journey before sending it.
• Downloaded regions and settings: compact route bundles, blocks, theme and app-lock material remain in app-private storage.
• Landmark photos: a photo you choose is re-encoded into a fresh bounded JPEG. This removes source EXIF fields such as GPS, device and capture time before upload.

4. Information sent to the Msewu service

The service also receives data you deliberately submit:

• a landmark note, descriptive text and optional sanitized photograph;
• a content report and its reason;
• a random Msewu installation identifier/token for content ownership, token limits and deletion;
• after you download a region, a Firebase Installation ID and the downloaded region ID, used only to deliver route-revision signals.

When you choose Send feedback by email, Android opens your email app with the public support address and a Msewu subject. Msewu does not collect or transmit the message, email address, app version, Android version or device details.

5. How information is used

• validate and combine independent route evidence;
• infer route geometry, stops, variants, travel ranges, fare ranges and freshness;
• prevent replay, implausible traces and one-contributor map changes;
• publish and moderate landmark clues and respond to reports;
• process account deletion.

6. Public and third-party processing

Published aggregate routes contain evidence counts and geometry, not rider identities. Landmark notes, their descriptive text and whether a photo is attached are public to riders after safety checks. Your random contributor pseudonym may be used only so another rider can block that contributor on their own device.

• Cloudflare Workers, D1 and R2 process the production API, database and landmark media on our behalf.
• Google Firebase Cloud Messaging processes a Firebase Installation ID and delivery metadata to send revision signals for regions stored on your device. The signal contains a region ID and revision, not a journey trace or live location. Google Analytics is not enabled.
• OpenStreetMap/Overpass receives bounded area queries from the server for road map matching; it does not receive an installation account or raw device request.

Email feedback is handled outside Msewu by your chosen email provider. We do not include advertising, analytics, data-broker or behavioural tracking SDKs, and we do not sell personal data.

7. Retention

• Raw accepted or excluded traces expire from D1 after 30 days.
• Spent-token hashes may remain for up to 90 days to prevent replay and cannot identify the issuing installation.
• Aggregate route geometry/evidence remains while it is useful and visibly decays when not recently observed.
• Landmark posts and media remain until you delete the installation account or moderation removes them.
• The Firebase Installation ID/region subscription remains while the installation account is active. Account deletion unregisters messaging and removes the server subscription; invalid uninstalled-app targets are removed when delivery reports them.
• Local data remains until you delete it, clear app storage or uninstall Msewu.
• If you choose to send feedback from your email app, it remains in the developer's support inbox as needed to answer and maintain Msewu.

8. Your controls

• Do not start capture, or deny/revoke location and activity-recognition permissions.
• Review and delete unsent journeys in the Vault.
• Report every public landmark post and block its contributor locally.
• Deny or revoke notification permission to suppress visible region-update notices.
• Use More → Settings and account → Delete account and local data to remove posts, reports, media, account material and local vault data.

Accepted traces cannot appear in account export or be selected by account deletion because the blind-token design intentionally prevents the service from linking them back to an installation. They expire under the 30-day raw-trace rule.

9. Security

Network traffic uses HTTPS. Local pending traces are encrypted. The service rejects identity-bearing trace fields, spends each blind token once, rate-limits issuance, quarantines reported posts and restricts production administration with vault-held secrets. No system is risk-free; report suspected misuse to the contact above.

10. Children and user-generated content

Msewu is intended for ages 13 and over and is not directed to children under 13. Child sexual abuse and exploitation, grooming, solicitation, sextortion and CSAM are prohibited. Every landmark post is reportable. See the separate Msewu Child Safety Standards.

11. International processing and legal requests

Cloud services may process data outside your country. We may preserve or disclose information when legally required, including reports to appropriate child-safety or law-enforcement authorities.

12. Changes and contact

We may update this policy when the app or law changes. The current version remains at privacy.saifullah.ai/msewu.html with a revised effective date.

Privacy or deletion questions: www.saifullah.ai@gmail.com.