Privacy Policy

When you raise an SOS

Anyone can raise an SOS with BRASS. You do not need a Sevak account, and you can raise an SOS without signing in. When you do, we process:

• Your location at the moment you raise the SOS, to street-level precision, so nearby Sevaks can be dispatched to you and see where you are on a live map. This is a single position taken when you raise the SOS — you are not continuously tracked.
• An optional note you add for responders (for example, a landmark or your condition). Anything you type here is shown to the Sevaks who respond, so please share only what helps them reach and assist you.
• An optional SOS type — “medical” or “danger” — if you choose to tag one. Tagging an SOS “medical” indicates health information about you; see Health information below.
• Your phone number, if you are signed in. Your verified phone number is shared with a Sevak once they accept your SOS, so they can call you. If you are not signed in, we do not receive your phone number or identity — only your location and any note you provide.

While your SOS is active, you can see the first name and live location of the Sevaks responding, so you know help is on the way. They can see your location and note, and (if you are signed in) your phone number once they respond. When the SOS ends, responders stop receiving this information.

Health information

If you tag an SOS as “medical”, or describe a medical condition in your note, that is health data — a special category of personal data under data-protection law. We process it only to route appropriate help to you, because it is necessary to protect your (or another person’s) vital interests and because you chose to provide it by raising the SOS. It is shared only with the Sevaks responding to your SOS and is subject to the retention limits below.

If you are a Sevak

• Phone number. Your phone number is your BRASS account identity, verified by a one-time SMS code (via Firebase Authentication). It also lets the BRASS team verify you as a Sevak.
• Identity. You can optionally link Google or Apple sign-in to your account; we then receive your name and email address from that provider.
• Sevak verification details. If you apply to become a Sevak, we collect — with your consent — your name, the type of photo ID you present (e.g. Aadhaar, Voter ID), and a trusted contact. We record only the ID type — never its number or an image of the document; the BRASS team checks the original in person to verify you before you can go on duty. We do not collect your home address.
• Background-check consent. When you apply, you may consent to a background verification. We record that you gave consent and the date; any verification result is stored as a simple status (e.g. cleared).
• Location. While you are On duty, the app shares your device location — including in the background, when the app is closed — so you can be matched to and routed toward nearby SOS requests. Location is not collected when you are Off duty.
• Notification token. A Firebase Cloud Messaging device token, so we can send you SOS alerts.

How we use it

• To verify and approve Sevaks.
• To find available Sevaks near an SOS and alert them, and to route them to the person who needs help.
• To show the live “help arriving” view to the person who raised the SOS and the responding Sevaks, and to let a responder reach the requester.
• To keep the service safe and reliable (for example, detecting implausible location jumps and preventing abuse).

We do not sell your data, use it for advertising, or share it with third parties except the service providers below that operate the service, and the other participants in an SOS as described above.

Background location (Sevaks)

The app uses background location only while you are On duty, shown by an ongoing “BRASS — on duty” notification on Android and the system location indicator on iOS. You control this with the On duty toggle and can stop sharing at any time by going Off duty. If your location stops updating for several minutes, the system automatically marks you unavailable.

Legal bases (EEA/UK users)

• Responding to an SOS (your SOS location, note and type; alerting and routing Sevaks): protecting the vital interests of you or another person, and processing you initiate by raising the SOS.
• Sevak account and verification: your consent (which you can withdraw) and our legitimate interest in running a trusted responder network.
• Service safety and security: our legitimate interest in keeping the service reliable and preventing misuse.

Service providers

• Google Firebase — sign-in (authentication) and push notifications (Cloud Messaging). SOS alerts we send to Sevaks contain the alert text and an incident reference, not the requester’s identity.
• Cloudflare — hosting of the BRASS backend.
• Neon — the database storing accounts, SOS requests, and the most recent location of on-duty Sevaks.

Retention

• Sevak account and verification details are kept for as long as you are a Sevak, and removed when you delete your account.
• Sevak location is stored only as your most recent position and is overwritten as you move; it is not kept as a location history.
• SOS requests. The details of an SOS (its location, any note, and type) are kept while it is active and for a limited period afterward for safety and operational review. Within 30 days of an SOS being resolved or closed, we remove any free-text note and coarsen the recorded location to an approximate area (about 100 metres), keeping only de-identified summary information. If you delete your account, SOS requests you raised are unlinked from your profile and de-identified in the same way.

When you delete your account, your profile, verification details and Sevak status are removed, and your sign-in identity is deleted from our authentication provider.

Your rights

You can access, correct or delete your personal data, and withdraw a consent (such as the background-check consent) at any time. Depending on where you live, you may also have the right to object to or restrict certain processing, to data portability, and to lodge a complaint with your data-protection authority. To exercise these rights, contact us using the details below.

Because an SOS can be raised without signing in, an anonymous SOS is not linked to an identity and we may be unable to trace it back to you individually; anonymous SOS requests are de-identified automatically within the retention period above.

Your choices

• Go Off duty to stop sharing location.
• Revoke location or notification permissions in device settings.
• Sign out, or request deletion of your account and data.

Contact

For privacy questions or to request deletion of your data, contact the BRASS team at privacy@brass.help.