Privacy Policy

1. What we collect

If you create an account

• Email address, used for authentication only
• Display name, optional, shown on your profile
• Incidents you submit, including location coordinates, category, description, and timestamp
• Incidents you confirm, tracked to prevent duplicate confirmations

If you use the map without an account

• No personal data is collected or stored
• Incident confirmations without an account are tracked on your device only via browser storage, never sent to our servers

Location data

• When you use "My location", your GPS coordinates are used only within your browser to centre the map and check for nearby incidents
• Your live location is never sent to our servers or stored
• When you submit an incident, you choose the location by dropping a pin. This coordinate is stored as part of the incident record

2. How we use your data

• To authenticate your account and protect it from unauthorised access
• To display incidents you have submitted on the community map
• To show your activity on your account page
• We do not sell, rent, or share your data with third parties
• We do not use your data for advertising

3. Data storage and security

• All data is stored on Supabase (PostgreSQL), hosted in the EU region
• All connections are encrypted in transit using HTTPS (TLS)
• Authentication is handled by Supabase Auth with bcrypt password hashing
• Row-level security policies restrict data access at the database level
• We do not store payment information. Heads Up is free

4. Incident content

• Incidents are community-reported and publicly visible on the map
• Do not include personally identifying information in incident descriptions
• Incidents are incident-based, not accusation-based. Do not name individuals
• Incidents older than 180 days are automatically removed from the public map
• Incidents flagged by enough community members are reviewed and may be hidden

5. Your rights

• You can delete your account and all associated data at any time from your account page
• You can request a copy of your data by contacting us
• Incidents you submitted will be anonymised, not deleted, if you delete your account, to preserve community safety information

6. Children

Heads Up is not directed at children under 13. We do not knowingly collect data from anyone under 13. If you believe a child has provided us with personal data, contact us immediately.

7. Changes to this policy

We may update this policy as the platform grows. We will notify registered users of material changes via email. Continued use of Heads Up after changes constitutes acceptance of the updated policy.

8. Contact

For privacy questions or data requests, contact us through the Heads Up platform. We aim to respond within 7 business days.