Privacy Policy
Last updated: September 24, 2026 · Applies to Komitu app
Komitu is built on a simple principle: your sensitive data belongs to you, not us. This policy explains exactly what we collect, what we don't, and how we protect your information.
1. Who we are
Komitu is a product of MeltedLab Ltd, a company registered in the United Kingdom. If you have any questions about this policy, contact us at hi@meltedlab.ltd.
2. What we collect
Account information (stored on our servers):
- Email address — for account creation and login
- Name — displayed to your community members
- Profile photo URL — if you choose to add one
Location data (temporary, only during active alerts):
- GPS coordinates — only captured when you press SOS
- Location updates every 5 seconds during an active alert
- Shared only with members of your community
- Deleted from our servers when alert is resolved
Community data:
- Communities you create or join
- Alert history (anonymized after 90 days)
- Device push notification tokens
3. What stays on your device only
The following sensitive information is stored only on your device using encrypted local storage. It never leaves your phone unless you explicitly choose to share it during an alert:
- Blood type
- Medical notes and conditions
- Emergency contact details
- Sharing consent preferences
You control exactly what gets shared and with whom through the consent settings in your Profile tab.
4. How we use your data
- To authenticate your account and keep it secure
- To send emergency alerts to your community members
- To deliver push notifications when someone in your community needs help
- To show alert history within your community
We never sell your data, use it for advertising, or share it with third parties except as described below.
5. Third-party services we use
- Telegram — for alert notifications to community groups (only if you connect a Telegram group)
- Google Maps — for displaying your location on the map (subject to Google's privacy policy)
- OpenStreetMap — for AED defibrillator locations (no personal data shared)
- Expo Push Notifications — for delivering push alerts to your device
- Railway — our cloud hosting provider (servers located in US West)
- Google Fonts — the letters on this website (Google sees your IP address). The website sets no cookies and uses no analytics or advertising: it only remembers your cookie choice in your browser. Change it any time with the Cookies link at the bottom of the page.
6. Data retention
- Active alert location data: deleted when alert is resolved
- Alert history: retained for 90 days, then anonymized
- Account data: retained until you delete your account
- Push notification tokens: deleted when you log out
7. Your rights
Under GDPR and UK data protection law, you have the right to:
- Access all data we hold about you
- Correct inaccurate data
- Request deletion of your account and all associated data
- Export your data in a portable format
- Object to processing of your data
To exercise any of these rights, email us at hi@meltedlab.ltd. We will respond within 30 days.
8. Security
We protect your data using:
- HTTPS encryption for all data in transit
- JWT tokens for secure authentication
- Encrypted local storage (Expo SecureStore) for sensitive on-device data
- No plaintext passwords — all passwords are hashed using bcryptjs
9. Children's privacy
Komitu is not intended for children under 13. We do not knowingly collect data from children under 13. If you believe a child has provided us with personal information, please contact us immediately.
10. Changes to this policy
We may update this policy as Komitu grows. We will notify you of significant changes via the app or email. The "last updated" date at the top of this page always reflects the current version.