Privacy Policy
This policy explains how the Acil SOS mobile app (App Store / Google Play) and the web services at acilsos.nwtsoft.com and acilsos-api.nwtsoft.com process your personal data. Acil SOS lets you send a call for help and your location to people you know in an emergency; it does not guarantee a rescue and does not replace emergency services.
1. Data controller and contact
Data controller: Abdullah Aktaş (NWTsoft)
Contact: [email protected]
This is our only contact address for all questions and requests about your personal data.
2. What data do we process?
| Group | Data |
|---|---|
| Account | First name, last name, e-mail address and a hash of your password (the password itself is not stored). If you sign in with Google or Apple, your account ID and e-mail address at that provider; for Sign in with Apple, an encrypted key issued by Apple so that we can revoke the Apple connection when you delete your account. |
| Profile and medical card (optional, entered by you) | Phone number, Turkish ID number, blood type, height, weight, date of birth, profile photo; on the medical card, allergies, medications you take, chronic illnesses and an emergency note. |
| Location | Your location when you send an SOS (latitude/longitude, accuracy, floor if available). Location updates sent while the app is open, at the interval you choose in Settings (5–60 minutes, 10 minutes by default). Your last known location (a single record). The country code derived from your location. |
| Device | Device ID, push notification token, platform (iOS/Android), app language and your settings, battery level, network connection status. |
| Circle and contacts | Your contact list (role, nickname, location-sharing preference) and invite codes. You share invite codes yourself via WhatsApp or your phone's address book; your address book stays on your device and is not sent to us. |
| SOS records | SOS time, location, accuracy, floor, battery level, whether it was triggered by an earthquake, whether it was a test, cancellation time and reason, and which of your contacts the alert reached. |
| Safety and alive signals | Signals sent when you open the app, when you report "I'm OK" and periodically: time, battery level, network status. |
| Preparedness information (optional) | Meeting points, building information, emergency kit checklist. |
| Consents | The explicit consents you give or withdraw: type, version, time, IP address. |
| Technical records | Audit records (action taken, time, IP address, device/browser information; the e-mail address in sign-in and e-mail change records) and app error reports. |
Data we do not process: message or conversation content, your phone's address book, microphone recordings, payment information, advertising identifiers. The app has no advertising and no user tracking.
3. Purposes and legal grounds
| Purpose | Data | Legal ground (KVKK) |
|---|---|---|
| Creating your account, signing you in and running the app (SOS, circle, notifications, settings, preparedness) | Account, profile, device, circle, location, SOS records, signals, preparedness information | Art. 5/2-c — establishing and performing a contract |
| Passing your location and SOS information to your contacts to protect your life in an emergency, at a moment when we cannot obtain your consent | Location, SOS records | Art. 5/2-b — protecting the life of a person unable to give consent |
| Meeting legal obligations and answering requests from authorities and from you | Account, consents, audit records | Art. 5/2-ç — legal obligation |
| Security, preventing misuse, fixing errors and aggregate statistics | Technical records, device, country code | Art. 5/2-f — legitimate interest |
| Showing your location on the public disaster map | Rounded location, SOS time | Art. 5/1 — explicit consent (optional, can be withdrawn at any time) |
| Storing your medical card and health information and showing it to your contacts during an SOS | Health data | Art. 6 — explicit consent (showing it is enabled by the "Medical Data (special category)" consent in the app) |
4. Who can see your data?
- Contacts in your circle: when you send an SOS, they see your location, battery level and SOS status. On the circle screen they see your battery level and alive-signal status, and your location according to the preference you choose for each contact (Off / Only during SOS / Always). They can see your medical card only while your SOS is active (last 24 hours) and only if you gave the "Medical Data (special category)" consent.
- The public disaster map (acilsos.nwtsoft.com/map): only if you gave the "Public Location During Disaster" consent and an earthquake of magnitude 6.0 or more happened within 200 km of you in the last 72 hours, your SOS appears on the map as a marker. The location is rounded to about 1 km and the time to 10 minutes; your name, contact details, battery level and medical information are not shown. The marker is removed 24 hours after your last SOS, or earlier if you cancel the SOS or withdraw your consent.
- Administrators: see aggregate statistics in the admin panel (e.g. user counts, country and platform breakdown; groups smaller than 5 are hidden). To answer support and KVKK requests, an authorised administrator can see whether a single account exists and its status; this access is logged. Your location, medical information, circle and SOS contents are not shown in the admin panel.
- Service providers (section 6): process only the data needed to provide their service.
- Authorities: if there is a court order or a request from an authorised body, only to the extent requested.
5. Notifications we send
- SOS and SOS-cancelled alerts from your contacts (a real SOS is sent with high priority and can break through Do Not Disturb),
- Test SOS alerts (marked "[TEST]", normal priority),
- Earthquakes near you: magnitude 4.0 or more within 200 km of your location,
- Major earthquakes: magnitude 6.5 or more anywhere in the world,
- E-mails: e-mail verification, password reset, e-mail change and data export.
Earthquake alerts are based on public earthquake data, are sent after an earthquake has happened and are not an early warning.
6. Service providers and third parties
| Service | Purpose | Data |
|---|---|---|
| Hetzner Online (Helsinki, Finland) | Server and database hosting | All account and app data |
| Cloudflare | Network protection and content delivery (website and app traffic passes through this service) | IP address and the traffic passed through |
| Cloudflare R2 | Storing profile photos | Profile photo |
| Firebase Cloud Messaging (Google) | Android notifications | Push token, notification content |
| Apple Push Notification service | iOS notifications | Push token, notification content |
| Sign in with Google, Sign in with Apple | Signing in | Provider account ID, e-mail address |
| Resend | Sending e-mails | E-mail address and e-mail content (including the data export file) |
| Sentry | Error tracking | Error reports (configured not to send personal data) |
| OpenFreeMap (app); OpenStreetMap, CARTO, unpkg and flagcdn (web map) | Map images, map library, flag images | IP address in requests |
| AFAD, USGS and similar public earthquake data sources | Earthquake information | No personal data is sent to these sources |
When you tap a WhatsApp or Google Maps link in the app, those services work under their own privacy policies.
7. Transfers abroad (KVKK Art. 9)
Your data is processed outside Türkiye: our servers are in Finland (Hetzner). Cloudflare, Google, Apple, Resend and Sentry may process data in other countries, including the United States. Section 6 shows which data goes to which provider. These transfers rely on the safeguards provided for in KVKK Art. 9 (standard contracts) and, where these are not available, on your explicit consent.
8. Retention periods
| Data | Period |
|---|---|
| Account, profile, medical card, settings, circle, preparedness information | Until you delete your account |
| Location records | 30 days |
| Last known location | A single record, updated with each new location; deleted when the account is deleted |
| SOS records | 1 year |
| Safety and alive signals | 30 days |
| Notification records | 30 days |
| Session records | Deleted 7 days after they expire, 60 days after they are revoked |
| Audit records | 1 year, then 10 years in the archive |
| Consent records | Kept as proof even after the account is deleted |
| Error reports (Sentry) | For the period set in the Sentry account settings |
9. Your rights (KVKK Art. 11)
- To learn whether your personal data is processed,
- If it is, to ask for information about it,
- To learn the purpose of the processing and whether the data is used for that purpose,
- To know the third parties in Türkiye or abroad to whom it is transferred,
- To ask for it to be corrected if it is incomplete or wrong,
- To ask for it to be deleted or destroyed,
- To ask for corrections and deletions to be notified to the third parties it was transferred to,
- To object to a result against you that comes solely from analysis by automated systems,
- To claim compensation if you suffer damage from unlawful processing.
How to use them: in the app, under Settings → Privacy (KVKK), use Download My Data (all your data as a JSON file, downloaded or sent to your e-mail address depending on the app version; once every 24 hours) and Delete my account, and withdraw your explicit consents under Consent Management. Or write to [email protected] from your account's e-mail address. Requests are answered within 30 days at most. Your right to complain to the Turkish Personal Data Protection Board (KVKK Kurulu) is reserved.
10. Account deletion
In the app: Settings → Privacy (KVKK) → Delete my account, then Confirm. Deletion is immediate and cannot be undone.
- Deleted: profile and emergency card, medical card, location records and last known location, device and notification records, settings, alive signals, circle connections (both ways), invite codes, preparedness information, sessions, Google/Apple connections (the Apple connection is also revoked at Apple) and profile photos.
- Anonymised: the SOS records you sent are kept with the link to you removed, the location rounded to about 1 km and the details (accuracy, floor, battery, building, cancellation reason, recipients) deleted; they are deleted completely after 1 year.
- Kept as legal records: consent records and audit records (for the periods in section 8). They contain no location data.
If you cannot access the app, you can send a deletion request on the web; it is answered within 30 days at most.
11. Security
- Passwords are stored as Argon2id hashes.
- The Turkish ID number and the medical card are encrypted with AES-256-GCM; an HMAC-SHA256 hash is used to look up Turkish ID numbers.
- All traffic between the app and website and our servers is encrypted with TLS (HTTPS).
- Access to data is limited by authorisation; sensitive actions and administrator access are written to the audit log.
12. Children
Acil SOS is designed for users aged 18 and over. Young people aged 13–18 should use it only with parental consent and with a parent added as a contact; the app is not suitable for children under 13. The app does not verify age. If you find that we are processing data of a child under 13, write to us and we will delete the account.
13. Changes
When we update this policy, we publish the new text on this page and update the date below.
Last updated: 15 October 2026