Privacy Policy

Effective date: 2026-09-12

Ejulu! respects your privacy. Ejulu! is a private location-sharing app designed for trusted circles (families, travel groups, and close friends), built so that your location is end-to-end encrypted and can never be read by us or by our infrastructure providers: our servers only ever see encrypted data. This Privacy Policy explains what information is processed when you use the Ejulu! application and how it is handled.

1. Information We Collect

You must sign in with your Google account, or with your Apple ID on iOS (Sign in with Apple), to use Ejulu!. There is no anonymous mode.

• Account information: When you sign in with Google, Google provides your email address, display name, and profile photo as part of the authentication process, managed by Firebase Authentication.
• Sign in with Apple (iOS only): when you use Sign in with Apple, Apple provides your name and, only if you choose to share it, an email address (either your real one or a private relay address). Apple does not provide a profile photo. This data is managed by Firebase Authentication like the Google one.
• Your profile (visible to other app users): a public profile document stores your visible name, profile photo URL, and last activity time (lastSeen). This is visible to any authenticated Ejulu! user and is required to show who the members of a group are. The visible name is never your full Google name: by default it is just the initials of your first and last name (e.g. "GR"), and you can replace it at any time with a custom name of your choice ("Visible name" in the app menu). Ping notifications also use this visible name only.
• Your private data (visible only to you): your email address, your full Google display name, and your push notification token (Firebase Cloud Messaging token) are stored in a private document that only you can read. The push token is used exclusively to deliver "location ping" notifications to your device.
• Group data: for each group, we store the group name, the list of member IDs, the creator's ID, the creation date, and, for groups with an expiry, the expiry date. This metadata is readable by any authenticated Ejulu! user, because the app needs it to validate a linking code before joining; locations and ping metadata remain visible to group members only. The group ID is a long random identifier that acts as the admission token for the group.
• Location request metadata (visible to group members): when a member of your trusted circle sends a "ping", we store a small record with who requested it, who it is addressed to, the time, and its status. This metadata does not contain any coordinates or location data.
• Terms of service acceptance records: when you accept the Terms of Service / License Agreement (EULA), we store a minimal record on Firestore (eula_acceptances) containing your user ID (uid), the accepted version identifier (eulaVersion), a server timestamp (acceptedAt), and the operating system platform (platform). This record contains no location, email, or personal identifiers other than your account ID. Purpose: contractual performance and legal compliance.
• No analytics, no advertising: Ejulu! contains no analytics SDKs, no advertising, and no tracking of any kind. We do not profile you, and your data is never used for marketing purposes.

2. Location Data and End-to-End Encryption

Location is the core of Ejulu!, and it is handled with end-to-end encryption:

• What a location record contains: your GPS coordinates, their accuracy, altitude, speed, your device battery level and charging state, the capture time, and what triggered the capture (manual refresh, app start, or a member's ping).
• How it is stored: each record is encrypted on your device with AES-256-GCM before it is uploaded, using a 256-bit key that belongs to your group. Our cloud database (Firebase Firestore) stores only the ciphertext and a timestamp indicating how recent the position is. We cannot read your position, and neither can Google.
• The group key never leaves your devices: it is generated on the device of the member who creates the group, it is stored only in the secure hardware storage of each member's device (Android Keystore / iOS Keychain), and it leaves your device only through the linking code (shown as a QR code and copyable as text), which you are asked to share in person only. It is never transmitted to any server.
• No location history: only your latest position per group is stored. Each new position overwrites the previous one; past positions are not retained anywhere.
• Treat the linking code as confidential: the QR code, and the text you can copy from it, contain the group ID, the group name, and the encryption key; joining is possible by scanning the QR code or by pasting the code. Anyone in possession of it can join the group and decrypt the members' positions, so never send it over chat or email. The key is not automatically rotated when someone leaves the group; deleting and recreating the group invalidates a leaked code.

3. When Your Location Is Accessed

Ejulu! does not track you continuously. Your location is captured only in these moments, each time on demand: when you send your position from the app, when the app starts, when a member of your trusted circle sends you a "ping", and when you accept an invitation to rejoin a renewed group. Between these events, the app does not access the GPS.

• To answer pings while the app is closed, Ejulu! asks for the "Allow all the time" location permission and a high-priority silent push notification wakes the app for a few seconds. This is optional: with "While using the app" only, your device responds to pings only while the app is open.
• Camera: the camera is used solely to scan the enrollment QR code. The camera stream is processed locally on your device; no images are captured, stored, or transmitted.

4. Third-Party Services

Ejulu! integrates with the following third-party services:

• Firebase (by Google): used for authentication (Firebase Authentication), data storage (Cloud Firestore), push notifications (Firebase Cloud Messaging), and server-side automation (Cloud Functions). One function dispatches ping notifications, reading only group membership and push tokens to route them. Another renews expired groups: it removes the other members, deletes their stored positions, and writes a rejoin invitation. A scheduled hourly job permanently deletes expired groups after their grace period. These server-side components can delete stored locations as part of renewal and cleanup, but they never read or decrypt them, and never have access to the encryption key. Diagnostic data (such as device type or operating system) may be collected by these providers in an anonymous and aggregated form to ensure reliability and performance. Please refer to Google's privacy policy for details on their data handling.
• Google Sign-In: used for the authentication process; subject to Google's privacy policy.
• OpenStreetMap: the map is rendered with OpenStreetMap tiles. Loading map tiles exposes your IP address and the map area you are viewing to the OpenStreetMap tile service.
• Wikimedia (Wikimedia Commons): the Google logo on the sign-in screen is downloaded from Wikimedia's servers; loading it exposes your IP address to Wikimedia.

5. Data Retention and Your Control

• Your position: the document holding your latest position in a group is deleted immediately when you leave the group or when the group is deleted.
• Groups: you can leave a group at any time from the app; the creator can delete a group, which removes its data (including all stored encrypted positions and ping metadata).
• Timed groups: a group can optionally have an expiry date. When it expires, the group becomes read-only for a 7-day grace period: members can still read the stored positions, but nobody can join, share new ones, or send pings. If the creator renews the group, the other members are removed, their stored positions are deleted, and an invitation to rejoin is written to each of their private documents. If the grace period passes without renewal, an automated hourly job permanently deletes the group together with all its encrypted positions and ping metadata. Your position in an expired group is therefore retained for at most 7 days beyond the expiry date.
• Ping metadata: request records are retained with the group until it is deleted.
• Cryptographic keys: stored only on your device; uninstalling the app or leaving the group removes them.
• Terms of service acceptance records: stored upon explicit agreement and retained for 10 years following account deletion, strictly for contractual accountability and legal defense under applicable statutes of limitation (Art. 7 GDPR).
• Your account and profile: you can delete your account at any time directly in the app (profile menu → "Delete account"). This permanently removes your memberships and stored positions in all groups, your public profile and your private document, the encryption keys stored on your device, and your Firebase Authentication account, and revokes the Google sign-in consent. Groups you created that become empty as a result are deleted together with all their data. You may be asked to confirm your Google account to complete the deletion. To request deletion from outside the app (for example after uninstalling it), send an email to hemme.dev@gmail.com from the Google address you use to sign in, with subject "Account Deletion Request - Ejulu!".

6. Children's Privacy

We do not knowingly collect personal information from children under 14. If we discover that a child under 14 has provided us with personal information, we will delete it immediately. Ejulu! is intended for trusted circles and families: minors should use the app under the supervision and consent of a parent or guardian, who should carefully consider whether to enable continuous location sharing for the child.

7. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be reflected on this page with an updated effective date.

8. Contact Us

If you have any questions about this Privacy Policy, please contact us at: hemme.dev@gmail.com