SafeRide privacy notice

SafeRide is a public-interest safety app developed by Esheria For Good and operated by Esheria Ventures Limited.

Data controller: [To confirm: The legal entity responsible for SafeRide data (the data controller) and its data protection registration details. The website names Esheria Ventures Limited as operator; confirm that it is also the controller.]

Some features in this notice, such as sending a report to SafeRide and sharing it with HURIA, are switched on only when their approvals are in place. If the app does not offer a choice, nothing is sent for it.

SafeRide keeps your report draft encrypted on your phone. You decide whether to keep it private, contact a provider, or send it.

Before anything leaves the phone, the app shows you a preview of what each choice sends.

Under Privacy & data you can export or delete the data the app lists there. Deleting data on your phone does not recall anything you have already sent to SafeRide or shared with HURIA.

Only what you choose to send reaches SafeRide’s server:

• Your SafeRide account: either an anonymous account the app creates, or your email address and password if you sign up with email. Passwords are stored only as a one-way hash.
• For a support referral: the provider and contact method you picked and, if you turned on the support brief, only the details listed in it (incident type, date, general type of place, and whether it is still happening).
• For an escalation packet: the packet you prepared, at the redaction level you chose. It contains what happened and your statement, any impact or witness details you added, the time, the place in words, your tags and any vehicle details, your alias if you chose one, and the list of your evidence, including your descriptions and transcripts of any recordings. At the “none” and “light” redaction levels the packet also includes the map coordinates of the place; “heavy” redaction leaves them out.
• Evidence files (photos, audio, video and documents) that you choose to upload, when evidence upload is available.
• Your consent records: what you agreed to, which version of the wording, when, and when you withdrew.
• A callback number, only if you choose to add one for HURIA (see below).

SafeRide does not use your reports for analytics, research or training AI models, does not publish anonymous route signals from them, and does not send them to third-party AI services during the pilot.

Technical logs: [To confirm: What SafeRide’s server logs contain and how long they are kept.]

Lawful basis: [To confirm: The lawful basis for each kind of processing described here.]

SafeRide runs its own server. The website, the app’s server, its database and the evidence file store all run on one self-hosted server that SafeRide operates on a virtual server rented from Contabo. Location: [To confirm: The country and data centre of the Contabo server that hosts SafeRide.]

SafeRide operates the application and storage on rented Contabo infrastructure. Contabo is the infrastructure hosting provider. Connections to SafeRide use HTTPS. SafeRide’s domain names use Cloudflare’s DNS service; the current deployment does not proxy application traffic through Cloudflare.

Authorised staff may enable optional browser notifications on a trusted device. Browser push services operated by Google, Mozilla or Apple deliver an encrypted, generic alert to that browser. SafeRide sends no report narrative, identity, phone number, case reference or location in these alerts. Browser delivery credentials are encrypted on SafeRide’s server and tied to the staff session. A notification does not confirm that a staff member has read or acted on a report.

The server makes an encrypted backup every day and keeps each one for 14 days. An encrypted copy of each backup is also kept off the server, on a computer controlled by the SafeRide team. [To confirm: Where the off-server encrypted backup copies are kept, and for how long.]

Who at SafeRide can access it: [To confirm: Which SafeRide or Esheria roles can access data on the server, and the confidentiality terms they work under.]

HURIA (Human Rights Agenda) is SafeRide’s partner on the Coast and, in this pilot, the only partner the app offers. Sharing with HURIA is off unless you turn it on and tick the consent for that report. If you send a report, SafeRide gets it whether or not you share it with HURIA.

If you share, named HURIA staff see the report in the SafeRide partner dashboard. They use individual accounts and passwords, with an authenticator step when their organization requires it. SafeRide routes reports to HURIA only while its recorded agreement is current and intake is enabled.

What HURIA sees:

• For an escalation packet: the minimised packet at the redaction level you chose. That is what happened and your statement, any impact or witness details you added, the time, the place in words, your tags and any vehicle details, your alias if you chose one, and the list of your evidence, including your descriptions and transcripts of any recordings (with the masking you chose).
• For a support referral: a short brief with the contact method you picked and, if you turned on the support brief, only the details listed there.

What HURIA does not see:

• Your exact location. The map coordinates in your packet are always removed before HURIA sees it. SafeRide also tries to remove coordinates and map links that you type into your own text, but cannot recognise every way of writing a position, so describe places in words.
• Evidence files. HURIA sees the list of your evidence, with your descriptions and transcripts, but not the photos, audio, video or documents themselves. Evidence files are not shared with partners during the pilot.
• The email address or phone number of your SafeRide account.

HURIA staff can update the status of your report and add notes in the dashboard. These are stored on SafeRide’s server, and you can follow the status in the app. Every time a HURIA staff member opens a report or a callback number, SafeRide records who did it and when. Those records do not contain your report or anyone’s IP address.

To talk to HURIA, call 0769 546 253 and quote the reference number the app gives you.

HURIA’s role: [To confirm: HURIA’s role under data protection law (for example independent controller or processor), the agreement reference, and how HURIA handles information it records outside SafeRide, such as notes from a call.]

You can let HURIA call you back by adding a Kenyan mobile number. This is a separate choice with its own consent, and it is off unless you turn it on. Without it, HURIA has no number for you: you call HURIA yourself and quote your reference.

The number is stored encrypted. Authorized HURIA caseworkers can reveal it, and every view is recorded. If you stop sharing, the number is deleted.

Only share a number that is safe for you to be called on. If someone else might answer or check that phone, leave this off and call HURIA yourself.

You can stop sharing with HURIA at any time, from the case or from Privacy & data in the app. HURIA then loses access to that report straight away, and any callback number you shared is deleted.

If the app no longer knows which consent belongs to a report, for example after reinstalling SafeRide, you can stop sharing all your reports with HURIA at once.

Withdrawal needs a connection. The app tells you if the server has not confirmed it yet.

Anything HURIA has already done, such as calling you or referring you onward, cannot be undone. Stopping sharing with HURIA does not delete your report from SafeRide; to ask for that, use the contact below.

Evidence files uploaded to SafeRide go into quarantine. A file can be downloaded only after its fingerprint (hash) matches the one your phone recorded and an approved malware scanner has reported it clean.

Scanning runs only when a current approved scanner is configured and healthy. Until a matching clean result is recorded, the file stays quarantined. An unavailable scanner or failed scan does not release it. A file the scanner rejects is never released.

Face blurring, metadata removal or other processing you request for a file is not reported as done until SafeRide has evidence that it was done.

These periods come from SafeRide’s privacy controls (version privacy-controls.2026-07-30.2). Except for the phone setting, every period is pending legal approval, and SafeRide does not yet run automatic time-based deletion on its server.

• On your phone: until you delete it. Automatic deletion after 30 or 90 days is planned but pending legal approval, so it is not available yet.
• Reports sent to SafeRide: no retention period has been approved yet. [To confirm: How long reports sent to SafeRide are kept. No period has been approved yet.]
• HURIA’s access to a report after HURIA closes it: proposed 90 days, pending legal approval. Until then, access ends when you stop sharing.
• Records of HURIA staff opening reports and callback numbers: proposed 730 days (two years), pending legal approval.
• Callback number: until you stop sharing, when it is deleted straight away.
• Server backups: 14 days on the server. Off-server copies: see “Where your report is stored”.

SafeRide is not yet approved to handle reports from children. The pilot does not create accounts for people who tell SafeRide they are under 18.

In the app you can see the consents you have given, withdraw them, and export or delete the data listed under Privacy & data.

To see, correct, export or delete what SafeRide holds about you on its server, contact SafeRide. These requests are handled by the SafeRide team, not yet automatically in the app. Response time: [To confirm: How quickly SafeRide responds to a privacy request.]

Your rights under the law: [To confirm: The applicable data protection law, the rights it gives, and how to complain to the regulator.]

Privacy requests: [To confirm: The contact for privacy requests. Proposed: saferide@esheria.org, SafeRide’s public inbox. Add a postal address and a data protection officer if required.] Please do not send evidence, exact locations or details of what happened by email.

For SafeRide in general, use the contact page. To talk to HURIA about a shared report, call 0769 546 253.

Each version of this notice has its own version number. This is version 2026-10-22.pilot.1. A changed notice gets a new version number on this page.