Português (Portugal) · Português (Brasil) · English · Español · Français · Italiano

Privacy Policy

Courtesy translation. In case of doubt, the European Portuguese version prevails.

This applies to the Kage app (Flash, Panic, Switch, Sentinel and the Kage Ring accessory), to the help page your contacts open and to this website. Last updated: 13 October 2026.

1. Who is responsible for your data

José Manuel Palma Amador, sole trader (Portugal), brand Navidkya. Contact for privacy matters and to exercise your rights: kage@thenavidkya.co.

2. What data we process, why, and on what legal basis

• Account (email and password, or sign-in with Google/Facebook): to create and protect your account. Basis: performance of a contract.
• Name, profile photo or symbol (optional) and a phone number verified by SMS: so people who receive your alert know who you are. Basis: performance of a contract.
• Contacts you choose (name and number) and Kage Contacts (people with the app linked to you by code or invitation): to know whom to alert. Basis: performance of a contract and your interest in getting help. These numbers are data you give us; we only use them for your alerts.
• Location: when you use Flash, a tool or the ring, your position is included in the alert and keeps being sent to the contacts you chose until you say "I'm safe" — also with the app closed or the screen off (background location). Outside that, we do not collect your location. Basis: your consent (phone permission), performance of a contract and, in an emergency, protection of your vital interests.
• Record of alerts and of what was delivered to each contact (channel, time, status), account events and help requests received: to show you your history and prove what happened. Basis: performance of a contract.
• Phone notification identifier (token): to deliver alerts and help requests. Basis: performance of a contract.
• Purchases (Google Play receipt, product, country of purchase): to activate your plan or extra SMS and calculate your plan's SMS. We never see your card details. Basis: performance of a contract and legal obligations (invoicing).
• Kage Ring (if you use it): ring identifier, battery status and alarm events. Basis: performance of a contract.
• Security and abuse prevention: irreversible fingerprints of numbers used for the free test SMS and verification codes, request counters, and "don't send me these" requests made by people who receive alerts. Basis: legitimate interest (preventing abuse and improper SMS spending).
• App error log: the technical error message, the version and the generic system model, without names, numbers, emails or location. To fix faults. Basis: legitimate interest.
• PIN and fingerprint (optional) stay on your phone only; they never reach our servers.

We never sell data or use it for advertising or profiling. We make no automated decisions that affect you.

3. Phone permissions

• Location, including "Allow all the time": Kage collects location data to send your position to your trusted contacts when you use Flash, even when the app is closed or not in use. Only while an alert is active.
• Contacts: so you can choose, on your phone, whom to alert. The list is read on the device; we only store the contacts you pick.
• Notifications, foreground service, full screen and battery optimisation: so Flash by volume button, the Switch and the Sentinel work with the screen off and show their status.
• Bluetooth (only with the Kage Ring): so the phone can listen to the ring.

4. Who receives data (processors) and transfers

• Supabase — server and database, in the European Union (Ireland).
• BudgetSMS (Netherlands) and mobile carriers — receive the destination number and the SMS text, only to deliver it.
• Telnyx (USA) — only as a backup, when BudgetSMS refuses a message; receives the destination number and the SMS text, only to deliver it.
• Google (Firebase Cloud Messaging for notifications; Google Play for payments; Google sign-in, if you use it).
• Meta (Facebook sign-in, if you use it).
• OpenStreetMap — shows the maps; receives the IP address and the visible area, never names or numbers.
• Website hosting (Cloudflare or Vercel) and support email (Zoho) — receive visitors' IP addresses or what you write to us.

Some of these services (Google, Meta, Telnyx, Cloudflare/Vercel, Zoho) may process data outside the European Economic Area, namely in the USA. Such transfers rely on GDPR safeguards: the EU-US Data Privacy Framework where the company is certified, or the European Commission's standard contractual clauses.

5. People who receive your alerts

The contacts you choose receive your name, verified number, the message and a link to your location while the alert is active. Recipients can ask, on the link's page, not to receive any more alerts from you (or from Kage). To report abuse, write to kage@thenavidkya.co.

6. How long we keep data

• Account, profile and contacts: while the account exists.
• Location of an alert: deleted when you say "I'm safe"; if you don't, the link stops working after 24 hours and the data is deleted 7 days later.
• Alert records: 12 months. Delivery results and resolved help requests: 90 days (requests never seen: 180 days).
• Error log: 30 days. Anti-abuse counters: up to 30 days; fingerprints of test-SMS numbers and "don't send" requests: as long as needed to prevent abuse or until the person who asked undoes it.
• Purchase billing data: as long as the law requires.

You can delete your account in the app (Account, Delete account) or at kage.thenavidkya.co/eliminar-conta. This deletes your data and your sign-in account, except the anti-abuse fingerprints above and what the law requires us to keep.

7. Your rights

You have the right to access your data, correct it, erase it, restrict or object to its processing, receive it in a portable format and withdraw consent at any time (for example, location, in your phone's settings). To do so, write to kage@thenavidkya.co; we reply within one month. You may also lodge a complaint with the Portuguese data protection authority (CNPD, www.cnpd.pt) or the authority in your country. In Brazil, you have the rights in article 18 of the LGPD and may complain to the ANPD.

8. Age

Kage is intended for people aged 18 and over.

9. Security

Communications are encrypted (HTTPS), each account can only access its own data and the phone's background services use their own tickets instead of your session. If a data breach could affect you, we notify the CNPD within 72 hours and tell you without delay.

10. Changes

If we change anything important, we will tell you in the app before it takes effect.