ResQMesh Privacy Policy

Scope and responsible organization

This notice applies to ResQMesh's public website, mobile application, cloud APIs, administration portal, and participating mesh-node services. It covers visitors, civilian account holders, rescuers, administrators, and people who communicate with the ResQMesh Team.

The ResQMesh Team is responsible for the personal data described in this notice. Privacy questions and requests may be sent to resqmesh@gmail.com, through the Contact page, or to the contact address listed in Section 14.

Information we collect

The categories depend on the ResQMesh feature and role being used:

• Registration and identity information: name, birthdate, address, barangay, occupation, username, email address, phone number, ID type and number, and front and back ID images.
• Health and emergency information: blood type, medical complications, allergies, distress details, emergency status, responder assignments, and incident timestamps.
• Location and route information: civilian distress coordinates, rescuer locations when sharing is enabled, route requests, travel distance, and estimated arrival information.
• Communications: online and mesh text messages, voice clips, announcements, read state, moderation information, and delivery or transmission status.
• Account and security information: password hashes, authentication sessions, password-reset records, account status, access changes, IP addresses, user-agent details, and administrative audit events.
• Device and operational information: push-notification tokens, app settings, mesh node identity, health, battery, connectivity, synchronization events, radio neighbors, and system diagnostics.
• Contact and support information: name, email address, selected subject, message, submission time, and network address submitted through the Contact page.

Passwords are processed as hashes rather than stored as readable passwords. Sensitive registration fields and uploaded ID images use the system's protected storage workflow.

How information is collected

• Directly from users during registration, login, distress activation, messaging, support requests, and settings changes.
• Automatically when the website, app, cloud APIs, or mesh nodes create sessions, security logs, timestamps, delivery states, location updates, or technical diagnostics.
• From authorized administrators and rescuers when they review accounts, manage teams, coordinate deployments, update incident states, or communicate with users.
• From connected mesh nodes when local emergency activity is received, relayed, stored, or synchronized.
• From service providers when they return routing, notification, security-verification, email-delivery, or infrastructure results.

Why information is processed

ResQMesh processes information to:

• review registrations, verify identity, authenticate users, and manage account access;
• create, transmit, display, and resolve distress information;
• support emergency chat, voice communication, responder assignment, routing, and location sharing;
• deliver important messages and push notifications;
• operate mesh devices, synchronize supported records, diagnose faults, and preserve service continuity;
• prevent abuse, investigate failures, maintain audit trails, and protect users and systems; and
• respond to requests, disputes, lawful orders, and applicable public-safety or legal obligations.

Consent is requested for public civilian registration and certain optional device features. Other processing may occur where necessary to provide a requested service, protect life or health, maintain system security, meet legal obligations, or rely on another lawful circumstance under applicable privacy law. Withdrawing consent does not invalidate processing already completed and may not stop processing supported by another lawful basis.

Emergency and offline mesh processing

Mesh mode is designed to operate when internet service is weak or unavailable. Distress details, available GPS coordinates, text or voice messages, assignments, completion states, node status, and related records may be handled by the connected mesh node and transmitted over LoRa to other reachable nodes.

Depending on the message type and network path, records may temporarily exist on more than one mesh node. Supported records may later synchronize with the ResQMesh cloud when a node regains internet access. Radio conditions can delay, duplicate, or prevent transmission, so users should not treat local transmission as guaranteed remote receipt unless the app explicitly confirms it.

Authorized recipients and service providers

Information is disclosed only when needed for an authorized function. Administrators may review account, system, and incident records. Rescuers may access information relevant to their communications and assigned emergency response. Mesh nodes process local operational data needed to provide mesh communication.

Information may also be disclosed to competent authorities when required by law, a valid legal process, or a necessary public-safety response. Service providers operate under their own terms and privacy notices.

Retention and secure disposal

ResQMesh retains information only while it is reasonably needed for account administration, registration review, emergency operations, incident review, communication history, security investigation, audit, dispute resolution, system recovery, and applicable legal or public-safety obligations.

The appropriate period depends on the record and its operational context. Active account records may be retained while the account remains in use. Incident, deployment, communication, location, mesh-sync, and audit records may need to remain available after an incident for accountability and investigation. Short-lived sessions and reset credentials expire according to their configured validity.

When information is no longer required, it should be deleted, anonymized, or securely disposed of. A deletion request may be limited where retaining a record remains necessary for safety, security, audit, dispute, or legal purposes. ResQMesh does not represent that every record currently follows a single fixed automated deletion schedule.

Security safeguards and limitations

ResQMesh uses role-based access, authentication, password hashing, encrypted or protected sensitive fields and uploads, HTTPS transport, request validation, rate limiting, audit logging, restricted administrative routes, and device authentication. Access should be limited to people and systems with an operational need.

No online, radio, or storage system can be guaranteed completely secure. Users should protect their device, credentials, and access tokens, install trusted app releases, and promptly report suspected unauthorized access. ResQMesh will handle confirmed incidents and provide notices when required by applicable law.

Cookies, sessions, and device-side storage

The website uses essential session and security data for authenticated functions. ResQMesh does not operate advertising cookies. Third-party features such as Google reCAPTCHA and Google Fonts may make requests or use storage according to the provider's own policies.

The mobile app stores session tokens, preferences, notification state, cached operational information, and other data needed for app functions. If Keep me signed in is enabled, a hashed credential and profile snapshot are stored locally to support saved offline access. The current account's saved offline access can be removed from the app's Settings screen without immediately ending the active session.

Your privacy rights

Subject to applicable law and any valid limitations, data subjects may have rights to be informed, access their data, object to certain processing, correct inaccurate data, request erasure or blocking, obtain data portability, seek damages, and file a complaint.

Requests may be submitted through the privacy contact in Section 14. ResQMesh may need to verify identity and clarify the requested account or record before responding. Requests involving another person's data, an active emergency, security evidence, legal obligations, or records needed to protect another person may be restricted or handled differently as permitted by law.

Learn more from the Philippine National Privacy Commission's Data Subject Rights guidance.

Age requirement

Public civilian registration is limited to people who are at least 18 years old. ResQMesh does not knowingly approve a public civilian registration from a person below that age through the current registration workflow. If information was submitted contrary to this requirement, contact the ResQMesh Team.

International processing

Some infrastructure and service providers may process or route information outside the Philippines. This can occur for cloud hosting, abuse prevention, push notification delivery, mapping, routing, fonts, or email services. ResQMesh should use providers only for necessary functions and apply reasonable safeguards appropriate to the information and service involved.

Changes to this notice

This notice may be revised when ResQMesh features, providers, processing practices, or legal requirements change. The effective date and version shown at the top identify the published notice. Material changes should be communicated through the website, application, registration flow, or another reasonable channel. New consent may be requested when required.