Privacy Policy — Né Ngập
Né Ngập is a minute-scale rain and flood app for motorbike riders in Ho Chi Minh City and Hanoi. This policy explains what the app collects, why, for how long, and how you delete it. It follows Decree 13/2023/NĐ-CP on personal data protection and the Personal Data Protection Law (effective 1 January 2026).
Né Ngập is not an official disaster warning ("Né Ngập không phải cảnh báo thiên tai chính thức"). Forecasts are for reference only and are always shown as a range (e.g. "10–14 min"). Follow the announcements of the competent authorities.
1. Summary
- No accounts. No sign-up; we never ask for your name, phone number or email.
- No ads, no behavioural analytics, no sale of data.
- Your location leaves the phone only as a ~1 km cell (geohash-6), never as precise coordinates — unless you choose to send a flood/rain report.
- You can delete all your data with the "Delete my data" button in the app. Devices that do not use the app for 180 days are deleted automatically.
2. Data we collect
| Data | When | Why | Retention |
|---|---|---|---|
| Anonymous installation id (random, server-generated) | First launch | Deliver alerts to the right device, prevent abuse | Until you delete your data, or 180 days after last use |
| ~1 km location cell (geohash-6, e.g. "w3gv2c") and the cell's centre | When you allow location | Warn you of rain approaching your area while the app is closed | Overwritten on every update; deleted with the installation |
| Push token, APNs environment, Live Activity token (iPhone) | When you allow notifications | Send rain/flood/tide alerts | Until replaced or invalid; deleted with the installation |
| Platform (iOS/Android), app version, language, alert preferences | First launch and when you change settings | Operate the service (notification language, forced updates) | Deleted with the installation |
| Saved places (your label, kind, alert window; position snapped to the ~1 km cell centre) | When you save a place | Rain alerts for places you care about | Until you delete the place or your data |
| Rain/flood reports: position rounded to ≈ 11 m (4 decimals), type, water depth | Only when you tap send | Let the community see where it floods | Publicly visible for at most 3 hours; deleted 30 days after expiry |
| "Still flooded / Gone" votes | When you tap | Confirm other people's reports | Deleted with the report |
| Alerts sent and your "Right / Wrong" feedback | On each alert; when you answer | Measure alert accuracy | 90 days |
| IP address in server logs | Every request | Abuse prevention, troubleshooting | 14 days. The server never logs coordinates or search text |
We do not store your precise GPS position (other than reports you send) or any movement history. The "Trip" feature is computed on the phone; the server only returns a city-wide rain-forecast grid. The website at https://nengap.uranashel.com uses no tracking cookies, embeds no analytics scripts, and self-hosts its fonts directly from the same server.
Why a ~1 km cell?
Convective rain in Vietnam moves in patches a few km wide. A geohash-6 cell (about 1.2 × 0.6 km) is small enough to say "rain is about to reach you" but too coarse to identify your home or workplace. The phone rounds your position to the cell before sending it.
Community reports
Reports are shown publicly on the map (with no identity or installation id) for at most 3 hours. When you delete your data, your reports are anonymised (the link to your device is removed) rather than deleted immediately, because other riders rely on them; they are still deleted on the schedule above.
3. Legal basis
- Your consent: location (permission prompt), notifications, saved places, reports and votes. You can withdraw it at any time in your phone's Settings or in the app.
- Legitimate interest / operating the service: device information, alert history, server logs.
- Security: refresh tokens (stored hashed), duplicate-request records (24 hours).
4. Third parties
The Né Ngập server sits between the app and the weather data sources, so your IP address does not reach them:
| Source | Used for | Data sent |
|---|---|---|
| Weather radar provider (RainViewer or licensed data provider) | Radar images, rain forecast | None of your data (the server fetches shared images) |
| Hourly/daily forecast and air-quality source (Open-Meteo / CAMS; disabled by default in production until licensed) | Hourly and daily forecast, AQI | Only the centre of a ~5 km cell, with no IP or installation id |
| Place search (development: Photon/OpenStreetMap; commercial: Track Asia or VietMap) | The place search box | The text you type, with no IP or installation id; the server neither stores nor logs it |
| Firebase Cloud Messaging (Google) / Apple Push Notification service | Delivering push notifications | Push token and notification content |
| Firebase Crashlytics (Google) — not enabled in v1.0.0 | Crash reports (only if enabled in a future release) | Crash and device information; no location, session token or personal data |
Exceptions — direct connections from your phone (your IP reaches these services):
- Base map: iPhone uses Apple Maps (MapKit); Android loads map tiles from OpenFreeMap. These services receive your IP address and the map area being viewed.
- Push delivery: the operating system connects to Apple/Google to receive notifications.
Servers run on cloud infrastructure (Hostinger KVM). Where data is processed or transferred across borders, we maintain safeguards and assessments required under applicable law.
5. Your rights
You have the right to be informed, to consent or withdraw consent, to access, correct and delete your data, to restrict processing, and to complain.
- Delete your data in the app: Me → Settings → "Delete my data". The server deletes, at once and in one step: the installation id, location cell, push tokens, saved places, alert history and feedback, votes; your reports are anonymised. The phone then clears its local data.
- Automatic deletion: a device that does not connect for 180 days is deleted automatically as above.
- Uninstalling removes data on the phone; server data is deleted after 180 days, or immediately if you tap the delete button before uninstalling.
- Web / email requests: because there are no accounts we cannot identify you by email; other data-rights requests (e.g. after uninstalling) go to privacy@nengap.vn with a description (such as your platform and approximate last-use date).
6. Children
Né Ngập is not directed at children under 16 and does not knowingly collect children's data.
7. Security
Connections use TLS. Session tokens are kept in the Keychain (iPhone) / Keystore (Android). Refresh tokens are stored hashed on the server. Push-sending keys and database passwords are never shipped in the app.
8. Changes
If this policy changes materially we will announce it in the app before it applies. The latest version is always at https://nengap.uranashel.com/privacy/en (English) and https://nengap.uranashel.com/privacy (Vietnamese).
9. Contact
Data controller: Né Ngập team (uranashel.com). Email: privacy@nengap.vn Website: https://nengap.uranashel.com/en/