Chantel Alert Privacy Policy

Chantel Alert is a public safety notification and community platform serving participating countries in the region. It has three parts: the Chantel Alert mobile app (used by the public), the Community Publisher Portal (used by verified businesses, news organizations, and public agencies), and the Authority admin dashboard (used by police, army, and other authorized agencies to issue Alerts). This policy covers all three.

The mobile app: no account required

The mobile app does not require an account, sign-up, or any personal identity information to use. You can install it, complete onboarding, receive and read Alerts, read Community content, submit a tip, and change your notification and location settings without ever creating an account. It collects only what's needed to deliver Alerts and, optionally, let you submit a tip:

• Push notification token: a device identifier issued by Apple/Google's push services, used to deliver Alert and Community notifications to your device, and, if you submit a bug report, to notify you of a reply. Required for the app's core function.
• Parish: the parish you select during onboarding, used to target Alerts relevant to your area. Coarse and self-declared, not derived from device location.
• Precise location (optional): only collected if you explicitly opt in to radius-based Alerts near a reported location. You can decline and still receive parish-level Alerts, and turn this off at any time in Settings.
• Tip submissions (optional): if you choose to submit a tip on an Alert, we collect the message you write and, only if you choose to provide them, your name and phone number. Leaving these fields blank keeps your tip anonymous to authorities. You may also optionally attach a photo to your tip; if you do, it is uploaded to our cloud storage and shared only with the authority handling the corresponding Alert, the same as the rest of your tip.
• Notification settings: whether you've granted notification permission, read locally on your device to show accurate status in Settings. It is not transmitted anywhere beyond what's needed to actually deliver notifications.
• Bug reports and support messages (optional): if you choose to report a problem through Help & Support, we collect the description you write, your app version, and your device's platform (Android/iOS). Any further messages you send in that conversation, and any reply from us, are stored as part of that same thread. This conversation is visible only to you and to Chantel Alert staff handling support — never to other app users, Authorities, or Community organizations.

The app also links out to external destinations you choose to open: the Publisher & Partner Network (to learn about or apply for a Business, News, or Public Agency account), our Instagram, and our website. Opening one of these takes you to an external site in your browser; we do not receive anything about that visit beyond what the external site itself collects under its own policy.

Alerts and Community content

Alerts, including any subject name, age, photo, description, and last-seen location, are submitted by verified, individually provisioned Authority accounts (police, army, and other government agencies), not by app users. Community content (business updates, news, public notices) is submitted by verified Publisher Portal organizations. Both are public-safety or community information published by the relevant organization, not data we collect from you as a reader.

Community Publisher Portal accounts

Businesses, news organizations, and public agencies that want to publish Community content create a separate publisher account, entirely distinct from, and never merged into, the public mobile app. We collect:

• Account email and password: your password is stored as a salted hash, never in plain text. We send a verification code to your email, which you must confirm before you can apply for an organization.
• Organization application details: organization name, type (Business, News, or Public Agency), description, public contact phone/email, website, and location, submitted when applying for a verified organization.
• Organization logo (optional): an image you upload, verified server-side (file type and content, dimensions, size) before it's stored and shown on your organization's profile and Community posts.
• Membership and role: who belongs to your organization and their role (Owner, Admin, Editor, Viewer), so we can enforce who may publish or manage it.
• Two-factor authentication (MFA): an authenticator-app secret if you enable MFA, and (for News and Public Agency publishers with a publishing-capable role) a fresh MFA step-up is required immediately before publishing.
• Posts you publish: titles, body text/rich content, and any media you attach.

Organization applications for News and Public Agency accounts are reviewed by Chantel Alert before verification; this is not instant. Once verified, your organization's profile, logo, and published posts are public within the app; your account email, password, and internal moderation history are not. If a post is flagged for review or an organization is suspended, we keep an internal record of that action (and the reason, where one is given); this internal moderation record is visible to your organization but not to the public.

Sponsorship and Featured Placements

A sponsorship inquiry submitted through the public sponsorship page is sent as an email to Chantel Alert's own contact address; it is not stored in our database, and sponsorship is a separate relationship from a Publisher Portal account (creating one does not automatically grant the other). Active sponsorships and Featured Placements (a paid or admin-granted boost that surfaces a post more prominently within Community) are managed by Chantel Alert administrators and are visibly labeled wherever they appear; they are never presented as, and never provide access to, emergency Alert broadcasting.

Subscriptions and payment

Organizations may subscribe to a paid publishing plan. On Android, subscriptions are purchased and managed through Google Play Billing inside the Chantel Alert app; Chantel Alert never collects or stores your card number, CVV, or Google account payment credentials — that information is handled entirely by Google. Chantel Alert receives only your purchase and subscription status (plan, renewal date, and similar billing state) from Google Play, never your payment method itself. A small number of organizations that subscribed before this app moved to Google Play Billing may still have an existing subscription processed by PayPal; for those organizations, card and payment details continue to be handled entirely by PayPal, and Chantel Alert never receives or stores the full card number.

How we use this information

• Delivering Alert and Community push notifications to your device.
• Targeting Alerts to the parish(es) or radius they're relevant to.
• Passing tip submissions to the authority handling the related Alert.
• Notifying you directly if a tip you submitted is marked as actioned by an authority (using the same push token your device registered with).
• Reviewing and responding to bug reports and support messages you submit, and notifying you of a reply.
• Reviewing and verifying organization applications before granting publishing access.
• Operating the audit trail authorities and Chantel Alert administrators rely on for accountability.

We do not sell your information, use it for advertising, or use any third-party analytics or advertising SDKs in the mobile app.

Who we share it with

Push notifications are delivered through Expo's push notification service, which relays them through Apple Push Notification service (iOS) or Firebase Cloud Messaging (Android). Your device token is shared with these services solely to deliver notifications. Tip contact details and content are shared only with the authority (agency) handling the corresponding Alert. Bug reports and support messages are shared only with Chantel Alert (McNova) staff handling support, never with an authority or Community organization. Organization media (including logos) is stored with our cloud storage provider. Subscription/payment processing for Android organization subscriptions is handled by Google Play Billing; a small number of pre-existing subscriptions are still processed by PayPal (see “Subscriptions and payment” above).

Data retention

Device registrations, Alerts, tips, bug reports and support messages, organizations, and posts are retained to support ongoing delivery and the audit trail authorities and administrators rely on for accountability. Resolved Alerts, their tips, resolved bug reports, suspended organizations, and archived posts are kept (not deleted) for this reason; their records are retained, not erased, even when no longer publicly visible. You can stop receiving Alerts at any time by uninstalling the app, which stops further notifications to that device token.

Authority accounts

Police, army, and other agency accounts used to send Alerts are individually provisioned, secured with mandatory two-factor authentication, and subject to an internal audit trail (login attempts, IP blocking) not visible to the public. These accounts are not self-service: there is no public sign-up for sending Alerts.

Data security

Authority and Publisher account passwords are stored as salted bcrypt hashes, never in plain text. Every Authority login, and every Community login for accounts with MFA enabled, requires a second factor. Login attempts and IP addresses are logged so a super-admin can identify and block abusive access. Uploaded organization media is verified server-side (declared type checked against actual file content, not just the filename or browser-supplied type) before storage. Data in transit between the app, portals, and backend is encrypted (HTTPS/TLS). No system is perfectly secure, and we cannot guarantee absolute security of information transmitted to the Service.

Children's privacy

The mobile app itself is not directed at children and does not knowingly collect personal information from children. Note that AMBER Alerts and missing-person notices may concern a minor as the subject of an Alert: that content is published by the issuing government agency as part of its public-safety mandate, not information we collect about app users.

Your choices and rights

You can decline precise location sharing at any time, change your parish in Settings, or uninstall the app to stop receiving Alerts (this deactivates your device's push token). If you submitted a tip with contact details, or a bug report or support message, and want it deleted, or you hold a Publisher Portal account and want your account or organization data deleted, contact us using the details below and reference what you submitted and the approximate date/time.

Account deletion

Businesses, news organizations, and public agencies with a Community Publisher Portal account can request deletion of their account at any time, without needing to sign in first, at chantel-alert-publisher-portal.vercel.app/delete-account. Submitting a request starts a review process; it does not delete your account instantly. A Chantel Alert administrator reviews each request before any account or data is removed.

An administrator reviews and approves each request, then confirms deletion as a separate step. Deletion checks that the request corresponds to a real account and that completing it would not leave an organization without any owner; if it would, deletion cannot be completed until organization ownership is transferred first.

When deletion is completed, your account's email address, password, and two-step verification information are replaced so the account can no longer be used to sign in, and your membership in any organization is removed. The original request itself is minimized at the same time: your submitted email address and any reason you provided are cleared once deletion is complete.

Deleting your personal Publisher account does not delete the organization you belonged to, its verification status, or content it has published — that organization-owned and public content remains, the same way it would if you simply left the organization. Some records may be retained where necessary for security, fraud prevention, abuse investigation, legal obligations, dispute resolution, or system integrity, including audit history that references the account; we do not invent or apply a fixed retention period for these records.

The mobile app's public users do not have accounts, so there is no account to delete. Uninstalling the app removes it and its local data from your device and deactivates your device's push token. To also have personal information you voluntarily submitted through the app removed from the Service — for example, a tip and any name or phone number you chose to include with it, or a bug report or support message — contact us at the address in "Contact" below, referencing what you submitted and the approximate date and time; an administrator reviews each request. Some information may be retained where reasonably necessary for security, fraud prevention, legal obligations, public-safety record integrity, or legitimate audit requirements.

Changes to this policy

We may update this policy as the Service changes or legal requirements evolve. Material changes will update the "Last updated" date above.

Governing law

This policy is governed by the laws of Antigua and Barbuda, regardless of the country from which you access or use the Service.

Contact

Questions about this policy or a request regarding your data can be sent to mcnovasolutions@gmail.com.