Privacy Policy

1. Who we are

WayMaker is a free mobile application developed and operated by Kingdom Way Trust, a registered charity based in Eastbourne, East Sussex. The app helps people experiencing homelessness or hardship to find local support services including food, shelter, healthcare, and advice.

Kingdom Way Trust is the data controller for personal data processed through this application. Our registered charity number is 1139646. Our website is www.kingdomwaytrust.org.

2. What data we collect

WayMaker is designed to collect as little personal data as possible. The app does not require you to create an account or provide any personal details to use its core features.

Data collected only if you enable SWEP alerts

If you choose to enable Severe Weather Emergency Protocol (SWEP) notifications in the app Settings, the following data is collected and stored:

• Push notification token — A unique identifier generated by your device and Expo's push notification service. It is not linked to your name, email address, or any other personal identifier. We collect this to deliver SWEP weather alert notifications to your device.
• Area preference — The area you selected (for example, Eastbourne or Lewes). We collect this to send you alerts relevant to your chosen area only.
• Active status — Whether your alerts are currently enabled or disabled. We collect this to avoid sending notifications to users who have turned alerts off.

Data we do not collect

Report an App Issue

If you use the Report an App Issue feature, your report is sent via EmailJS directly to Kingdom Way Trust's email address. The report may contain any information you choose to include. We use this solely to investigate and resolve the issue reported. We do not store this data beyond our normal email retention practices.

3. Legal basis for processing (UK GDPR)

Kingdom Way Trust processes data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

• Push notification token and area preference — Legal basis: Consent. You actively choose to enable SWEP alerts in the app Settings. You can withdraw consent at any time by disabling alerts in Settings or uninstalling the app.
• Issue reports submitted via the app — Legal basis: Legitimate interests. To maintain the quality and accuracy of the app for the benefit of its users.

4. How we store your data

Push notification tokens and area preferences are stored securely in Supabase, a cloud database service. Supabase stores data in data centres located within the European Union, ensuring compliance with UK GDPR requirements for international data transfers.

All data is encrypted in transit using TLS and encrypted at rest. Access to the database is restricted to authorised Kingdom Way Trust personnel only.

5. How long we keep your data

• Push notification tokens — retained while your alerts are active. If you disable alerts or uninstall the app, your token is marked inactive and permanently deleted within 30 days.
• Issue reports — retained in our email system for up to 12 months, then deleted unless required for ongoing investigations.

6. Who we share your data with

We do not sell, rent, or share your personal data with any third parties for marketing or commercial purposes.

To operate the notification service, your push notification token passes through the following services:

• Expo Push Notification Service — used to route notifications to your device. Expo receives the token temporarily to deliver the notification and does not retain it for other purposes. Expo's privacy policy is available at expo.dev/privacy.
• Google Firebase Cloud Messaging (FCM) — used on Android devices to deliver push notifications. FCM is operated by Google. Google's privacy policy is available at policies.google.com/privacy.
• Apple Push Notification Service (APNs) — used on iOS devices to deliver push notifications. APNs is operated by Apple. Apple's privacy policy is available at apple.com/legal/privacy.

7. Your rights under UK GDPR

You have the following rights regarding your personal data:

• Right of access — you can request a copy of any personal data we hold about you.
• Right to erasure — you can request that we delete your data. For push notification tokens, the simplest way is to disable SWEP alerts in Settings, which marks your token for deletion.
• Right to withdraw consent — you can withdraw consent for push notifications at any time by disabling alerts in the app Settings, or by going to your phone Settings and disabling notifications for WayMaker.
• Right to object — you can object to processing of your data.
• Right to data portability — you can request your data in a portable format.

To exercise any of these rights, please contact us using the details in section 9 below. We will respond within 30 days.

8. Children

WayMaker is not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

9. Contact us

If you have any questions about this privacy policy, wish to exercise your data rights, or have a concern about how we handle your data, please contact us:

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have not handled your data correctly:

10. Changes to this policy

We may update this privacy policy from time to time to reflect changes in the app or in data protection law. The effective date at the top of this page will be updated when changes are made. We encourage you to review this policy periodically.

Continued use of the WayMaker app after changes to this policy constitutes acceptance of the updated terms.