Privacy

Coccu is used by organizations to plan and monitor journeys in difficult places. If you are using Coccu, it is almost certainly because your organization asked you to.

That distinction matters for your rights. Your organization decides what goes into the platform, who can see it, and how long it is kept — they are the data controller. Coccu runs the platform for them and only handles information on their instructions.

So if you want to see, correct or delete what is held about you, ask your own organization first. They can do all of it inside the platform. If you cannot reach them, contact us and we will help.

The periods marked “by default” are set by your organization and may differ.

Coccu does not ask for health information about you, with one exception: if you are involved in a security incident, the report names you and records what happened to you — for example a minor or severe injury, or a death — and how many people were hurt and how badly. That is health data. It is encrypted in the database, only the Security Manager, the Operations Manager and the Director can read it, and it is kept because an organization cannot meet its duty of care without it.

This is the part people most want a straight answer on, so: your location is only recorded while you are actually travelling a leg of a mission, and only if you have switched location sharing on. Not between legs. Not when the mission is over. Not when you are off duty. The one exception: on a mission where being lost is the greater danger, the Security Manager can ask the team to keep sending while stopped, and the mission screen says so. Going out, below, is not an exception: it records where you said you were going, never where your phone is.

You can stop sharing at any time, mid-journey, from the mission screen. Nobody is notified that you did. A switch that reports you for using it is not a switch.

The one exception is the help button. If you press it, your position is sent to your area's managers and your mission's focal point every 15 seconds, on a leg or not, until you or they stand the alert down. That is what the button is for, and the screen says so while it is on. Those positions are deleted like any others, below, unless an incident report is written from the alert: then they are kept with the report.

From the Android app, each position also records the name of the mobile network your phone was on at that moment — the operator, not the signal strength, and nothing that needs a phone permission. It exists so the coverage map can say which network works where. A browser cannot read it, so positions sent from a browser carry none. It is deleted with the position.

Recorded positions delete themselves after a period your organization sets — 30 days unless they change it.

Some organizations set a curfew: a time by which everyone should be back somewhere safe. If your area uses Going out, a button on Home lets you say you are going out after hours, outside any mission. The screen says whether your security rules require it or it is optional. Your organization decides that, and which staff are offered it.

What it records. Where you are going, picked from your area's list of places or in up to 60 characters of your own; any colleagues going with you; when you left; when you said you would be back; and when you were back. No position is sent from your phone. Say where, not why: “Market” or “Hotel Talvor” is enough.

What happens at curfew. Only where your area has curfew alerts switched on; if you are not sure, ask your Security Manager. Where alerts are on: if you are still out half an hour before curfew, you get a reminder. If you are still out at curfew, the radio room is told, or Security where your area has no radio room. The radio room may call you; a call is not promised. If you are not back or somewhere safe a set time after curfew (30 minutes, unless your area changes it), Security is told, whether or not the radio room has called. If you went out after curfew, that time counts from when you left. If the radio room reaches you and notes that you are on your way, Security is told that same set time after the time you said you would be back. If the radio room notes that you did not answer, Security is told at once. Where alerts are off, nobody is told you are still out, though you still show on the board. Two exceptions. If you went out while alerts were on, that evening is followed to the end as above, even if alerts are switched off while you are out. And if nobody marks you back within 48 hours of the time you said you would be back, Security is told, whatever the alerts setting (see below). Messages about you inside Coccu may name you, never the place. On a locked screen they say only “Something new for you”.

Who sees it. The radio room, the Security Manager and the Director, on one board called “Who is out”. While a Security Manager or a Director is away, the colleague named to stand in for them sees the board too. It shows who is out now or came back tonight, where they said they were going, when they are due back, their phone numbers, and a button to call them. The radio room role opens this board and nothing else in Coccu: no missions, no incidents, no profiles. If the radio room reaches you, they note it on your entry, under their name. Your organization should tell you who does this job; it may be a contractor, such as a guard company.

On a mission. Where your area has a curfew, a mission under way shows on the same board, one row per team. The radio room, the Security Manager and the Director see its reference code, the names and phone numbers of the people on it, where it is heading and when it is expected. If location sharing is on, they also see how long ago its last position came in and where that was, in words such as “near Km 12 bridge”: never a point on a map, a trail or coordinates. Nothing extra is recorded for this; it is the last position the mission already had. Whoever records the check-ins can press “We're in for the night” once the team is somewhere safe, which stops the curfew alerts. They may add a few words about where they are. Each step of the chase (who was told, a call answered or not, “We're in for the night”) is written into the mission's permanent record, like its check-ins, and kept as long as the mission. Only the step and its time go in, never words anyone typed. Two steps say a little more: “On their way” keeps the time the team said it would be somewhere safe, and an arrival names the stop on the route the team reached (and the zone with no curfew it is in, when that is why the alerts stopped). Those names come from the mission's route and the area's map, not from anything typed. The words a team adds when it says it is in, and what the radio room notes about a team, are encrypted, shown on the board and deleted after 90 days. Alerts about teams on missions run only while your area has curfew alerts switched on. Switching them off stops them, even for a team already out.

How long it is kept. 7 days after you are back, or 90 days if the radio room or Security was told at curfew that you were still out. Your organization can change these, between 1 and 30 days and between 30 and 365. An entry is only deleted once it is closed. If nobody presses “I'm back”, it stays on the board until you or the radio room close it, or until 48 hours after the time you said you would be back: then it is closed as “not marked back” and Security is told you were never marked back, so they can check you are safe. Nobody is told you are back. The keep period above runs from there, and that message is deleted with your entry: after 7 days, or 90 if someone was told at curfew that you were still out. Messages about an entry are deleted with it, and no curfew message is kept longer than 90 days. When Security brings curfew forward for one night, that change and the reason for it are kept 90 days. After all that, what stays is a monthly count for the area: how many went out, how many were out past curfew, and how many reached Security on the night. No names, and any number under 3 is shown as “fewer than 3”. If an incident report is written about something that happened while you were out, your entry is kept with the report: the entry open at the time, or one closed in the 24 hours before.

Going-out entries are never written into a mission's permanent record, so they can be deleted on time.

When somebody opens a mission, a person's profile, an incident, a location trail or the radio room's board, the platform writes down who they were and when. You should know this exists.

It is there so that misuse can be found afterwards — this platform holds the names, phone numbers and movements of people working in dangerous places, and “who looked at this” is the question that gets asked after something goes wrong. It records that a page was opened, not what was concluded from it, and it is kept for a year by default.

Each call made from the radio room's board is written down too: who called whom, and when. Because it is kept with this record, a year by default, it lasts longer than the going-out entry itself. If you work in the radio room, this is a record of your calls as well.

We use a small number of companies to run Coccu.

• Railway runs the servers and the database.
• Cloudflare stores uploaded files — training certificates, photos of vehicles and places, documents shared within your area, and the photographs and voice notes you attach to an incident report. Every file is encrypted before it is stored. It also keeps the nightly backup copies of the database, locked so that Cloudflare cannot read them — see below.
• Google delivers notifications to the Coccu Android app. Google sees only fixed words — “Something new for you”, or “EMERGENCY” for a help alert — and a link, never your name, a place or the message. The words are read from Coccu once you open it.
• In a web browser, notifications pass through the push service of your browser's maker — for example Google for Chrome, Mozilla for Firefox, Apple for Safari, Microsoft for Edge. Your browser picks it, not us. A browser gets the same fixed words as the app, never your name, a place or the message, and they are encrypted on their way through, so the service can see that a notification reached your device, and when, but not what it says.

Maps use imagery from OpenStreetMap, but your device never contacts them. The map is fetched by our server, so they cannot see who is looking at a map or where.

Servers and the database are hosted in the Netherlands. Uploaded files and the backup copies of the database are stored in the EU (Cloudflare R2, EU jurisdiction). Both stay inside the European Economic Area. Notifications pass through Google or your browser's maker, which may be outside it.

• A copy of what is held about you. Your organization can produce most of it from the platform. Help alerts, going-out entries, incident photographs and voice notes, and notifications are not in its download, nor is anyone who belongs to no area; your organization can ask us for those.
• Corrections. Most of your own details you can edit yourself, on your profile.
• Deletion. See below — it is worth understanding what it does.
• To object to something being recorded, or to complain to your country's data protection authority.

When your account is deleted, everything personal to it goes: your profile, phone numbers, licences, training certificates, area memberships, help alerts, your going-out entries and the messages about them, and any recorded positions (but a help alert an incident report was written from is kept with the report, its positions included, under a code instead of your name). An entry linked to an incident report keeps its row with the name removed. If you went out with a colleague and the entry was theirs, you are taken off it, and the curfew messages about it that name you are deleted.

Past missions, incidents and inspections are kept, because your organization needs them and may be required by law to keep them. But your name in them is replaced with a code, such as “Former member 4NWX”. The record still reads correctly and still describes what happened; it no longer shows your name.

This is not full anonymity. The records keep their internal numbers, so a copy taken before the deletion — an export, for example — can still link the code back to you. A name somebody typed into a description or comment is not changed. If a colleague has exactly the same name as you, some records are left for your organization to check by hand, so that the wrong person is not renamed.

Backup copies. Once a night a copy of the whole database is made, so the platform can be rebuilt if something breaks. Each copy is locked with a key only Coccu's owner holds, and deleted after 30 days. So anything deleted — your account, or records cleared at the end of the periods above — stays inside those locked copies for up to 30 days, then it is gone. If a copy is ever used to rebuild the platform, every deletion made after that copy is done again.

• The most sensitive fields — phone numbers, incident descriptions, injury detail, security assessments, where you said you were going out to in your own words, where your team said it was in for the night, and the radio room's notes — are encrypted in the database, and stay encrypted inside its backup copies.
• Anyone who can see beyond their own missions, including the radio room, must use two-step sign-in.
• Missions are need-to-know. Full incident reports, including who was hurt, are readable only by security and operations managers and directors; the people on the mission see a short summary.
• Your training certificates are visible only to you.
• Files are never in a public location; they are served only to people entitled to see them, and they are encrypted before they are stored.
• Each area's information is walled off from every other area.

For anything about your own information, ask your organization first — they hold the decisions. For anything about the platform itself, write to admin@coccu.co.