Privacy Policy

1. Who we are

Bokk GP is a discovery directory that helps people find GPs, meaning travelers heading to or from Senegal, and helps GPs list their trips. Bokk GP is operated by Pape Diop, an individual based in Dakar, Senegal, who is the data controller for the information in this policy. Contact: bokkgp@gmail.com.

You must be at least 18 years old to use Bokk GP.

2. Information we collect

Account information. GPs sign in with Google, or with Google or Apple on iOS. The provider shares your name and email address so we can create your account. We store your display name; your email stays with Firebase Authentication to manage sign-in. Senders can optionally sign in to sync saved routes and blocked GPs across devices. An account is never needed to browse or contact a GP. We do not use phone numbers to sign in.

Terms acceptance. For signed-in users, we record which version of the Terms you accepted and when.

GP profile. A GP's public profile includes a business name, short bio, languages spoken, operating cities, a WhatsApp number, an optional second phone number and an optional profile photo. GPs enter their numbers in international format. We check the format but do not verify the number by SMS.

Trips. A trip listing includes origin and destination cities chosen from a list, travel dates, a drop-off deadline, the types of items the GP will carry, optional price and capacity notes, an optional description and up to five photos.

Saved routes and alerts. If you save a route to be notified about matching trips, we store the origin and destination, your language, an optional date range and a push-notification token. If you are not signed in, this is linked to a random id created on your device. If you are signed in, it is linked to your account.

Reports and blocking. When you report a trip or a GP, we store what you reported, the reason, any note you add, and your account id if you are signed in. Blocks are stored on your device, or in your account if you are signed in. The blocked GP is never told.

Abuse-prevention records. To limit spam, we keep short-lived counters of how often an account posts trips or submits reports.

Location. "Near Me" asks your device for your current location, with your permission, to run that one search. We do not store it. Trips are always tied to cities, never to anyone's live location.

Notifications. If you allow notifications, your device receives a push token through Firebase Cloud Messaging so we can alert you about matching trips.

Crash and usage data. In release builds, Firebase Crashlytics reports app crashes and Firebase Analytics shows how the app is used. Advertising-ID collection is turned off.

Device integrity checks. Firebase App Check (Google Play Integrity on Android, Apple App Attest on iOS) confirms requests come from our real app. It does not identify you personally.

3. Why we use it

We use this information to run Bokk GP: showing GP profiles and trips, letting senders contact GPs directly, sending saved-route alerts, reviewing reports, enforcing our Terms, protecting the app from abuse and fixing bugs.

Our legal bases are: performing our agreement with you (providing the service you asked for); your consent (signing in, location and notification permissions, which you can withdraw at any time in your device settings); and our legitimate interest in keeping the app safe, reliable and free of abuse.

4. What we don't do

We do not handle payments. We do not read, store or moderate WhatsApp messages, calls or SMS between senders and GPs; those happen outside the app. We do not sell your personal information. We do not show ads today; if we ever add them, we will update this policy first.

5. Public information

A GP's profile (business name, bio, languages, operating cities, photo, WhatsApp number and optional phone number) and trip listings are public to anyone using the app. GPs agree to this when creating a profile and confirm it again whenever they change their WhatsApp number.

6. Who we share it with

We use Google Firebase to run Bokk GP. It stores and processes our data as our service provider (Firestore, Cloud Storage, Authentication, Cloud Messaging, Cloud Functions, Crashlytics, Analytics and App Check) under Google's data-processing terms. Google and Apple also act as sign-in providers. We share data with authorities only when the law requires it. We do not share it with anyone else.

7. International transfers

Our main database is hosted in Europe. Other Firebase services may process data on Google's global infrastructure. When data leaves your country, Google provides contractual safeguards, such as the European Commission's Standard Contractual Clauses.

8. Data retention and deletion

We keep data only as long as needed:

GP profile and account

Until you delete your account

Trips

Deleted 12 months after the trip is completed, or when you delete the trip or your account

Saved routes and alerts (signed in)

Until you delete them or your account

Saved routes and alerts (not signed in)

Deleted after 12 months without activity, or when you delete them

Reports

3 years, even after an account is deleted, to protect against repeat abuse

Abuse-prevention counters

7 days, and deleted when you delete your account

Crash reports

Up to 90 days, as set by Crashlytics

Usage analytics

Up to 14 months

You can delete all your saved routes and alerts at any time from Settings → Delete my alerts. GPs and signed-in senders can permanently delete their account from Settings → Delete account, or through our account deletion page. Deleting a GP account removes the profile, trips, trip photos and saved routes.

9. Security

We rely on Firebase's security: encrypted connections and access rules that limit who can read or write each piece of data, plus App Check to block requests that don't come from our app. No online service is perfectly secure, but we work to protect your data.

10. Your rights

Depending on where you live, you may have the right to access, correct or delete your data; to restrict or object to how we use it; to receive a copy in a portable format; and to withdraw consent at any time.

You can view, correct and delete most of your data directly in the app. For anything else, email bokkgp@gmail.com and we will reply within 30 days.

You can also complain to a data protection authority: in Senegal, the Commission de Protection des Données Personnelles (CDP); in the EU, the authority where you live (for example the CNIL in France, the Garante in Italy or the AEPD in Spain).

11. Changes to this policy

We may update this Privacy Policy. The date at the top shows the latest version. For material changes, we will tell you in the app.

12. Contact us