I'm Okay ("the app", "we", "us") is a safety app for migrant workers and their family and friends. It is published by Creative Media by ST (contact: hello@creativemediabyst.fi). This policy explains what data the app handles, why, who it is shared with, and how you can delete it.
We have tried to keep the app's data footprint as small as possible: there are no user accounts, no email or phone number, no real name, and no advertising or analytics tracking of any kind.
1 Who this app is for
I'm Okay is intended for adults (18+) — migrant workers abroad and the family members and friends they choose to stay connected with. It is not directed to children.
2 How pairing works (and why there is no account)
You choose a role — Worker or Family/Friend — during setup.
- A Worker's device generates a random 6-digit room code.
- The Worker shares that code with people they trust, out of band (e.g. by message).
- A Family member or Friend enters the code, chooses a display name, and sends a join request. Nobody is connected until the Worker accepts it.
Your device signs in anonymously to our backend. This creates a random, per-device identifier with no personal information attached. It exists only so the backend can tell your device apart from other devices and enforce that you can only see your own room and chats.
3 What data the app processes
Data you provide or generate
| Data | Purpose | Where it is stored |
|---|---|---|
| Home country, work country, app language | Show the right information and language | Backend (see §5) |
| Display name / label you type for a contact | Identify people in your chat list | Backend |
| Daily check-in status (OK / no check-in / SOS) and time | Let your family know you are safe | Backend |
| Approximate location (Worker only, opt-in) | When you turn on "Share Location", your device works out your city and shares that with your paired family. Precise coordinates are used briefly to determine the city and are not shown to anyone. | Backend |
| Chat messages (text) | Private 1-to-1 messaging with each paired contact | Backend |
| Chat photos and voice notes | Sharing in chat | Backend file storage; auto-deleted after the time you pick (6, 12 or 24 hours) |
| Optional check-in selfie | Reassure family | Backend file storage; auto-deleted after 24 hours |
| Text you enter in the Translator | Translation | Sent to Microsoft Azure AI Translator (see §6); not stored by us |
| Voice you record for the Translator's microphone input | Speech-to-text | Processed by your device's speech recognition service (see §6); not stored by us |
| Abuse reports (reason, optional note) | Keeping the service safe | Backend; kept for up to 24 months for review |
Data collected automatically
| Data | Purpose |
|---|---|
| Anonymous device identifier | Tell your device apart; enforce access control |
| Push notification token | Deliver SOS and missed-check-in alerts to your device |
| Approximate coordinates sent to a map service only when you open "Home away from home" | Find nearby South-Asian shops, restaurants and money-transfer points (see §6) |
| IP address | Standard part of any internet request; seen by our backend and by third-party services when the app talks to them (e.g. streaming a radio station) |
What the app does not collect
Email address, phone number, real name, date of birth, government ID, payment information, your device's contacts, calendar, SMS, call logs or browsing history. No advertising ID. No analytics or tracking SDKs. We do not sell your data and we do not use it for advertising.
4 Device permissions
| Permission | Why | Optional? |
|---|---|---|
| Location (while using the app) | Only used when a Worker turns on "Share Location", to determine your city | Yes — the feature is off by default |
| Camera | Take a check-in selfie or a chat photo | Yes — only when you tap the camera |
| Microphone | Record a voice note in chat, or use voice input in the Translator | Yes — only when you tap the mic |
| Notifications | Show SOS and missed-check-in alerts | Recommended for the app's core purpose |
The app does not request background location, contacts, SMS, or phone permissions.
5 Where your data is stored
Backend services are provided by Supabase Inc. and hosted in the European Union (AWS, Frankfurt). Data is encrypted in transit (HTTPS/TLS).
Access is enforced by database Row-Level Security: your device can only read or write its own room and chat threads. The key that ships inside the app cannot, on its own, read anyone's data.
6 Third parties your data may reach
We use a small number of service providers ("sub-processors"). We do not sell data to anyone.
| Service | What is shared | Why |
|---|---|---|
| Supabase Inc. | All app data listed in §3 | Database, file storage, anonymous sign-in, real-time sync |
| Expo (650 Industries, Inc.) | Your push token; the alert title/body | Routes push notifications to your device |
| Google Firebase Cloud Messaging | Your push token; the alert message | Delivers push notifications on Android |
| Apple Push Notification service | Your push token; the alert message | Delivers push notifications on iOS |
| Microsoft Azure AI Translator (EU region) | The text you type into the Translator | Machine translation. Microsoft states it does not retain this text. |
| Your device's speech recognition service (e.g. Google on Android) | Audio you record for Translator voice input | Convert speech to text. Governed by your device maker's and OS speech-service privacy terms. |
| OpenStreetMap Foundation / Overpass API | Your approximate coordinates, only when you open "Home away from home" | Look up nearby shops/restaurants/remittance points |
| Google Maps | A place name or coordinates when you tap "Get directions" | Opens Google Maps for directions. Governed by Google's privacy policy. |
| Third-party radio broadcasters | A normal media request (your IP address) when you play a station | Stream the audio you chose. No app data is sent. |
7 How long we keep data
- Chat photos & voice notes: deleted automatically after the sender's chosen window (6, 12 or 24 hours).
- Check-in selfies: deleted automatically after 24 hours.
- Text messages, room and connection records: kept until you delete them (see §8), or until we remove a room that has had no activity for 12 months.
- Abuse reports: up to 24 months.
- Anonymous sign-in identifiers: removed after 30 days with no active pairing.
8 Deleting your data
- Unpair (in the bottom menu) is the deletion control.
- If you are the Worker, unpairing deletes your entire room — every connection and every message in it, on every paired device.
- If you are a Family/Friend contact, unpairing deletes your connection and your chat thread.
- Delete a single chat from the chat's menu.
- A Worker can Remove or Block any one contact, which deletes that connection and its messages.
- You can also email hello@creativemediabyst.fi to request deletion of any data associated with your device or room code.
9 Children
The app is not intended for anyone under 18 and we do not knowingly collect data from children. If you believe a child has used the app, contact us and we will delete the associated data.
10 Security
Data is encrypted in transit. Access is restricted per device by database Row-Level Security. Chat media and selfies are short-lived by design. No system is perfectly secure; if we become aware of a breach affecting your data we will act promptly and notify affected users where required by law.
11 Changes to this policy
If we change this policy we will update the date at the top and, for significant changes, show a notice in the app.
12 Contact
Creative Media by ST
Email: hello@creativemediabyst.fi