Privacy Policy

Lako tells people when a roaming street vendor (pandesal, taho, scrambol, buko) is near, and lets approved vendors share where they are while they sell. This policy explains what the app and this website do with your information. The short version: a customer's spot never leaves the phone, vendors are shown only roughly and only while on route, and there are no ads or analytics.

If you use Lako as a customer

Kept only on your phone: your spot, the radius you watch, the vendors you picked, your usual-time reminders and your mute settings. Android cloud backup is turned off for Lako. Uninstalling the app or clearing its data deletes them.

Location: if you let Lako use your location to set your spot, it is read once on your phone and saved there. Lako does not track you in the background.

How alerts reach you without your location: your phone subscribes to Firebase Cloud Messaging topics for the small areas, about 150 m across, around your spot. When a vendor enters one of those areas, Lako sends one message to that area's topic, and your phone decides whether to alert you. Lako's servers never receive or store your spot or your list of areas. Google, which runs Firebase Cloud Messaging, delivers these messages and handles your phone's messaging token under the Google privacy policy.

Account: the app signs you in anonymously with Firebase Authentication. This creates a random account ID with no name, email or phone number, used only so the app can read the vendor map.

Pabili: when you tap Pabili, the app sends the vendor type and the code of your area, about 150 m across, never your exact spot. Lako adds one to a count for that area, which approved vendors on route can see as "N asked" (above 5 it shows "5+"). The count starts over after 30 minutes. To allow one request per vendor type every 30 minutes, Lako keeps the time of your last request for each type, never a place.

If you use Lako as a vendor

Sign-in and application: vendors sign in with Google. Firebase Authentication keeps the email address, name and profile photo link that Google provides, to sign you in. Your application holds the display name you type, your vendor type, its status (pending, approved, rejected or banned) and when you applied. The developer reads applications to approve them.

Location while on route: location is used only after you press Start route, while the route notification is showing, and stops when you end the route, when a route runs 6 hours, or when a fake GPS app is detected. Lako does not ask for background location.

• What other users see: your display name, vendor type and a position rounded to about 55 m, updated while you move. It disappears when you end your route, and in any case 15 minutes after your last update.
• What the server keeps privately: the exact last point of your current route and a count of today's updates, used only to stop abuse (too many updates, impossible jumps). It is cleared when you end the route and is never shown to anyone.
• No route history is kept.
• Your home zone is kept only on your phone. Inside it, nothing is sent, and entering it takes you off the map at once.

Pabili counts: approved vendors on route can see how many customers asked in nearby areas, as counts per area, never who asked or where they live.

Deleting your vendor account: tap Delete vendor account in the app. It deletes your application, your live position and your sign-in account, and signs you out. Customers can tap Delete my data in Settings to clear everything Lako saved on the phone.

Google services the app uses

• Firebase (Authentication, Cloud Firestore, Cloud Functions, Cloud Messaging), hosted by Google Cloud in Taiwan (asia-east1).
• Firebase App Check with Play Integrity, which checks that requests come from the genuine Lako app on a genuine device. Google receives device and app integrity information to do this.
• Google Maps, which draws the map. Google receives the map areas your phone loads.

These services are provided by Google under the Google privacy policy. Lako's own server logs do not record coordinates.

Notifications and sounds

Lako asks for notification permission to play each vendor's sound when one is near and at your reminder times. Reminders are scheduled on your phone. The vendor sounds are built into the app.

This website

lako.riecodes.com is a plain website with no forms, no cookies, no advertising and no tracking scripts. The sound samples play only when you tap them. The Facebook link opens Facebook, which handles your visit under its own policy.

What Lako does not do

• No storing of customer locations on a server.
• No advertising and no ad identifiers.
• No analytics, tracking or crash reporting of its own.
• No selling or sharing of personal information.

Children

Lako is not directed at children under 13 and does not knowingly collect information from them.

Changes

If this policy changes, the new version is posted on this page with a new effective date.

Contact

Questions, or to have your information removed: riecodes.collab@gmail.com