Anonymous by design
BantayJuan is the citizen-reporting experience powered by the Pantepoptes response platform and operated by SBB Innovations for participating cities. BantayJuan does not ask for or store your name, phone number, email address, user account, contacts, or advertising identifier as part of an incident report. A report is identified by a private tracking secret rather than by a citizen identity. A random installation identifier is stored on the device and the service retains only its hash for spam and nuisance-report prevention; it is not an advertising identifier and is not used to identify the reporter.
Anonymous reporting does not guarantee that the content itself is anonymous. A face, voice, vehicle plate, home address, written description, or precise location may identify a person. Capture only what is necessary for the incident and do not include personal information unless it is essential to public safety.
Information you choose to provide
- A new photo or video captured inside the app as incident evidence.
- An optional written description of the incident.
- Precise location only when you grant location permission and choose to include it, or a city selected manually.
- A private tracking secret used only when you ask for a public-safe report update.
- For an SOS alert, the emergency type you select, an optional note, and a fresh precise GPS location captured when you confirm sending.
The app blocks selection of existing device photos and videos. It does not use advertising or third-party advertising analytics SDKs.
Internet infrastructure may temporarily process technical connection information, such as an IP address, to deliver and secure the service. Pantepoptes does not attach this information to the public tracking record or use it to build a citizen profile.
How report data is used
Report data is used to validate evidence, identify the responsible service category, route the incident to the selected city's authorized operations team or agency, coordinate a response, prevent abuse, and provide a limited tracking update. A confirmed SOS is marked critical and enters the emergency operations queue with its selected emergency type, optional note, and GPS point for operator verification; it does not automatically dispatch a responder or place a telephone call. Pantepoptes does not sell citizen report data.
Optional hotline calls
BantayJuan offers a Call 911 button for the Philippine emergency hotline. When a participating city publishes an active hotline, the app may also offer a city hotline button. These buttons open your device's phone dialer after your confirmation. You may choose to request GPS before opening the 911 dialer or call immediately without it. When the 911 dialer opens, Pantepoptes attempts to record the time, selected city, and your precise location if you chose GPS and a fresh position was available. This unverified app activity is retained for up to 30 days. The record does not confirm that a call connected and is kept separate from emergency incident records. BantayJuan does not transmit its recorded coordinates to the 911 operator through this feature, and does not access your call history, contacts, or microphone.
A phone call is separate from an anonymous incident report and is not automatically linked to one. Your carrier and the receiving hotline may receive your caller ID, phone number, call time, and ordinary call-routing information. If a city connects its hotline to Pantepoptes, authorized operators may retain those call details with the operational incident record under the city's call-handling and retention policy.
Optional city advisory alerts
Anyone may view active same-day city advisories on the BantayJuan app or website without enabling notifications. If you separately enable quiet city-entry alerts in the mobile app, the device uses background geofencing to detect entry into a participating city. Geofence monitoring is performed by the device; Pantepoptes stores the currently subscribed city, an app-generated installation identifier, and a push-notification token, but does not receive continuous advisory-location coordinates or build a travel history. The same token may deliver an administrative notice when a city temporarily restricts incident submissions from that installation; the notice includes the city, reason, and automatic unblock date.
The city dashboard records aggregate delivery stages: queued, accepted by the notification gateway, received by the app when the operating system allows the app to report it, and opened. These stages are associated with the anonymous app installation, not a name, email address, phone number, advertising identifier, or citizen account. Gateway acceptance does not prove that a person saw the advisory. Advisories are quiet by default, are de-duplicated to one notification per advisory per installation, and expire at the issuing city's midnight.
Who can access a report
Access is restricted to authorized city administrators, assigned agencies, and named response personnel who need the information to handle the incident. Administrative access, evidence viewing, assignment, and status changes are auditable. Public tracking does not expose exact GPS coordinates, internal notes, personnel details, or unrestricted evidence.
Service providers
SBB Innovations and participating organizations use contracted infrastructure providers only to operate Pantepoptes. This includes DigitalOcean infrastructure and DigitalOcean Spaces for encrypted evidence object storage, as well as hosting, email-delivery, mapping or geocoding, malware-scanning, and monitoring providers where configured.
These providers process information on behalf of SBB Innovations or the participating organization under their service terms. Report data is not sold, rented, or shared for behavioral advertising.
Security and retention
Production traffic is encrypted in transit. Evidence is stored in protected object storage or a controlled server fallback and is accessed through short-lived signed links. Evidence metadata is inspected, and embedded device or GPS metadata is removed when supported. Role-based access controls and audit logs protect operational access.
Evidence, incident coordinates, audit records, and operational records are retained only as long as required by the participating city's response, safety, legal, and public-record policy. Authorized administrators may archive nuisance submissions for a defined number of days, after which they are deleted. Expired data is also removed from operational storage through scheduled retention processes; protected backups expire through their own controlled lifecycle.
Keep your private tracking secret confidential. Anyone who possesses it may be able to view the limited tracking status.
Your choices
You may deny location permission and select the incident city manually. You may view the public advisory map without enabling alerts, and you may turn advisory alerts off in the app at any time. You may leave the report description blank and submit only live camera evidence. To ask about access, retention, archiving, or deletion, contact the participating city or SBB Innovations and provide only the private tracking secret—never personal details you do not wish to disclose. Legal or public-record requirements may limit deletion.
Children and emergencies
BantayJuan is not designed to create accounts or profiles for children. It is not a replacement for emergency services. If there is an immediate threat to life or safety, contact the local emergency number.
Policy changes
Material changes will be posted on this page with a revised effective date. A participating city may also publish additional retention or public-record notices that apply within its jurisdiction.
Operator and contact
SBB Innovations
Pantepoptes privacy and support
admin@pantepoptes.com
For a city-specific incident request, contact the participating city first. Do not email incident evidence or unnecessary personal information.