Privacy Policy

Last updated: August 2026  ·  Effective: August 2026

This Privacy Policy explains how Ride In Sync ("we", "us", or "our") collects, uses, and protects information when you use our mobile application and website (collectively, the "Service").

1. Information We Collect

We collect only the data necessary to provide the core ride-sharing features:

• Account information — your email address and display name, collected when you register. Passwords are stored as a bcrypt hash and are never stored in plain text.
• Location data — real-time GPS coordinates while a ride session is active, streamed to the other participants in your session. Alongside the live stream we also record a breadcrumb trail of the ride on our servers — coordinates, heading, speed, accuracy, and timestamp — which is what powers your ride history and summary, and lets us alert the group when a rider drifts off the planned route. Breadcrumbs are recorded only while a ride is active, never in between rides.
• Push notification token — a Firebase Cloud Messaging (FCM) device token used to deliver ride invites, break signals, and ride-end alerts to your device.
• Authentication tokens — JWT access and refresh tokens stored in encrypted secure storage on your device to keep you signed in between sessions.
• Camera (QR scanning) — camera access is used exclusively to scan a ride session QR code. No image or video is stored or transmitted; scanning happens entirely on-device.
• Push-to-talk voice clips — short voice messages you record during an active ride are relayed live to your ride group and nothing more. Clips are never saved, never written to our database, and cannot be replayed or downloaded by anyone, including us. Once a clip has been broadcast it is gone.
• Ride session data — session codes and participant lists, retained only while a session is active and cleaned up after the ride ends.
• Usage analytics — anonymous, aggregated data about how the app and website are used, so we can see which features people actually rely on. This is described in detail in section 4 below. Analytics never includes your GPS coordinates, your voice clips, your email, or your display name.

2. Device Permissions

• Location (fine & coarse) — precise GPS coordinates shared with your ride group in real time during an active session.
• Background location — continues sharing your position when the app is in the background so your group is never left without your location mid-ride.
• Camera — used only to scan QR codes to join a ride session. No images are captured, stored, or transmitted.
• Microphone — used only while you hold the push-to-talk button to record a short voice message for your ride group. Recording never happens in the background, and the clip is broadcast once and never stored.
• Notifications — for ride invitations, break requests, and ride-end alerts via Firebase Cloud Messaging.
• Internet — required for authentication, real-time location sharing via WebSocket, and push notifications.

3. How We Use Your Information

• To authenticate your account and maintain secure sessions.
• To provide real-time location sharing within your ride group during an active session.
• To relay push-to-talk voice messages between members of an active ride, in real time only.
• To send push notifications for ride coordination (invites, breaks, ride end).
• To support email verification and password reset flows.
• To record your ride history and generate the summary you see after a ride ends.
• To understand, in aggregate, which features are used and where the experience breaks down, so we can improve the app.

We do not use your data for advertising, ad targeting, or profiling, and we do not sell your data to any third party. We do use a limited amount of product analytics, described below — it tells us that a feature was used, never who you are or where you were.

4. Third-Party Services

• Firebase Cloud Messaging (Google) — used to deliver push notifications. Your device token is sent to FCM to route notifications. See the Firebase Privacy Policy.
• OpenStreetMap — map tiles displayed in-app are fetched from OpenStreetMap tile servers. No personally identifiable data is sent. See the OSM Privacy Policy.
• Google Analytics / Firebase Analytics (Google) — product analytics for the mobile app and this website. See the Firebase Privacy Policy and Google Privacy Policy.

We include no advertising SDKs, no ad networks, and no data brokers. The only tracking technology in the Service is the product analytics described here.

What the mobile app sends to analytics

The app records a small, fixed set of events. Each one is a bare signal that something happened:

• Account events — sign_up and login, tagged with the method used (password, Google, or Apple).
• Ride events — trip_created (with a yes/no flag for whether a destination was set), trip_joined, and ride_started.
• In-ride feature events — ride_signal_received, voice_message_sent (with clip length in milliseconds), voice_message_received, voice_permission_denied, and gap_alert (with the distance in metres by which the group had spread out).
• Screen views — the name of each screen you open, so we can see where people get stuck.
• Automatic device data collected by Google — app version, device model, operating system version, and an approximate region derived from your IP address.

Events are tied to your account using your internal Ride In Sync user ID — a random identifier that carries no personal information. It is cleared the moment you log out or delete your account. We never attach your email, display name, GPS coordinates, voice audio, or ride destinations to an analytics event.

Website cookies

This website loads Google Analytics only after you explicitly accept via the cookie banner. If you accept, a single Google Analytics cookie records page views, referring site, browser, and an approximate region from your IP. If you decline — or simply ignore the banner — no analytics cookie is set and no analytics script is ever loaded. You can change your choice at any time by clearing this site's data in your browser, which brings the banner back. The website sets no advertising cookies of any kind.

5. Data Sharing

Your data is shared only in these limited circumstances:

• Within your ride session — your display name and real-time GPS coordinates are visible to other participants in the same session you have joined or created.
• Service providers — Google receives push notification tokens (to deliver notifications) and analytics events (to produce usage reports) strictly as a processor acting on our instructions.
• Legal requirements — if required by law, court order, or to protect the rights and safety of users.

We never sell, rent, or share your data with advertisers or marketing companies.

6. Data Retention

• Account data (email, display name) — retained while your account is active.
• Live GPS position — the position shared with your group in real time is held in temporary memory only and is discarded when the ride ends.
• Ride breadcrumb trail — the recorded track of a ride is stored with that ride and kept for as long as your account exists, so your ride history stays available to you. Deleting your account deletes every breadcrumb along with it.
• Push-to-talk voice clips — never persisted. Broadcast once to your ride group and discarded; there is nothing left to retain.
• Ride session data — retained only while the session is active and cleaned up after the ride ends.
• FCM tokens — updated on login and removed when you log out or delete your account.
• Analytics data — held by Google under the retention window configured on our analytics property, after which Google deletes the user-level records automatically. Aggregate counts (for example, "how many rides were started last month") may be kept indefinitely, as they cannot be traced back to an individual.

Account Deletion

You can permanently delete your account from within the app at any time. Deletion is immediate and irreversible — we do not keep a copy, an archive, or a "deactivated" shadow record. Every row tied to your account is removed along with it: your profile and email, your login credentials and any linked Google or Apple sign-in, your rides and ride memberships, your ride history and summaries, your stored location breadcrumbs, your notifications, and your push notification token. If you would rather we do it for you, email teamrideinsync@gmail.com from your registered address.

7. Security

We take the security of your data seriously. Passwords are hashed using bcrypt. Authentication uses short-lived JWT access tokens paired with refresh tokens, stored in device-level encrypted secure storage. All network communication uses HTTPS and encrypted WebSocket (WSS). QR code scanning happens entirely on-device — no camera frames are ever transmitted.

8. Children's Privacy

The Service is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided personal data, please contact us and we will delete it promptly.

9. Your Rights

Depending on your jurisdiction, you may have rights to access, correct, or delete your personal data, or to withdraw consent for specific data processing (e.g. revoking location or camera permission via device settings). Contact us at teamrideinsync@gmail.com to exercise these rights.

For analytics specifically: on this website you control it directly through the cookie banner. In the mobile app, deleting your account removes your analytics identifier and your ride data; if you would like your analytics records erased without deleting your account, email us and we will action it.

10. Changes to This Policy

We may update this policy from time to time. We will update the "Last updated" date above and, where appropriate, notify users via the app or email. Continued use of the Service after changes constitutes acceptance.

11. Contact

Questions about this policy? Reach us at teamrideinsync@gmail.com.