Privacy Policy

Draft — published for the invite-only beta; this text may change.

Draft. This text is a draft awaiting legal review and may change before it takes effect. No date is shown on this page yet; one will be added when the text is published.

1. Who is responsible for your data

knowyourRide is run by Shubhankar Kalra, an individual based in India. He decides why and how your personal data is processed, and is the data fiduciary under India's Digital Personal Data Protection Act, 2023. This policy covers the knowyourRide app and the pages at /account/delete and /legal/*.

Questions and complaints go to the address on our grievance redressal page (/legal/grievance). It carries the deadlines we answer to: acknowledgement within 72 hours, a decision within 7 days, and closure within 30 days.

2. The short version

• We never store your mobile number. Google's sign-in service holds it so it can send you a code. We keep only a one-way fingerprint of it.
• We never ask for your name, email, location or contacts, and the app has no access to your location, contacts or microphone.
• Other users see a generated pseudonym, never who you are.
• Screenshots you import are read on your phone. An image leaves your phone only if you attach it as evidence, and every attached image is redacted before any person sees it.
• We do not sell your data.
• You can export your data and delete your account from the app, and delete your account without the app at /account/delete.

3. What we collect, and why

4. What stays on your phone

• Reading a screenshot or receipt (to fill in the registration number, platform and date) happens on your phone. Neither the image nor the text is sent to us for that step.
• Recent screenshots are shown to you only if you turn that on, and are read on your phone.
• Camera and photos are used only when you choose to take or pick an image. When you attach one, its location and camera data are removed before upload.
• The app does not request your location, your contacts or your microphone.

5. What other users can see

All of it requires signing in.

• Your reviews: your pseudonym, the month of the ride (never the day), your ratings, your text and its votes.
• Your pseudonym on the helpfulness leaderboard, unless you opt out in Settings.
• Nothing else. Not your number, your year of birth, your searches, your evidence, your reports, your blocks or your subscription.

6. People who are not users: drivers and vehicle owners

A review is about a vehicle, and through it about the person driving it. For that we process:

• the vehicle's registration number, make, model and colour;
• a driver's first name, where it is linked to a vehicle, and where it appears on redacted evidence (it is the one name our redaction keeps, because it is what shows the evidence belongs to the ride).

We never publish a driver's surname, phone number or photo, and our redaction removes faces. If something on knowyourRide concerns you, write to us through grievance redressal (§1).

7. Who we share data with

We do not sell personal data, and we share it only with the services that run knowyourRide for us:

Text that goes to Anthropic leaves India for the United States. A person on our staff reads each suggestion and takes every decision themselves: nothing Anthropic returns approves, removes, holds, suspends or bans anything on its own.

We may also disclose data where Indian law requires it.

8. Advertising

• KYR Plus members: the ad service is never started, so it receives nothing.
• Free version: we use Google Mobile Ads. Even when ads are not personalised, Google's own disclosure says its SDK collects your IP address (which it may use to estimate your general location), a device identifier, the ads you were shown and how you interacted with them, and performance and crash data. It uses these for ad delivery, frequency limits, measurement and preventing invalid ad activity.
• Ads are not personalised unless every one of these is true: you have declared a year of birth; you have completed the consent form Google shows where it is required, and not refused personalisation in it; and, on iPhone, you have allowed tracking in Apple's prompt. If any one of these is missing, ads are non-personalised.
• The ad service starts only after the consent step has finished.
• We never give Google your knowyourRide account identifier.

9. How long we keep it

10. Your rights, and how to use them

• See and take your data. Exporting from Settings gives you a file of your pseudonym, year of birth, search history, your reviews (with their full ride dates), details of your evidence, your consent records and your subscription. It does not yet include your votes, reports, blocks, watchlist, notifications, devices or levels. Ask through grievance redressal for those.
• Correct it. You can get a new pseudonym in the app. To correct anything else, such as your year of birth, write to us through grievance redressal.
• Clear your search history from the app at any time.
• Delete your account, in the app or at /account/delete. Deletion waits 7 days, and you can cancel it in that time. When it runs:
  • deleted: your sign-in at Google, your mobile-number fingerprint (unless you are banned, see below), your year of birth, your devices and push tokens, search history, watchlist, notification settings, subscription record and the feedback you sent from the app;
  • kept, but no longer tied to a phone number or a sign-in: your reviews, which stay published under a removed pseudonym, with their evidence; your votes, reports and blocks; the notifications we sent you; your levels, badges and cosmetics; your trust and abuse signals; and your earlier pseudonyms;
  • kept as a legal record: your consent records;
  • kept for as long as a ban stands: if we banned your account, the fingerprints of your mobile number and of your devices, and the reason. We keep them after your account is deleted so that a banned person cannot return by deleting the account and signing up again, and we delete them when the ban is lifted. They are fingerprints, not the number or the identifier themselves.
  • If you want a review gone, remove it before deleting your account.
• Withdraw consent. Each type of notification can be turned off in Settings → Notifications, or all of them in your phone's settings. On iPhone, ads are personalised only if you allow tracking, and you can revoke that at any time in iOS Settings. On Android, Settings → Consent & data has an "Ad preferences" row that opens Google's own ad-consent form, where you can withdraw personalisation.
• Complain through grievance redressal (§1). If you are not satisfied with our answer, you may complain to the Data Protection Board of India.

11. Children

knowyourRide is for people aged 13 and over. We ask for a year of birth before a phone number is entered. If it is under our minimum age, no account is created and nothing is kept, not even the year you entered. An account with no year of birth recorded never receives personalised ads.

12. Keeping it safe

• Evidence originals sit in storage that is never served to anyone. Only the redacted copy is ever shown, and only to you and our moderators.
• Your mobile number is never stored in our database.
• Crash reports are scrubbed on your phone before they are sent.
• If a breach affects your personal data, we will tell you without delay, and report it to the Data Protection Board within 72 hours.

13. The web pages

• /legal/* pages run no scripts and set no cookies.
• /account/delete signs you in with the same one-time code as the app. It loads Google's Firebase sign-in code and Google's reCAPTCHA, which may store data in your browser under Google's own policy.

14. Changes to this policy

When this policy changes, the app shows a notice in Settings asking you to accept the new version, and we record which version you accepted.