User Privacy Policy

1. Personal Data the App Collects

1.1 Identity & Account Data
  • Phone number (used as unique identifier, collected via OTP)
  • First name — stored in User.firstName, collected at registration (DetailsInput screen)
  • Last name — stored in User.lastName, collected at registration (DetailsInput screen)
  • Email address (optional)
  • Rider code (4-digit OTP for drivers, auto-generated)
1.2 Location Data
  • - Real-time GPS coordinates — held in app state (app-slice.ts) via watchPosition, continuously tracked while app is open (enableHighAccuracy: true, 5s interval, 1m distance filter)
  • - Ride pickup coordinates — stored in Ride.pickupLatitude, Ride.pickupLongitude, stored per ride
  • - Ride dropoff coordinates — stored in Ride.dropoffLatitude, Ride.dropoffLongitude, stored per ride
  • - Pickup/dropoff addresses — stored in Ride.pickupAddress, Ride.dropoffAddress, human-readable text
  • F- Real-time ride tracking — stored in RideTracking.latitude, RideTracking.longitude, RideTracking.speed, logged during active rides with timestamps
  • - Favourite locations (label, address, lat/lng) — stored in RiderProfile.favoriteLocations (JSON), usersaved places like Home, Work, etc.
1.3 Device & Notification Data
  • Firebase Cloud Messaging (FCM) token for push notifications
  • Device and app diagnostic data
1.4 Financial & Transaction Data
  • - UPI ID (optional) — stored in PaymentMethodModel.upiId, payment method on file
  • - Wallet provider (optional) — stored in PaymentMethodModel.walletProvider, payment method on file
  • - Payment method type — stored in PaymentMethodModel.type (CASH / WALLET / UPI), selected per ride
  • - Transaction amounts — stored in Transaction.amount, ride payments and refunds
  • - Cashfree order/payment IDs — stored in Transaction.paymentGatewayId, Transaction.gatewayPaymentId, external payment gateway references
  • - Fare estimates & final fares — stored in Ride.estimatedFare, Ride.finalFare, per ride
1.5 Emergency & Safety Data
  • - SOS contact number — stored in RiderProfile.sosContact, user-entered emergency contact
  • - SOS message — stored in RiderProfile.sosMessage, custom emergency message
  • - Emergency contacts — stored in EmergencyContact.name, .phoneNumber, .relationship
1.6 Support, Feedback & Survey Data
  • - Support ticket content — stored in SupportTicket.subject, .description, .category, user-submitted tickets
  • - Ride ratings — stored in Rating.rating (1-5), Rating.comment, post-ride feedback
1.7 Survey Data

- Survey responses — stored in SurveyResponse, SurveyAnswer, answers to company-sponsored surveys shown during rides - Answer text/rating/options — stored in SurveyAnswer.answerText, .answerOptions, .answerRating, linked to ride ID

1.8 Crashlytics / Diagnostics

- Phone number as Crashlytics user ID — in app-slice.ts, crashlytics().setUserId(state.user.phoneNumber) is called, which sends the phone number to Firebase Crashlytics

2. ANDROID PERMISSIONS REQUESTED

  • - INTERNET — network access for API calls, WebSocket, maps
  • - ACCESS_FINE_LOCATION — high-accuracy GPS for ride pickup/dropoff, live tracking
  • - ACCESS_COARSE_LOCATION — approximate location (fallback)
  • - ACCESS_BACKGROUND_LOCATION - location tracking when app is backgrounded (ride in progress)
  • - POST_NOTIFICATIONS - Firebase push notifications (ride updates, alerts)

3. THIRD-PARTY SDKs USED

  • - Firebase Messaging (@react-native-firebase/messaging) — push notifications — sends FCM token, device identity
  • - Firebase Crashlytics (@react-native-firebase/crashlytics) — crash reporting — sends crash logs, phone number (as userId), device info
  • - Firebase App (@react-native-firebase/app) — Firebase core — sends project config
  • - MSG91 SendOTP (@msg91comm/sendotp-react-native) — OTP-based phone auth — sends phone number
  • - Google Maps (react-native-maps) — map rendering — sends user's viewport/coordinates
  • - Google Places Autocomplete (react-native-google-places-autocomplete) — address search — sends search queries, coordinates
  • - Google Maps Directions (react-native-maps-directions) — route rendering — sends pickup/dropoff coordinates
  • - React Native Geolocation (@react-native-community/geolocation) — GPS access — sends latitude, longitude, speed
  • - React Native NetInfo (@react-native-community/netinfo) — connectivity detection — sends network state (no PII)
  • - React Native Keychain (react-native-keychain) — secure token storage — JWT tokens stored locally on device
  • - Socket.IO Client (socket.io-client) — real-time ride events — sends auth token, ride events
  • - Axios (axios) — HTTP client — sends API requests with auth headers

4. DATA RETENTION

Data is retained in the database until the user explicitly requests deletion. There are no automated scheduled purges or TTLs on database records.

Account Deletion:
  • - Users can delete all their data via DELETE /api/account/delete-account endpoint
  • - A web-based deletion page is available at https://trucostrides.com/account/delete-data where users can enter their phone number, verify via OTP, and delete their account
  • - Upon deletion, the following data is permanently removed in a single transaction:
  • - User account (User record, including phone number, name, email, FCM token)
  • - Rider profile (RiderProfile, including favourite locations, SOS contact/message)
  • - All rides (pickup/dropoff coordinates, addresses, fares, timestamps)
  • - All ride tracking records (GPS breadcrumbs with speed)
  • - All transactions and payment methods
  • - All ratings given and received
  • - All promo redemptions
  • - All survey responses linked to the user's rides
  • - All support tickets
  • - Emergency contacts
  • - Driver profile, vehicle, documents, and devices (if applicable, via cascade

5. DATA SHARED WITH SERVICE PROVIDERS

  • - MSG91 (msg91.com) — shares phone number, OTP delivery status — purpose: SMS OTP authentication — retention: per MSG91's privacy policy
  • - Cashfree (cashfree.com) — shares customer ID (internal), phone number, order amount (INR) — purpose: UPI payment processing & QR generation — retention: per Cashfree's T&C / RBI guidelines
  • - Firebase / Google — shares FCM tokens, phone number (as Crashlytics userId), crash stack traces, device metadata — purpose: push notifications + crash analytics — retention: per Google Firebase privacy policy
  • - Google Maps Platform — shares pickup/dropoff coordinates, search queries, distance matrix lookups — purpose: geocoding, routing, place search, distance calculations — retention: per Google Cloud privacy terms

All service providers process data according to their own privacy policies and applicable laws.