Privacy Policy
Contents
1. Introduction 2. Information we collect 3. How we use your information 4. How we share information 5. Data retention 6. Your rights 7. How to delete your account 8. Security 9. Children's privacy 10. International data transfers 11. Changes to this policy 12. Contact us1. Introduction
RideConnect ("we", "us", "our") operates the RideConnect mobile application and related services (the "Service"). This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and the rights you have over your data.
By creating an account or using the Service, you agree to the practices described here. If you do not agree, please do not use the Service.
2. Information we collect
2.1 Information you provide
- Account details: name, mobile phone number (in E.164 format), and email address.
- Authentication credentials: a 4-digit PIN you set during registration (stored only as a salted hash, never in plain text).
- Profile information: profile photo, bike details (make, model, year), and any other information you choose to add to your garage or profile.
- User-generated content: posts, comments, polls, photos and videos, ride plans, RSVPs, community messages, and reports you submit.
2.2 Information collected automatically
- Device and push-notification tokens: when you enable notifications, we receive a token from Apple Push Notification service or Firebase Cloud Messaging that lets us deliver alerts to your device.
- Approximate location: when you use the ride planner or view nearby events, your device sends location coordinates to our maps provider (Google Maps) to render routes and points of interest. We do not continuously track your location in the background.
- Log data: IP address, request timestamps, device type, OS version, and crash diagnostics — used to operate, debug, and secure the Service.
2.3 Information from third parties
We do not buy or import personal information from data brokers. The only third-party data we receive is the OTP delivery confirmation from our email provider (MSG91) and push-token registration responses from Apple/Firebase.
2.4 Tracking
RideConnect does not track you across other companies' apps or websites. We do not use third-party advertising SDKs, behavioural-advertising identifiers, or cross-app tracking technologies. Accordingly, the iOS App Tracking Transparency permission prompt is not shown.
3. How we use your information
We use your information to:
- Create and authenticate your account (PIN verification, OTPs sent to your registered email).
- Operate core features — communities, feed, ride planner, RSVPs, events, garage, and messaging.
- Send you transactional emails (OTPs, password resets, account-related notifications) and in-app or push notifications about activity relevant to you.
- Render maps, routes, and location-based content using Google Maps.
- Detect, prevent, and respond to fraud, abuse, security incidents, and violations of our terms (this includes the soft-lockout mechanism after repeated failed PIN attempts).
- Improve the Service, analyse usage in aggregate, and fix bugs.
- Comply with legal obligations and enforce our rights.
We do not use your data for behavioural advertising and we do not sell your personal information.
5. Data retention
We keep your account information for as long as your account is active. When you delete your account, we remove your profile, posts, comments, photos, garage entries, ride plans, and PIN hash within 30 days, except where we are legally required to keep certain records (for example, transaction or abuse logs for fraud prevention) or where information has been anonymised so it can no longer be linked to you.
Residual copies of your data may persist in encrypted backups until those backups are rotated out by our cloud provider's normal lifecycle, after which they are irretrievable.
6. Your rights
Subject to applicable law (including India's Digital Personal Data Protection Act, 2023, and the GDPR where it applies), you have the right to:
- Access the personal information we hold about you.
- Correct information that is inaccurate or incomplete — most fields are editable directly inside the app.
- Delete your account and associated data (see section 7).
- Object to or restrict certain types of processing.
- Withdraw consent at any time, where processing is based on consent.
- Lodge a complaint with your data-protection authority.
To exercise any of these rights, email us at support@rideconnect.in from your registered email address.
7. How to delete your account
To permanently delete your RideConnect account, email support@rideconnect.in from the email address registered to your account, with the subject "Delete my account". So we can verify it's really you, please send the request from your registered email; if that's no longer accessible, include enough detail (registered phone number, approximate sign-up date) for us to confirm your identity.
Once we receive and verify your request, we acknowledge it within 7 days and complete deletion within 30 days. After deletion, your profile, posts, comments, photos, polls, garage entries, ride plans, RSVPs, community memberships, push tokens, and PIN hash are permanently removed from our active systems. Anonymised aggregate analytics that cannot be linked back to you may be retained.
8. Security
We protect your data with industry-standard measures, including:
- TLS encryption for all data in transit between the app and our servers.
- Bcrypt password-hashing (12 salt rounds) for PINs — we never store or transmit your PIN in plain text.
- A temporary account lockout after 5 incorrect PIN attempts to mitigate brute-force attacks.
- JWT-based session tokens with separate, refreshable refresh tokens.
- Role-based access control on administrative functions.
- Access controls and encryption features provided by our cloud infrastructure provider (AWS).
No system is perfectly secure, but we work continuously to reduce risk and respond quickly to incidents. If you believe your account has been compromised, contact us immediately at support@rideconnect.in.
9. Children's privacy
RideConnect is intended for adult riders. The Service is not directed to children, and we do not knowingly collect personal information from anyone under the age of 18. Under India's Digital Personal Data Protection Act, 2023, a "child" is any person under 18, and processing a child's personal data requires verifiable parental consent — which we do not currently solicit because the Service is not designed for minors.
If you are a parent or guardian and believe a person under 18 has created a RideConnect account, please email support@rideconnect.in and we will close the account and delete the associated data promptly.
10. International data transfers
RideConnect is operated from India and our primary infrastructure is hosted in the AWS Asia Pacific (Mumbai) region. Some of our service providers (for example, Apple Push Notification service, Firebase Cloud Messaging, and Google Maps) may process data in the United States or other regions. Where data is transferred outside your country, we rely on appropriate safeguards required by applicable law, including standard contractual clauses where applicable.
11. Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. For material changes, we will also notify you in-app or by email before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.
12. Contact us
Questions, concerns, or requests about this policy or your data? Reach us at:
Email: support@rideconnect.in
WhatsApp: +91 91191 14665
Website: support.rideconnect.in/help