1. Introduction
RouteBook, Inc. ("RouteBook," "we," "our," "us") takes your privacy seriously. This Privacy Policy explains what information we collect when you use the RouteBook mobile application and related services (the "Platform"), how we use that information, who we share it with, and what choices you have.
By using the Platform, you agree to the collection and use of information as described in this Policy.
2. Information We Collect
2.1 Information You Provide
Account information: full name, email address, phone number, profile photo, and password (stored as a cryptographic hash — never in plain text).
Profile information: bio or about-me text, and travel preferences (e.g., preferences about music, smoking, pets).
Route information: origin and destination of routes you post or search, departure dates and times, number of seats you post as available, recurring schedule preferences, and vehicle information (make, model, year) provided voluntarily when posting routes.
Messages: content of messages you send through in-app messaging. Messages are stored to enable the conversation experience and are accessible to both parties in the conversation.
Feedback and reports: ratings and reviews you submit about other users, and safety reports or support requests you submit to us.
Identity verification: before posting routes or requesting seats, all users are required to complete identity verification. Your government-issued ID document and selfie are transmitted directly to Stripe Identity for processing. Your profile name is compared against the name on your government ID as part of this process. RouteBook does not receive, store, or retain your ID document images or biometric data — these are processed and stored exclusively by Stripe under their privacy policy.
RouteBook does not collect or store payment information of any kind. RouteBook does not process payments and has no payment infrastructure.
2.2 Information We Collect Automatically
Device and usage data: device identifiers (IDFA/GAID where permitted by your device settings), device type, operating system version, app version, IP address, app activity logs (screens viewed, features used, session duration), and crash reports and performance diagnostics.
Location data: general location derived from IP address is collected passively when you use the Platform. Precise GPS location is collected only when you explicitly grant location permission in your device settings — we use this to pre-fill your departure city in route searches and show relevant nearby results. We do not track your location in the background or when the app is closed.
Cookies and similar technologies: the web version of the Platform may use cookies to maintain your session and analyze usage patterns. You can control cookie behavior through your browser settings.
2.3 Information From Third Parties
- Firebase (Google) — we use Firebase to verify your phone number during sign-in. Your phone number is transmitted to Google to deliver a one-time verification code, subject to Google's privacy policy. We receive only a confirmation that the number was verified.
- Stripe Identity — all users must complete identity verification through Stripe Identity before posting routes or requesting seats. Your government-issued ID document and selfie are transmitted to and processed by Stripe, subject to Stripe's privacy policy. RouteBook receives only the verification outcome (verified, requires input, etc.) and the name extracted from the ID for name-matching purposes. RouteBook does not store your ID document or biometric data.
- Google Maps — we use Google Maps APIs to geocode addresses and display routes. Origin and destination addresses you enter are transmitted to Google subject to Google's privacy policy.
3. How We Use Your Information
Operate the Platform: create and manage your account, display route postings in search results, enable in-app messaging, and display user profiles, ratings, and reviews.
Improve the Platform: analyze usage patterns to improve features and fix bugs, test new features, and generate aggregate non-identifying analytics.
Communicate with you: send transactional notifications (new messages, invitation updates, account alerts), respond to support requests, and send marketing communications only with your consent where required by law.
Safety and enforcement: investigate reports of policy violations, detect and prevent fraud and abuse, and enforce our Terms of Service and Community Guidelines.
Legal compliance: comply with applicable laws and valid legal process, and protect RouteBook's legal rights and interests.
4. How We Share Your Information
We do not sell your personal information to third parties.
4.1 With Other Users
To enable route discovery, limited profile and route information is visible to other users: your first name, profile photo, and any ratings or reviews you have received appear on your public profile; route details you post (origin, destination, date, vehicle info, preferences) are visible to users who search for routes; in-app messages are visible only to the parties in that conversation.
We do not share your email address, phone number, or precise location with other users.
4.2 With Service Providers
| Provider | Purpose |
|---|---|
| Supabase | Database hosting and backend infrastructure |
| Stripe Identity | Government ID verification for all drivers and riders |
| Firebase (Google) | Phone number verification during sign-in |
| Google (Maps API) | Address geocoding and route display |
| Apple / Google (Push) | Push notification delivery |
| Crash reporting provider | Error tracking and diagnostics |
| Analytics provider | App usage analytics |
Each service provider is engaged under data processing terms that restrict their use of your data to operating services on our behalf.
4.3 Legal Requirements
We may disclose your information if we believe in good faith that disclosure is required to comply with a law, regulation, subpoena, or court order; to protect the safety of any person from imminent harm; to prevent fraud or unauthorized use of the Platform; or to protect RouteBook's legal rights. Where permitted by law, we will attempt to notify you of legal demands for your data before complying.
4.4 Business Transfers
If RouteBook is involved in a merger, acquisition, bankruptcy, or asset sale, your information may be transferred as part of that transaction. We will notify you of any such event and any choices you may have.
4.5 With Your Consent
We may share your information for other purposes with your explicit prior consent.
5. Data Retention
| Data Type | Retention Period |
|---|---|
| Account and profile data | Active account + 2 years after deletion |
| Route postings | Active + 1 year after expiration or deletion |
| In-app messages | 1 year after the conversation's last activity |
| Ratings and reviews | Indefinitely while the Platform operates (de-identified after account deletion) |
| Verified status | Active account + 2 years after deletion. Identity documents and biometric data retained exclusively by Stripe — RouteBook holds no copy. |
| Crash logs and diagnostics | 90 days |
| Aggregate usage analytics | Indefinitely (not linked to individual users) |
You may request deletion of your personal data at any time (see Section 8). Some data may be retained longer if required by law or to resolve an active legal dispute.
6. Security
We implement commercially reasonable security measures including encryption of data in transit using TLS, encrypted storage of sensitive fields at rest, role-based access controls limiting internal access to personal data, and regular review of security practices.
No system is completely secure. We cannot guarantee that your information will never be accessed or compromised. In the event of a data breach affecting your rights, we will notify you as required by applicable law.
7. Children's Privacy
The Platform is not directed to children under the age of 13, and we do not knowingly collect personal information from anyone under 13. Our minimum age requirement is 18 (see Terms of Service). If we discover we have collected information from a user under 13, we will delete it promptly.
If you believe a child under 13 has provided personal information to us, contact us at privacy@routebook.us.
8. Your Choices and Rights
8.1 Access and Correction
You can review and update your account information at any time through the Profile settings in the app.
8.2 Account Deletion
You may delete your account through the app settings. We will delete or anonymize your personal data within 30 days, subject to the retention exceptions in Section 5.
8.3 Marketing Communications
You may opt out of marketing emails via the "Unsubscribe" link in any marketing email. Manage push notification preferences through your device settings. We may continue to send transactional messages regardless of marketing preferences.
8.4 Location
You may revoke location permissions at any time through your device settings. Disabling location access may limit certain features, such as automatic detection of your departure city.
8.5 California Residents — CCPA/CPRA Rights
If you are a California resident, you have the following rights under the CCPA as amended by the CPRA:
- Right to Know — request a summary of the personal information we have collected about you in the past 12 months, including sources, purposes, and third parties with whom we share it.
- Right to Access — request a portable copy of your personal information.
- Right to Deletion — request deletion of your personal information, subject to certain legal exceptions.
- Right to Correct — request correction of inaccurate personal information.
- Right to Opt Out of Sale/Sharing — we do not sell or share personal information for cross-context behavioral advertising.
- Right to Non-Discrimination — we will not discriminate against you for exercising your privacy rights.
To exercise these rights, contact us at privacy@routebook.us. We will verify your identity before processing your request and respond within 45 calendar days.
8.6 Other State Privacy Rights
Residents of Colorado, Connecticut, Virginia, Texas, Oregon, Montana, and other states with comprehensive privacy laws may have similar rights to access, correct, delete, and opt out of certain data uses. Contact us at privacy@routebook.us to exercise those rights.
8.7 Do Not Track
The Platform does not currently respond to browser "Do Not Track" signals.
9. Third-Party Links and Services
The Platform may display links to third-party websites or integrate with third-party services (such as mapping). We are not responsible for the privacy practices of those third parties and encourage you to review their policies.
10. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the app or by email. Your continued use of the Platform after notice constitutes acceptance of the updated Policy.
11. Contact
For privacy questions, requests, or concerns, contact us at privacy@routebook.us.