Privacy Policy

1. Introduction

RouteBook LLC ("Routebook," "we," "our," "us") takes your privacy seriously. This Privacy Policy explains what information we collect when you use the Routebook mobile application and related services (the "Platform"), how we use that information, who we share it with, and what choices you have.

By using the Platform, you agree to the collection and use of information as described in this Policy.

2. Information We Collect

2.1 Information You Provide

Account information: phone number (used as your primary account identifier), profile photo, and a cryptographically derived credential used to attach your Firebase-authenticated sign-in session to your Routebook account. No password you type is stored, because there is no password to type — see Section 2.3.

Profile information: bio or about-me text, and travel preferences (e.g., preferences about music, smoking, pets).

Identity-verification information: a government-issued identity document (driver's license, passport, or national ID card) and a real-time selfie. These are collected inside the Persona flow and transmitted directly to Persona Identities, Inc. They are not received or stored by Routebook. Persona retains them under Persona's own privacy and retention policies. From Persona's processing, Routebook receives and stores your verification outcome (verified / requires input / canceled / age-ineligible), the document type submitted, the full name printed on the document, and your date of birth. Your Routebook profile name is automatically overwritten to the full name Persona extracts from your ID once verification succeeds, so that your displayed name equals your legal name.

Route information: origin and destination of routes you post or search, departure dates and times, number of seats you post as available, recurring schedule preferences, and vehicle information (make, model, year) provided voluntarily by users posting routes.

Ride requests: requests you send for a seat on another user's route, including any note you attach and the accept/decline/withdrawal state of the request.

Messages: content of messages you send through the in-app messaging feature. The messages are stored to enable the conversation experience and are accessible to both parties in the conversation.

Feedback and reports: ratings and reviews you submit about other users, and safety reports or support requests you submit to us.

Routebook does not collect or store payment information of any kind. Routebook does not process payments and has no payment infrastructure.

2.2 Information We Collect Automatically

Device and usage data: device identifiers (IDFA/GAID where permitted by your device settings), device type, operating system version, app version, IP address, app activity logs (screens viewed, features used, actions taken, session duration), and crash reports and performance diagnostics collected via Sentry (see Section 4.2).

Push notification tokens: APNS (Apple) and FCM (Firebase Cloud Messaging / Google) push tokens issued by your device. These tokens are the address at which push notifications for your account are delivered. They are relayed by the Expo Push Notification service.

Location data: general (coarse) location derived from IP address is collected passively when you use the Platform. Precise GPS location is collected only when you explicitly grant location permission in your device settings, and only while the app is open in the foreground — we use it to pre-fill your departure city in route searches and to show relevant nearby results. We do not track your location in the background or when the app is closed.

Cookies and similar technologies: the web version of the Platform may use cookies and similar technologies to maintain your session and analyze usage patterns. You can control cookie behavior through your browser settings.

Routebook does not run advertising SDKs, does not participate in cross-context behavioral advertising, and does not embed third-party ad tracking or ad-network domains in the app.

2.3 Information From Third Parties

• Firebase Authentication (Google LLC) — sign-in requires phone-number verification. When you sign in, your phone number is transmitted to Firebase, Firebase sends a one-time SMS verification code to that number, and once you enter the code Firebase returns an authentication token to Routebook. Routebook receives only the verified phone number and the token. Firebase's handling of your phone number is subject to Google's privacy policy.
• Persona (Persona Identities, Inc.) — before you can post a route or send a seat request, you must complete government-ID verification. Your ID document images and selfie are transmitted directly to Persona and processed by Persona. Routebook receives only the verification outcome, the document type, and the name and date of birth extracted from the document. Users whom Persona determines are under 18 are automatically rejected and their submitted images are redacted from Persona. Persona's handling of ID and biometric data is subject to Persona's privacy policy.
• Google Maps Platform / Places (Google LLC) — origin and destination addresses you enter for search, route posting, and directions are transmitted to Google for geocoding, autocomplete, and route rendering, subject to Google's privacy policy.
• Sentry — crash reports and performance traces (including stack traces, device metadata, and, in some cases, the user ID associated with the session) are transmitted to Sentry so we can diagnose and fix bugs, subject to Sentry's privacy policy.
• Expo Push Notification service (Expo) — APNS and FCM push tokens issued by your device, plus notification payloads (title, body, and any data attributes we attach), are transmitted through Expo's push-relay service to be delivered to Apple's or Google's push infrastructure, subject to Expo's privacy policy.

3. How We Use Your Information

We use the information we collect to:

Operate the Platform: create and manage your account, display route postings to relevant users in search results, enable in-app messaging between users, and display user profiles, ratings, and reviews.

Improve the Platform: analyze usage patterns to improve features and fix bugs, test new features and measure their effectiveness, and generate aggregate, non-identifying analytics about platform usage.

Communicate with you: send transactional notifications (new messages, invitation updates, account alerts), respond to your support requests, and send marketing communications only with your consent where required by law.

Safety and enforcement: investigate reports of policy violations, detect and prevent fraud, abuse, and spam, and enforce our Terms of Service and Community Guidelines.

Legal compliance: comply with applicable laws and valid legal process, and protect Routebook's legal rights and interests.

4. How We Share Your Information

We do not sell your personal information to third parties.

4.1 With Other Users

To enable route discovery and coordination, limited profile and route information is visible to other users: your first name, profile photo, and any ratings or reviews you have received are visible on your public profile; route details you post (origin, destination, date, vehicle info, preferences) are visible to users who view or search for routes; in-app messages are visible only to the parties in that conversation.

We do not share your email address, phone number, or precise location with other users.

4.2 With Service Providers

We share data with the following third-party vendors, who process it only to operate the Platform on our behalf:

Each service provider is engaged under terms that restrict their use of your data to operating services on our behalf.

4.3 Legal Requirements

We may disclose your information if we believe in good faith that disclosure is required to comply with a law, regulation, subpoena, or court order; to protect the safety of any person from imminent harm; to prevent fraud or unauthorized use of the Platform; or to protect Routebook's legal rights. Where permitted by law, we will attempt to notify you of legal demands for your data before complying.

4.4 Business Transfers

If Routebook is involved in a merger, acquisition, bankruptcy, or asset sale, your information may be transferred as part of that transaction. We will notify you of any such event and any choices you may have.

4.5 With Your Consent

We may share your information for other purposes with your explicit prior consent.

5. Data Retention

We retain your information for as long as your account is active and for a period afterward as described below:

You may request deletion of your personal data at any time (see Section 8). Some data may be retained longer if required by law or to resolve an active legal dispute.

6. Security

We implement commercially reasonable technical and organizational security measures to protect your information, including encryption of data in transit using TLS, encrypted storage of sensitive fields at rest, role-based access controls limiting internal access to personal data, and regular review of security practices.

No system is completely secure. We cannot guarantee that your information will never be accessed or compromised. In the event of a data breach affecting your rights, we will notify you as required by applicable law.

7. Children's Privacy

The Platform is not directed to children under the age of 13, and we do not knowingly collect personal information from anyone under 13. Our minimum age requirement is 18 (see Terms of Service). We enforce this age requirement operationally: every user is required to complete Persona verification before posting a route or requesting a seat, and Persona extracts the date of birth from the ID document. Users whom Persona determines are under 18 are automatically rejected as ineligible and their submitted document images are redacted from Persona.

If we nonetheless discover we have collected information from a user under 13, we will delete it promptly. If you believe a child under 13 has provided personal information to us, contact us at [email protected].

8. Your Choices and Rights

8.1 Access and Correction

You can review and update your account information at any time through the Profile settings in the app.

8.2 Account Deletion

You may delete your account through the app settings. We will delete or anonymize your personal data within 30 days, subject to the retention exceptions in Section 5.

8.3 Marketing Communications

You may opt out of marketing emails via the "Unsubscribe" link in any marketing email. You may manage push notification preferences through your device settings. We may continue to send you transactional messages (e.g., message alerts, account security notices) regardless of marketing preferences.

8.4 Location

You may revoke location permissions at any time through your device settings. Disabling location access may limit certain features, such as automatic detection of your departure city.

8.5 California Residents — CCPA/CPRA Rights

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know — request a summary of the categories and specific pieces of personal information we have collected about you in the past 12 months, including the sources, purposes, and categories of third parties with whom we share it.
• Right to Access — request a portable copy of your personal information.
• Right to Deletion — request deletion of your personal information, subject to certain legal exceptions.
• Right to Correct — request correction of inaccurate personal information.
• Right to Opt Out of Sale/Sharing — we do not sell or share personal information for cross-context behavioral advertising. If this changes, we will provide a conspicuous opt-out mechanism.
• Right to Non-Discrimination — we will not discriminate against you for exercising your privacy rights.

To exercise CCPA/CPRA rights, contact us at [email protected]. We will verify your identity before processing your request and respond within 45 calendar days.

8.6 Other State Privacy Rights

Residents of Colorado, Connecticut, Virginia, Texas, Oregon, Montana, and other states with comprehensive privacy laws may have similar rights to access, correct, delete, and opt out of certain data uses. Contact us at [email protected] to exercise those rights.

8.7 Do Not Track

The Platform does not currently respond to browser "Do Not Track" signals.

8.8 Biometric Information (Illinois, Texas, Washington, and other states with biometric-specific laws)

As part of our identity-verification requirement (Section 2.3), you submit a government-issued identity document and a real-time selfie through Persona. Persona uses biometric identifiers derived from the selfie and the ID photograph — including facial-geometry data — to confirm that the person submitting the check is the person shown on the document.

• Purpose of collection: solely to verify your identity as a condition of using the Platform. Not used for marketing, advertising, profiling, or any secondary purpose.
• Who receives the data: the images, biometric identifiers, and biometric information derived from them are collected, stored, and processed exclusively by Persona, not by Routebook. Routebook receives only the outcome of the verification and the extracted printed fields (name and date of birth).
• Retention: biometric identifiers and biometric information are retained by Persona in accordance with Persona's own retention schedule. Persona's stated policy is to retain such data no longer than reasonably necessary to fulfill the purpose for which it was collected or as required by law. Routebook does not itself retain biometric data at any time.
• Destruction: upon your request through [email protected], or upon deletion of your account, Routebook will submit a redaction request to Persona for the biometric data associated with your verification session. Persona's fulfillment of that request is governed by Persona's own policies.
• No sale, no disclosure without consent: neither Routebook nor Persona sells, leases, trades, or otherwise profits from your biometric information. Neither will disclose your biometric information to any third party except (a) with your written consent, (b) to complete the verification transaction you initiated, (c) if required by a valid subpoena, warrant, or court order, or (d) as necessary to protect against fraud, abuse, or a violation of law.

This disclosure is provided for the benefit of residents of jurisdictions with biometric-information-specific privacy laws, including the Illinois Biometric Information Privacy Act (740 ILCS 14), the Texas Capture or Use of Biometric Identifier statute (Tex. Bus. & Com. Code §503.001), and the Washington biometric-identifiers statute (RCW 19.375), among others.

9. Third-Party Links and Services

The Platform may display links to third-party websites or integrate with third-party services (such as mapping). We are not responsible for the privacy practices of those third parties and encourage you to review their policies.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the app or by email. Your continued use of the Platform after notice constitutes acceptance of the updated Policy.

11. Contact

For privacy questions, requests, or concerns:

RouteBook LLC  ·  [email protected]