Privacy Policy

CoRidee ("we", "our", "us") provides a carpooling platform that connects drivers and passengers travelling along similar routes in Pakistan. This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and your rights.

Contact us at coridepakistan@gmail.com.

2.1 Information you provide

• Account identity — full name, email, phone number, gender, and a salted password hash
• Verification — CNIC number, CNIC front/back images, live selfie
• Driver verification — driving licence number, licence images, issue/expiry date, province
• Vehicle records (drivers) — car model, registration, seat count, car photo
• Ride data — pickup, destination, route, schedule, fare, seats, preferences
• Profile picture, complaint/dispute content, ratings and feedback

2.2 Information we collect automatically

• Precise location — only when the app is open or during an active ride (with a persistent foreground notification)
• Approximate location — fallback when GPS is unavailable
• Device identifiers — FCM token, anonymous Firebase installation ID, device model, OS version, app version
• Usage data — screens visited, anonymous events for product analytics
• Crash diagnostics and network state

2.3 What we do not collect

We never collect your contacts, SMS, call logs, photos other than those you upload, background microphone audio, or background location when no ride is active.

• Match riders and drivers along similar routes
• Verify identity as required by Pakistani regulations
• Process driver onboarding
• Run active rides safely (live location, ETAs, SOS)
• Send essential push notifications
• Operate ratings and the dispute system
• Enforce safety policies including driver suspension
• Improve the app via anonymous analytics and crash reports

We do not use your data for marketing messages, sell it to third parties, or build advertising profiles.

4.1 Between riders and drivers

When you book or accept a ride, the other party sees your name, profile picture, rating, and phone number. During an active ride the driver's live location is shared with accepted passengers.

4.2 Service providers

We use Render (hosting), Supabase (image storage), Firebase / Google (auth, push, analytics, real-time location), Google Maps Platform (mapping), and Brevo (OTP emails). Each is bound by confidentiality obligations.

4.3 Legal disclosures

We may disclose information to Pakistani law enforcement when compelled by valid legal order under PECA 2016 or other applicable law.

4.4 We do not sell your data

We never sell, rent, or trade your personal information.

• Active-account profile data — while your account is active
• Ride history and ratings — retained for marketplace integrity
• CNIC and selfie — retained for legal traceability
• Server logs — 30 days · Crash reports — 90 days
• OTPs — burned after first verification or auto-expire within minutes

You can access, correct, delete, or restrict processing of your data. Email coridepakistan@gmail.com with the subject "Privacy Request".

Delete your account at any time inside the app (Settings → Delete Account) or via our Delete Account page.

On deletion we anonymise PII (name, email, phone, photo, FCM tokens), invalidate the password, and retain CNIC records strictly for legal traceability. Ride history and ratings remain attached to the anonymised account.

CoRidee is for users aged 18+. Because a valid CNIC is required, only Pakistani adults can register.

We protect data with HTTPS/TLS encryption, salted password hashes, private storage buckets with signed URLs, debug-log stripping in release builds, and active foreground-service notifications during live tracking.

Some providers are located outside Pakistan. Transferred data remains subject to the contractual confidentiality obligations imposed on those providers.

We may update this Privacy Policy. Material changes will be announced via an in-app notice and the "Last updated" date will change.

Email coridepakistan@gmail.com — subject line "Privacy Request". We aim to respond within 7 working days.