Privacy Policy

JoinRoute · Version 2026-10-21 · Under the Digital Personal Data Protection Act, 2023

What we collect

• Account: name, phone number, email, profile photo, About me and ride preferences.
• Verification: one government photo ID image and the name as printed on it, and a selfie taken in the app, checked by JoinRoute's own team. The selfie is used only to see that the ID is yours: it is seen only by the reviewer and deleted as soon as the check is finished. While your account exists we keep an ID picture check code: a short code calculated from the ID picture (not the picture, and not a biometric), so the same ID picture can't be used for another account.
• Journeys: rides you offer or request, pickup and drop points, bookings, ratings and reports.
• Location: your device location when you use location features, and during a trip to show progress, ETA and safety tracking.
• Messages in trip chats, and device information for notifications and crash reports.

Why we use it

• To match you with people going your way, run bookings, chat and notifications.
• For safety: identity checks, SOS, live trip tracking, safe-arrival checks, and handling reports.
• To keep the service secure, prevent misuse, and improve it (aggregated statistics).

Who can see what

• Other people on JoinRoute see your first name, photo, rating and trip details needed to travel together. Exact home/work points are blurred until a seat is booked.
• If you choose, your profile shows where you work or study from a verified work or college email (for example "Works at tcs.com"). Your email address itself is never shown.
• Your phone number is shared only with the other person after a seat is booked, and hidden again after the trip.
• Your emergency contacts receive your live location only when you press SOS: JoinRoute prepares the SOS text and your phone's Messages app sends it from your own number; contacts who also use JoinRoute get an in-app alert.
• During a trip you joined, your live location is shared with your co-travellers on that trip. It is never tracked outside a trip.
• Service providers that run JoinRoute for us process data only on our instructions:
  • Google Firebase — sends your login code by SMS, emails the email-verification link, and delivers notifications (your phone number, email and a device token).
  • Ola Maps and OpenStreetMap services — place search, addresses and road routes (the place you type or the points of a route; not your name or number).
  • Hosting in India (our server and database), an SMS provider for login codes once we send them ourselves, and crash reporting (technical error details).
• We do not sell personal data. We share data with authorities only when the law requires it.

Advertising

JoinRoute may show a small number of ads, clearly marked "Sponsored", through Google AdMob. They are non-personalised: we do not use your journeys, location history or contacts for ads, and we never sell or share your personal data with advertisers. Google may receive basic device information and an approximate area (from your internet address) to show and count ads and prevent fraud. Ads never appear on safety, trip, chat, booking, ride-creation or sign-in screens. Members of a Premium or organisation (Corporate) plan see no ads. Some "Sponsored" cards may be local businesses that pay us to appear; tapping one opens their website, and we do not share your details with them.

Product analytics

To understand how JoinRoute is used and improve it, we record simple app events with your account — for example "app opened", "ride published", "ad shown on the home screen" — with only plain details such as the screen or app version. These events never include your messages, contacts or exact locations, and are not sold or shared for advertising.

How long we keep it

• Selfies are deleted as soon as the reviewer decides (and in any case within 30 days). ID photos are deleted 30 days after the verification decision. The ID picture check code is deleted with your account.
• Trip location points are deleted after 30 days, except those linked to an open safety incident.
• Login codes are stored only in scrambled form and deleted within 24 hours.
• Read notifications are deleted after 30 days, others after 90 days.
• Account data is kept while your account is open; when you delete your account, personal data is erased except what the law requires us to keep.

Security

Phone numbers, emails and ID photos are encrypted at rest; connections are encrypted (HTTPS); staff access is limited and logged.

Children

JoinRoute is for adults (18 and over). We do not knowingly collect data from children.

Your rights

You can access and download your data, correct it, withdraw consent, and delete your account (Profile → Your account), or contact us. You may also complain to the Data Protection Board of India.

Contact

JoinRoute is responsible for your data (the Data Fiduciary). support@joinroute.in. Grievance Officer details: to be added before launch.

See also the Terms of Service.