Privacy Policy
Last updated 5 October 2026
This policy explains what personal data the SmyRides app and website collect, why, who can see it, how long we keep it and how you can control it. It is written as the notice required by India's Digital Personal Data Protection Act, 2023 and its Rules.
1. Who we are
SmyRides (“we”, “us”) is operated by SmyHire (proprietor Alasapuri Susmitha, Udyam UDYAM-TS-27-0053484), 1-4-162/A, Old Municipality Office, Opp. APGVB Bank, Suryapet, Telangana 508213. For the purposes of the DPDP Act we are the Data Fiduciary for the data described here. Questions about this policy go to support@smyrides.com. Our Grievance Officer is listed on the Grievance page.
SmyRides is a platform where people who are already travelling share empty seats and carry parcels for each other. We don't run vehicles, and we never handle the money people pay each other.
2. The short version
- We collect what the service needs: your phone number and profile, verification results for drivers and travellers, your trips and parcels, messages, and location while you use the app or while you are on a trip.
- Live location is collected only between Start trip and the end of that trip, including while the app is in the background. It is never collected when you are not on a trip.
- Other users see only what they need for a trip. Your exact meeting point appears after booking, and your phone number only to the people a trip puts you in touch with, so they can call you about it.
- We don't sell personal data, we don't show ads, and we don't track you across other apps or websites.
- You can see, correct and delete your data, and withdraw consent, in the app or by writing to us.
3. What we collect and why
| Data | When | Why |
|---|---|---|
| Account: mobile number, name, date of birth, profile photo (optional), language | Sign-up and profile | To create your account, sign you in with a one-time code, confirm you are 18 or older, and show your profile on trips |
| Verification (people who offer rides or carry parcels): identity details from DigiLocker with your consent (name, date of birth, gender, photo, the last 4 digits of your Aadhaar), driving licence and vehicle registration details, and a selfie for a face match and liveness check | When you verify | To confirm who you are before you can drive or carry, to stop banned users from coming back, and to offer women-only rides with verified gender. We keep the result, the last 4 digits and a one-way code of the document number, not the full number; document images are deleted once the review ends |
| Vehicle: make, model, colour, seats and number plate | When you add a vehicle | To show riders which car to look for. The full plate is shown only to people booked on your trip |
| Trips and parcels: routes, stops, pickup and drop points, dates and times, seats, prices, requests, bookings, cancellations, ride and handover codes, parcel details and photos | When you search, offer, book, send or carry | To match you with trips, manage bookings and handovers, and keep a record both sides can rely on |
| Receiver details: the name and mobile number of the person receiving a parcel | When a sender adds them | To send the receiver the drop code and a tracking link, and so the traveller can call them at the drop. Senders must have the receiver's permission |
| Location | See section 4 | To find trips near you, share live location during a trip, and keep trips safe |
| Messages: chats with people on your trips, including photos you send | When you chat | To let you arrange pickups without swapping numbers, and to review reports of abuse |
| Ratings, reviews, reports and blocks | After trips, or when you report or block someone | To keep the community trustworthy and act on safety problems |
| Safety: emergency contacts you add, SOS alerts, trip links you share | When you use safety features | To record SOS alerts for our safety team, keep the contacts you add for emergencies, and let the people you send a trip link to follow your trip. Add people only with their permission |
| Payment notes: the UPI ID you choose to show, and “paid” or “received” marks | When you add them | To help riders and senders pay you directly. See Payments |
| Device and app data: device model, operating system, app version, notification token and IP address | While you use the app | To deliver notifications and keep the service secure |
| Pre-registration (website): name, mobile number, city and what you want to do | When you pre-register | To send you one SMS when SmyRides opens in your city |
| Support: what you write to us and our replies | When you contact us | To answer you and improve the service |
We process this data because you consent to it when you create an account and use each feature, and where the law allows for it without consent, for example to comply with a legal duty or respond to a medical emergency or a threat to safety. You can withdraw consent at any time (section 9); some features stop working without the data they need.
4. Location and live tracking
- While you use the app, we use your location to set pickup points and show trips and travellers near you. Search points are rounded to about 100 metres before they leave your phone.
- During a trip, from the moment the driver or traveller taps Start trip until the trip ends, the app collects precise location even when it is in the background or the screen is off. It shares that location with the people on the trip (booked riders; the sender and receiver while their parcel is on the way) and with anyone you send a trip link to. Android shows a notification the whole time; iOS shows a blue location indicator.
- From Start trip until it ends, the people on the trip see the car the whole way, including where the trip begins and ends.
- Location stops the moment the trip ends. We never collect location when you are not on a trip, and the app does not ask for “always” or all-the-time location access.
- We keep a sampled trail of each trip (about one point a minute) to resolve disputes and safety reports. See section 8.
5. Phone permissions
| Permission | Used for | Asked |
|---|---|---|
| Location (while using the app) | Pickup points, nearby trips, live tracking during a trip you start | When you first search or start a trip |
| Camera | Verification selfie, parcel photos at pickup and drop | When you take the photo |
| Photos | Choosing a profile or parcel photo (through the system photo picker) | When you choose a photo |
| Notifications | Trip updates: started, nearby, arrived, delivered or cancelled | After you sign in |
You can change any permission in your phone's settings. The app does not read your SMS, contacts or call logs.
6. Who can see your data
- Other users see your first name, photo, ratings, verification badges and trip details. Before booking they see areas, not addresses; after booking they see the exact meeting point and, for drivers, the full number plate. Your phone number is shown, so they can call you, only to the people a trip puts you in touch with: your driver or the riders booked with you, and your parcel's traveller or sender, from booking or matching until a day after the trip; and the person you send a seat request, carry request or offer to, while it is open. Someone you have blocked, or who blocked you, never sees it.
- Service providers process data for us under contract and only on our instructions:
- Supabase (database and sign-in), hosted in Mumbai, India
- Cloudflare (this website and its security, and R2 storage for photos and documents)
- Google (Maps, and Firebase Cloud Messaging for notifications)
- Apple (notifications on iPhone)
- MSG91 (sign-in codes by SMS) and Meta's WhatsApp (sign-in codes when SMS fails)
- DigiLocker, through a licensed verification partner, and a face-match provider (identity checks)
- Authorities, when Indian law requires it (for example a valid request from the police or a court), or to protect someone's life or safety.
- A buyer or successor, if SmyRides is reorganised or sold, under this same policy.
Some providers may process data outside India, as the DPDP Act allows. We don't sell personal data, share it for advertising or let anyone use it to track you across other apps and websites.
7. Payments
SmyRides doesn't process payments. Riders and senders pay drivers and travellers directly by UPI or cash. We don't see or store bank account, card or UPI PIN details. If you show a UPI ID, it is visible to the person paying you for that trip. “Paid” and “received” marks are what users tell us; SmyRides doesn't verify or guarantee payments.
8. How long we keep data
| Data | Kept for |
|---|---|
| Account and profile | While your account is open. After deletion, registration details are kept for 180 days as India's IT Rules require, then erased |
| Verification documents and selfies | Until the review ends; afterwards only the result, the last 4 digits and a one-way code remain |
| Trip trails (sampled location) | 90 days in the live system, then in an encrypted archive until one year after collection, then erased |
| Exact pickup and drop points, chats, receiver details | One year after the trip; then points are reduced to about 1 km and chats and receiver details are erased |
| Notifications | 90 days in the app, archived until one year, then erased |
| Logs of how data was processed | At least one year, as the DPDP Rules require |
| SOS alerts and reported trips | Until the case is closed, including any legal process |
| Pre-registrations | Until launch in your city, or until you ask us to delete them |
9. Your rights and choices
Under the DPDP Act you can:
- get a summary of the personal data we hold about you and how we use it, and the people we have shared it with;
- correct, complete or update it (most of it directly in the app);
- have it erased, including by deleting your account (see Delete your account);
- withdraw consent, as easily as you gave it;
- nominate someone to use these rights for you if you die or become unable to;
- have your complaints handled by our Grievance Officer, and if you are not satisfied, complain to the Data Protection Board of India.
Use the options in the app (Profile → Settings) or write to support@smyrides.com from the number or email linked to your account. We may ask you to confirm it's you before we act.
10. Children
SmyRides is only for people aged 18 and over; we check date of birth at sign-up. We don't knowingly process children's data. If you believe a child has an account, tell us at support@smyrides.com and we will delete it.
11. Security
Data travels over encrypted connections and is stored in India with access limited to the people who need it. Sensitive fields such as receivers' phone numbers and handover codes are encrypted, identity numbers are stored only as one-way codes, and every change our team makes is logged. If a breach affects your data, we will tell you and the Data Protection Board of India without delay, as the law requires.
12. This website
smyrides.com uses no advertising or analytics cookies. Cloudflare Web Analytics counts page visits without cookies and without identifying you. Fonts are served from our own site. The live-tracking demo loads map tiles from OpenStreetMap, which receives your IP address as any website you visit does. When you pre-register or send a deletion request, what you type is stored in our database in India. Cloudflare, which hosts the site, processes IP addresses to protect it from attacks.
13. Changes and contact
If we change this policy in a way that matters, we'll tell you in the app before the change applies, and ask for consent again where the law requires. Questions: support@smyrides.com. Grievances: Grievance Officer.