Privacy policy
This page is a draft. It describes what the site actually does today, but it is not legal advice and has not been reviewed by a lawyer.
What we collect
Your email address, to sign you in: we send a one-time code and there is no password. A display name, and a short bio if you add one. If you offer a ride: your vehicle's make, model, colour and number of seats, and each ride's route, date, times, pickup and drop-off, and contribution per seat. If you book: which ride and how many seats. The messages you send the other person on a booking. We do not ask for payment details, identity documents, phone numbers, or plate numbers.
What other people can see
Anyone, signed in or not, can see a published ride: its route, date, times, contribution, the pickup and drop-off the driver typed, and the driver's display name, bio, vehicle and the year they joined. Enter a public meeting place, never a home address. Your display name starts out as the part of your email before the @ — change it in your account if you would rather that was not shown. Your email address itself is never shown to other members. Messages on a booking are visible only to that booking's passenger and driver.
Services that handle your data
The site is hosted on Vercel. Accounts, rides, bookings and messages are stored with Supabase in Singapore, so your data is held outside the Philippines. Sign-in emails are sent through Resend. The sign-in page uses Cloudflare Turnstile to check for automated abuse. Upstash is used to limit how often requests can be made, and stores a one-way hash rather than your IP address.
Cookies
Signing in sets cookies that keep you signed in. An optional cookie remembers your language. There are no analytics, advertising, or tracking cookies. If we add anything else, we will say here what it is and what it is for.
Your rights
You can change your display name and bio in your account at any time. There is not yet a self-service way to download your data or delete your account, and no support channel to ask through. That is a known gap, and it has to be closed; the applicable Philippine privacy law will be followed and this page properly reviewed.