Privacy Policy

1. Introduction

RideShare (“we,” “our,” or “the platform”) is a ride-matching application designed for university students in Uganda. This Privacy Policy explains what personal data we collect, how we use it, who has access to it, and what rights you have over it.

By creating an account or using RideShare, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this policy, you should not use the platform.

2. Information We Collect

2.1 Information You Provide Directly

• Full name — Display name on your profile and ride cards
• Email address — Used for account creation, verification, and launch notifications
• Password — Hashed using bcrypt. We never see or store your plaintext password
• Gender — Used for same-gender ride preference matching
• University — The campus you belong to. Determines which rides appear in your feed
• Hostel or area — Optional. Helps other riders understand your general location

2.2 Information Generated Through Use

• Trust score — Calculated as a rolling average of ratings you receive
• Ride history — Every ride you post, join, complete, or cancel
• Ratings received — Star ratings and optional comments from other users
• Safety PINs — Generated per ride per participant
• Chat messages — Temporary messages that expire after the chat expiry time

What We Do Not Collect

• Phone numbers — All communication happens through in-app chat
• Physical location / GPS data — We do not track your real-time location
• Payment information — We never handle money
• Photos or biometric data — We do not require profile photos
• Device identifiers for advertising — We do not use any advertising SDKs

3. How We Use Your Information

• Account creation and verification — Your email and name create and verify your account
• Ride matching — Your university determines which rides appear in your feed
• Trust scoring — Ratings are aggregated into a public trust score
• Communication — Your name and trust score are visible to ride participants
• Safety verification — Safety PINs are generated for identity verification

4. How Your Information Is Stored

All data is stored in a PostgreSQL database hosted on Supabase. Passwords are stored as bcrypt hashes, session tokens use SHA-256 hashing, and all tables have Row Level Security (RLS) enabled.

5. Information Sharing

We do not sell, rent, trade, or otherwise monetize your personal data. We share information only with ride participants (name, trust score, verification status), with rated users, and for legal compliance when required by Ugandan law.

6. Data Retention

• Ride history — Permanently stored for safety and accountability
• Chat messages — Accessible only while the chat is active, then inaccessible
• OTP codes — Deleted within 24 hours of expiry
• Account data — Permanently removed within 30 days of account deletion

7. Your Rights

Under the Uganda Data Protection Act 2019, you have the right to access, rectification, erasure, restrict processing, data portability, withdraw consent, and lodge a complaint. Contact us at privacy@rideshare.ug to exercise these rights.

8. Data Security

All data in transit is encrypted using TLS. Passwords are hashed with bcrypt. Row Level Security (RLS) is enabled on every database table. We do not use any third-party analytics, advertising, or tracking SDKs.

9. Age and Eligibility

RideShare is intended for university students aged 18 and above. We do not knowingly collect data from persons under 18.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated at least 14 days before taking effect.

11. Contact Us

For any questions or requests: privacy@rideshare.ug