Privacy Policy

This draft describes data indicated by the current YORIDE application code. It is not legal advice or a claim of statutory compliance. The operator must verify actual production practices, vendors, retention, and user-rights processes before publishing.

1. Who operates YORIDE

The legal entity/operator name and registered address have not been verified from the project configuration. They must be completed before this policy is published. YORIDE is a brand name in this draft.

2. Information processed

• Account and contact data: names, email addresses and mobile numbers provided for Customer, Captain, and Admin accounts. Mobile numbers are used for account access; configured OTP verification may process the number and verification event.
• Ride information: pickup and drop-off text, selected service category, ride status/history, cancellation or rating information, and related support requests. The application code inspected stores textual pickup/drop-off locations; no Google Maps integration was found.
• Captain application information: address, PIN code, vehicle information, driving arrangement, declarations, submitted identity/vehicle/licence documents, review states, and reasons recorded by Admin reviewers.
• Bank details: Captain bank account-holder, bank name, account number, and IFSC fields are encrypted by the application model and are hidden from its normal serialized responses. Actual storage access, key management, backups, and Admin access controls require production verification.
• Technical/security data: sessions, authentication state, request metadata used for security/rate limiting, and operational logs as configured by the deployed service.
• Website forms: name, email, optional mobile, subject, and message when a support request is submitted. Do not send passwords, OTPs, payment credentials, or identity documents in website messages.

3. Purpose and sharing

Data is used to create and secure accounts, process ride requests and status, assess Captain eligibility, review documents, maintain ride/payment records, answer support requests, and protect the platform. Data may be accessible to authorized YORIDE personnel and infrastructure/service providers needed to run the apps, messaging, hosting, storage, or email. The exact vendors and transfer locations must be confirmed by the operator.

4. OTP, authentication, and security

OTP is intended to verify control of a mobile number where a real provider is configured. Development-only OTP must never be used as production authentication. Captains use a four-digit MP after required approval in the current implementation; the backend stores a password hash rather than the raw MP. Do not share OTPs or MP codes. No system can be represented as risk-free; production security controls and incident processes require operator verification.

5. Location, maps, and Google services

The code and configuration reviewed do not show a Google Maps API integration; the configured map provider is set to none in the project template. Ride pickup/drop-off are represented as text in the ride API. This website does not request browser location permission. If a map, location SDK, Google API, or other location provider is enabled later, this policy and vendor disclosures must be updated to describe permissions, data, purpose, retention, and the relevant provider policy.

6. Payments

The current API allows cash as the supported preference and rejects online payment until a gateway is configured. No payment gateway integration was identified in the inspected application code. If a gateway is later added, its name, data shared, terms, and privacy information must be stated here before enabling it.

7. Retention and protection

Information is retained only as the operator determines necessary for account, ride, document-review, support, security, and legal purposes. The current project does not establish a complete published retention schedule. The operator must document retention periods, secure deletion, backup expiry, access controls, encryption/key ownership, and incident response before launch.

8. Your requests

You may request access, correction, or deletion by contacting the verified privacy contact below. Identity verification may be needed to protect an account. Some records may need to be retained for legitimate operational or legal reasons; the applicable periods and lawful basis must be confirmed by the operator. Account deletion is not currently represented as an in-app automated feature.

9. Children and eligibility

The apps are not described here as services for children. Account eligibility and any age requirements must be confirmed by the operator and published in the Terms before launch.

10. Privacy contact

Privacy email: owner must configure and verify this contact. You may also submit a privacy request using the contact form once its email channel is active.

11. Changes and owner review

Before this policy becomes effective, the operator must verify the legal entity, production data flows, vendors, hosting regions, retention, rights handling, contact details, and effective date. Changes should be dated and communicated through an appropriate channel.

Last prepared: 25 October 2026. Effective date: To be set by the verified operator after review.