Privacy policy
Draft: not reviewed yet. Fill in the [brackets] and have it checked against North Macedonia's Law on Personal Data Protection (and the GDPR if you serve people in the EU) before publishing.
Last updated: [date]
Who we are
Trakty is run by [your name or company], [address], [country]. For anything about your data, write to privacy@trakty.app [make sure this mailbox exists].
What we collect, and why
- Your account: your email address and your password, which we only store scrambled (hashed) so nobody can read it. If you sign in with Google or Apple, we store the account id they give us, not your password there; for Apple, also a token that lets us revoke Trakty's access when you delete your account.
- Rides you request: where you want to be picked up, when, which taxi company, and which driver took the ride, with the time of each step. The company's free drivers near the pickup point see it so one of them can take it. If none of them takes it, the nearest free driver of another taxi company may get it, and the ride moves to that company. Before a driver takes the ride they see only the pickup point and time; the company that has the ride, and its drivers, also see your email address with it.
- Drivers' location: if you drive for a taxi company in Trakty, your position and whether you're free, while you're online, so riders can see free taxis nearby. Riders see only the company and the position, not who you are. Your position is removed when you go offline. While you drive someone, that rider also sees your name, your car and your position, until the ride ends.
- Your phone's notification token, so we can tell you about your rides (a new ride for a driver, a driver on the way for a rider). It is removed when you sign out.
- Photos that bus companies and travel agencies add to their lines and offers.
- Car plates you add to your account, and feedback you send us.
- Sign-in records: to keep you signed in, we store scrambled sign-in tokens that expire after 60 days. Password-reset links expire after one hour.
We don't sell your data, and we don't use it for advertising. [If you add ads for nearby shops later, update this section first.]
Who else handles it
- Cloudflare carries all traffic to our servers and protects them from attacks, so it sees your IP address.
- Cloudflare R2 stores the photos companies add, and serves them from img.trakty.app.
- Google Firebase Cloud Messaging (and, on iPhones, Apple's push service) delivers our notifications to your phone. They see the notification and your phone's notification token.
- Proton (Switzerland) sends our emails, such as password-reset links, and stores our encrypted nightly backups.
- Google and Apple for sign-in, only if you choose to sign in with them.
Our servers are in [country].
How long we keep it
Your account stays until you delete it. When you do, your account, car plates, notification tokens and sign-ins are deleted; rides you took stay in the taxi company's records without their pickup points and no longer tied to you, and so does feedback you sent. If you own a taxi company on Trakty, the company is removed too, and its drivers leave the map. Backups are kept for 14 days, so deleted data disappears from them within two weeks. [Decide how long to keep ride history and say it here.]
Your rights
You can ask us what data we hold about you, correct it, get a copy, or have it deleted. Email privacy@trakty.app from the address you signed up with. You can delete your account yourself in the app or on trakty.app/delete-account. You can also complain to [the Agency for Personal Data Protection of North Macedonia / your local authority].
Children
Trakty is not meant for children under [16].
Changes
If we change this policy, we'll update the date above and, for important changes, tell you in the app.