Vyber is a carpooling app for intercity and intracity rides in India. It helps people who are already travelling share a private vehicle and split the fuel and toll cost. Because rides involve strangers, safety and trust features need personal data. This policy explains, in plain language, what we collect, why, who sees it, how long we keep it, and the choices you have.
The data fiduciary (the party that decides how your data is used) is [Legal entity name], [registered address] ("Vyber", "we", "us"). This policy is written to comply with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000 and the rules made under it.
By creating an account and accepting this policy you consent to the processing described here. We record which version of this policy (and of our Terms and the location-tracking notice) you accepted and when. You can withdraw consent at any time (see section 9), but some features cannot work without the data they need.
| Category | What | Needed for |
|---|---|---|
| Account | Email address, mobile number (if provided), password (stored only as a salted hash), Google sign-in identifier if you use Google | Login, one-time passwords, account recovery |
| Profile | Name, profile photo, gender, date of birth, short bio, home city, language choice | Showing who you are to co-travellers, women-only rides, age eligibility |
| Emergency contacts | Name and phone number of 1 to 3 people you choose | Sending SOS and trip-share alerts |
| Driver verification (drivers only) | Driving licence number, expiry and photos of the licence; a government ID (Aadhaar, driving licence, passport or voter ID) as photos; a selfie | Manual review by our admin team before you can post rides |
| Vehicle (drivers only) | Number plate, make, model, colour, type, front and side photos, registration certificate (RC) | Vehicle identification, blocking fake plates and borrowed cars |
| Rides and plans | Rides you post, seats you request, pickup and drop points, planned trips, saved routes and places, recurring commutes, recent searches, ride requests and ride alerts | Search, matching, reminders |
| Payments | Payment method choice, UPI ID of drivers (to receive payments), payment status and amounts, cancellation penalties; for commute passes, order and payment references from Razorpay | Cost-sharing payments and commute passes |
| Messages | In-app chat messages and images between people on a booking | Coordinating pickup |
| Ratings and reports | Ratings, reviews, reports about users, "car didn't match" reports, evidence you attach, appeals | Trust, safety and dispute handling |
| Groups | Membership of office, college or society groups, invites, and a company or college email if you verify one | Private pools and verified badges |
| Support | Anything you write to us | Answering you |
Photos are compressed on your device before upload.
Other users may rate you, review you, report you, or block you. Blocked users cannot see or contact each other.
You can change these in your phone's settings at any time.
Location is used only during an active ride and during an SOS. Outside those moments the app does not collect your location.
We show you a consent screen about location before tracking is first used, and record your choice.
| Purpose | Examples |
|---|---|
| Provide the service | Create your account, post and search rides, match riders along a route, handle bookings, cancellations and payments, run chat, send reminders and ride-found alerts |
| Verify and build trust | Review licences, IDs, vehicles and RC; show ratings and reliability scores; apply warnings and suspensions |
| Keep people safe | Ride PIN, live tracking, SOS, off-route and long-stop alerts, women-only rides, handling reports |
| Communicate | OTP emails, booking updates, safety alerts, service messages. Promotional messages can be muted in notification settings; safety alerts cannot be turned off |
| Prevent misuse | Detect fake plates, fake accounts, abuse of OTPs and prices above the cost-sharing cap |
| Improve and operate | Fix bugs, measure demand by route and cancellation rates in aggregate |
| Meet legal duties | Respond to lawful requests, keep records the law requires, enforce our Terms |
We do not use your data to make solely automated decisions with legal effect on you. Suspensions and rejections are reviewed by people, and you can appeal.
| Who | What they can see |
|---|---|
| Anyone browsing rides | Driver's first name, photo, rating and verification badges; car make, model and colour; masked plate (for example UP 15 ** 1234). No phone number and no car photos. |
| Co-travellers after a booking is confirmed | Full number plate, vehicle photos, and the driver's phone number; live location during the ride. Chat is available. Passengers' phone numbers are shared only as needed for the ride. |
| Your emergency contacts | Your name and, during SOS or a shared trip, your live location and trip details |
| Anyone with your share-trip link | The live position and route of that ride |
| Group members | Your name and photo within a group you joined |
| Our admin team | Documents, reports, SOS events, ride records and account data, only as needed for review, safety and support. Admin access is limited to authorised staff. |
Your ID documents, licence, RC and selfie are visible only to you and to our admin reviewers. They are never shown to other users. Your date of birth and email are not shown to other users.
We do not sell your data. We use the following providers to run the service. Each receives only what it needs.
| Provider | Purpose | Data involved |
|---|---|---|
| Supabase | Database, login, file storage, realtime updates, server functions | All app data described above |
| Google (Firebase Cloud Messaging; Google sign-in) | Push notifications; optional Google login | Push token, notification content; Google account identifier and email if you sign in with Google |
| Resend | Transactional email (OTPs, support and group email verification) | Your email address and message content |
| Razorpay | Commute pass purchases and refunds only | Order and payment references, amount. Card, bank and UPI credentials are entered with Razorpay and are not stored by us |
| OpenStreetMap-based services (map tiles, place search, routing) | Showing maps, finding places, distance and ETA | Search text and coordinates needed for the request |
| Static hosting (share-trip page and admin panel) | Serving web pages | Standard web request data such as IP address |
Ride payments: in-app ride payments are made directly by UPI from the passenger to the driver's UPI ID, or by cash. We record the amount and status but do not hold your money or your UPI PIN.
These providers are bound by their own terms and privacy policies, and may process data outside India (see section 12). If we add a provider (for example an SMS service for OTPs and SOS), we will update this policy first.
We keep data only as long as needed for the purpose it was collected, or as the law requires.
| Data | Retention |
|---|---|
| Account, profile, verification documents, vehicles | While your account is active. Deleted when you delete your account, subject to the exceptions below |
| Detailed live-location trail of a ride | Deleted after [30] days. Only a trip summary is kept afterwards |
| SOS records and safety alerts | [e.g. 3 years], for safety review and legal protection |
| Ride, booking, payment and cancellation records | [e.g. 8 years] or as required by tax and accounting law; may be anonymised on account deletion |
| Chat messages | While the account is active; deleted or anonymised with the account, except where held for an open dispute |
| Reports, appeals and evidence | Until resolved, then [e.g. 2 years] |
| One-time passwords | Deleted shortly after expiry |
| Share-trip links | Close when the ride ends and are then removed |
| Unverified accounts | Removed if not verified within [e.g. 30] days |
| Consent records | Kept as proof of what you agreed to and when |
| Backups | Deleted data leaves backups within [e.g. 90] days |
If the law or a dispute requires us to keep some records after you delete your account, we keep only those, restrict their use, and delete them when the requirement ends.
Under the DPDP Act you have the right to:
We respond to requests within [e.g. 30] days. We may need to verify your identity first.
No system is completely secure. If a personal data breach affects you, we will notify you and the Data Protection Board of India as the law requires. Please keep your login safe and never share your ride PIN with anyone other than the driver at pickup.
Vyber is for people aged 18 and over. We do not knowingly collect personal data of children. If you believe a child has created an account, contact us and we will delete it.
Our database and files are hosted with Supabase in [region, e.g. Mumbai / Singapore]. Some providers listed in section 6 may process data in other countries. We transfer data outside India only to countries not restricted by the Government of India under the DPDP Act, and only to providers who protect it.
We may update this policy as the app or the law changes. For material changes we will notify you in the app before they take effect and ask for your consent again where required. The version number and effective date at the top show the current version.
Grievance Officer / Data Protection Contact
Name: [Name]
Email: [privacy@yourdomain]
Address: [Registered address]
Response time: acknowledgement within [48 hours], resolution within [30 days]