This policy explains, in plain language, which personal data Tripcarr processes, what for, who it is shared with, how long it is kept and how you exercise your rights. It was written to comply with the Brazilian General Data Protection Law (LGPD, Law 13.709/2018) and the European Union's General Data Protection Regulation (GDPR).
Please also read the Terms of Service, which govern your use of the app.
1. Who we are and how to contact us
Tripcarr is a zero-fee carpooling app: it connects drivers and passengers who are making the same trip so they can share the cost of the journey. In this policy, "Tripcarr", "we", "us" and "our" refer to whoever operates the app and decides how your data is processed.
For any privacy question and for every request about your rights over your personal data, write to support@tripcarr.com. This is our official channel for data subjects.
2. Who this policy applies to
This policy covers:
- the Tripcarr app for Android and iOS;
- the tripcarr.com website.
About the website: tripcarr.com does not require sign-up, has no forms, sets no cookies, loads no analytics or advertising tools and does not collect personal data. Two remarks, to be precise:
- The website's fonts are loaded from Google Fonts. To deliver them, your browser connects to Google's servers, which receive your IP address and technical information about your browser, as with any visit to a website.
- If you dismiss the language suggestion, the website stores that choice only in your own browser's local storage. That information is not sent to us.
The rest of this policy is about the app.
3. Data we process
The table below lists all the personal data the app processes. Unless stated otherwise, it is kept in our database.
| Category | What it includes | Notes |
|---|---|---|
| Account and profile | Full name, email, date of birth, phone number (optional), profile photo, bio, preferred language, city, travel preferences, interests and social media profiles (Instagram, Facebook, LinkedIn), if you provide them | Name, photo and bio appear on your public profile according to your privacy settings. Email, date of birth and phone number are never shown to other users |
| Sign in with Google or Apple data | Google: account name, email and photo. Apple: name and email, which may be a relay address created by Apple | Received only if you choose to sign in with those accounts. Sign in with Apple is available on iOS only |
| Guest session | An anonymous identifier created by Firebase Authentication when you use the app without an account | Created in guest mode so the app can query our server. It is not linked to your name, email or any other data of yours, but Google receives the device's IP address when it is created |
| Gender (optional) | Female, male, non-binary or "prefer not to say" | Self-declared and editable. Used only for women-only rides. Never shown on your profile or on rides |
| Vehicle | Make, model, year, colour, number of seats, fuel type, photos and licence plate | The licence plate is never public: only you can see it |
| Verification documents | Photos of an identity document, or of the driving licence (CNH) and vehicle registration certificate (CRLV) (1 to 4 images per request) | Kept in private storage, accessible only through temporary 5-minute links. Deleted when the account is anonymised |
| Rides | Full address, city, state, country and coordinates of the origin, destination and stops; date and times; seats; suggested amount per seat; preferences and notes | Published rides are public, without any of the driver's personal data beyond the public profile |
| Bookings | Seats requested, message to the driver, status history and dates | Visible to the driver and passenger involved |
| Chat | Message text and read receipts | Visible only to the participants in the conversation |
| Ratings | Overall score, per-criterion scores, feedback tags (for example, "punctual") and comment | See section 5 on who sees each rating |
| Reports | Category, description and up to 5 evidence images | The identity of the person reporting is confidential. The images are kept in private storage |
| Emergency contacts | Name, phone number and relationship of up to 5 people you add | This is third-party data (see section 4) |
| Notification token | Device identifier for push notifications (FCM on Android, APNs on iOS) | Removed when you sign out, when it stops being valid or when the account is anonymised |
| In-app notifications | Title, text (which may mention names and cities) and the internal link of each notification | Visible only to you |
| Reputation | Rating averages and count, number of trips, reliability score, last-minute cancellation record and flag for review | Averages are public from 3 ratings; the reliability score appears on the profile; the cancellation and flag records are internal |
| Record of acceptance of the terms | Date of acceptance and the version of the Terms and of this Policy you accepted | Proof of acceptance, required by the accountability duty |
| Technical connection data | IP address and technical data of each request to our server | Used to deliver the service, protect against abuse and enforce usage limits |
Real-time location: during a ride, the driver can turn on location sharing. Positions are passed on instantly to the driver and to the passengers accepted on that ride and are not stored.
3.1 What we do not collect
- Payment data: none. There are no payments inside the app.
- Location history: real-time location is passed on and discarded; we do not keep routes.
- Tracking: the app contains no analytics, advertising or crash reporting tools, and does not use advertising identifiers.
- Contacts, camera and microphone: the app does not ask for access to them. Photos are chosen from your gallery.
- Background location: the app only uses location with foreground permission. On Android, while the driver shares their location during a ride, a foreground service keeps sharing active with the screen locked, always with a visible notification.
4. What we use it for and on what legal basis
| Purpose | LGPD | GDPR |
|---|---|---|
| Account, rides, bookings, chat, ratings and push notifications | Art. 7, V (performance of a contract) | Art. 6(1)(b) |
| Identity and driver verification documents | Art. 11, II, "g" | Art. 6(1)(b) and (f) |
| Gender (only for women-only rides; optional) | Art. 7, I (consent, revocable) | Art. 6(1)(a) |
| Real-time location (turned on by the driver for each ride) | Art. 7, I | Art. 6(1)(a) |
| Emergency contacts (third-party data) | Art. 7, IX (legitimate interest) | Art. 6(1)(f) |
| Reports, moderation, fraud prevention and usage limits | Art. 7, IX | Art. 6(1)(f) |
| Pseudonymised records kept after account deletion and proof of acceptance of the terms | Art. 7, VI (regular exercise of rights) | Art. 6(1)(f) and 17(3)(e) |
Some important points:
- Gender: providing it is optional and serves only to publish or book women-only rides. To withdraw consent, simply delete the gender from your profile or choose "prefer not to say". This does not affect the rest of the app, only access to women-only rides.
- Real-time location: consent is given each time the driver turns on sharing for a ride, and can be withdrawn at any time by turning it off.
- Emergency contacts: when you add someone, you are giving us another person's data. Let your contacts know that you added them and why. The app does not send them messages: the contacts are stored for you to use on the emergency screen.
- GDPR and gender: we do not treat self-declared gender as special category data under the GDPR, but we give it equivalent protection: it is optional, never shown, used for a single purpose and deleted when the account is anonymised.
We do not use your data for advertising, we do not build marketing profiles and we do not sell data.
5. Who we share it with
What other users see
- Public profile: name, photo, bio, sign-up date, rating averages (from 3 ratings), number of trips, reliability score, verification badges and vehicle details without the licence plate. In settings you can hide your profile page from people who do not share a trip with you: anyone who has or had a booking with you (pending, accepted or past) can still see it. Even with your profile hidden, the rides you publish still show your name, photo and badges. You can also hide your ratings: other users then stop seeing your averages and your number of ratings anywhere in the app (on your profile, on the rides you publish and in your booking requests), as well as the list of reviews on your profile.
- Rides: origin, destination, stops, times, seats, suggested amount, preferences and notes are public to anyone searching for rides, including without an account.
- Ratings: once visible, they show the score, the tags, the comment and the name and photo of the person who gave the rating.
- Vehicle licence plate: only you can see it.
- Email, date of birth and phone number: never shown to other users.
- Gender: never shown. However, a female passenger can choose not to see women-only rides offered by non-binary drivers. By comparing searches with and without that preference, it is possible to infer the declared gender of a driver who offers women-only rides. We accept this limitation so that the safety preference works.
- Real-time location: only the driver and the passengers accepted on the ride in progress.
- Sharing from the emergency screen: if you use the emergency screen to share your location, the app opens your phone's share menu and you choose who to send it to. That sending happens outside Tripcarr.
Providers that process data on our behalf
| Provider | What it receives | What for | Where |
|---|---|---|---|
| Google Firebase Authentication | Email, password (kept by Firebase, never by Tripcarr) and, with Sign in with Google, name, email and photo. In guest mode, an anonymous identifier and the device's IP address | Sign-in, the anonymous guest-mode session, email verification and password reset | United States |
| Google Firebase Cloud Messaging | Device token and notification content | Delivery of push notifications | United States |
| Apple | With Sign in with Apple (iOS only): name and email. On iOS: the map areas displayed | Sign in with Apple and Apple Maps on iOS | United States |
| Cloudflare R2 | Profile and vehicle photos; verification documents and report evidence (in a private area) | File storage | North America |
| Mapbox | Text typed in the address search and coordinates to identify an address, sent by our server | Address search and autocomplete | United States |
| Google Maps SDK | The map areas displayed, requested by your device | Map display on Android | United States |
| Railway | The entire database and the API | Hosting of the server and database | United States |
| Redis | Only temporary usage-limit counters, associated with your user identifier or IP address | Protection against abuse | United States, alongside the API |
Authorities: we only share data with public authorities when there is a legal obligation or a court order.
We do not sell or rent your personal data to anyone.
6. International transfer
The servers and providers listed above are located in, or controlled from, the United States. Your data is therefore stored and processed in the United States.
- LGPD: transfers rely on the contractual safeguards and data processing terms offered by these providers (Art. 33, II).
- GDPR (Chapter V): for providers certified under the EU-US Data Privacy Framework, the transfer relies on the European Commission's adequacy decision (Art. 45). For the others, on the Standard Contractual Clauses approved by the European Commission (Art. 46(2)(c)), included in those providers' terms.
You can ask for more information about these safeguards by emailing support@tripcarr.com.
7. How long we keep it
| Data | How long |
|---|---|
| Real-time location | Never stored |
| Chat messages | Deleted 90 days after the ride is completed or cancelled or, for a ride that was never completed, 90 days after its departure date. The messages you wrote are also erased when your account is anonymised (see "Deleted account") |
| Notification token | Until you sign out, until it stops being valid or until the account is anonymised |
| Usage-limit counters | Only for the short period of each limit |
| Deleted account | Immediately: the account is hidden from everyone and all sessions are ended. After 30 days: we delete the login identity, documents, photos, emergency contacts, verification requests, notification tokens and profile data (name, email, phone number, photo, bio, date of birth, gender, preferences and vehicle). We also erase every chat message you wrote and all your in-app notifications. The conversations themselves remain for the other participant, without your messages |
| In-app notifications | Deleted 180 days after they are created. Yours are erased earlier if your account is anonymised. Their text may mention names and cities: notifications received by other users that mention your name follow the same 180-day period, even after your account is deleted |
| Rides, bookings, ratings and reports | For as long as the account exists. After deletion, they are kept only in pseudonymised form, for the safety of the community and the defence of rights. Ratings and reports are kept for at most 5 years after the end of our relationship with you (limitation period under the Brazilian Consumer Defence Code, CDC, Art. 27) |
| Record of acceptance of the terms | For as long as the account exists and, in pseudonymised form, for the same 5 years |
"Pseudonymised" means the record no longer contains your name, email or other identifying data, but continues to exist so that, for example, another person's rating average does not change and so that we can respond to a complaint or a lawsuit.
8. Security
We take technical and organisational measures to protect your data, including:
- all communication between the app and our server is encrypted in transit (TLS);
- verification documents and report evidence are kept in private storage, opened only through short-lived temporary links and only after we check who is asking;
- passwords are held by Firebase Authentication; Tripcarr never receives or stores your password;
- usage limits to make abuse and automated attempts harder.
The chat is not end-to-end encrypted. Messages are encrypted in transit, but they are technically accessible to Tripcarr until they are deleted. Do not share information in the chat that you do not want to be stored.
No system is perfectly secure. If something goes wrong, we will follow what is described in section 12.
9. Your rights
Under the LGPD (Art. 18), you have the right to:
- confirmation that we process your data;
- access to the data;
- correction of incomplete, inaccurate or outdated data;
- anonymisation, blocking or deletion of unnecessary or excessive data, or data processed in breach of the law;
- data portability;
- deletion of data processed on the basis of your consent;
- information about who we share your data with;
- information about the possibility of not giving consent and the consequences of that;
- withdrawal of consent;
- objection to processing carried out on other legal bases, where the law is not complied with.
Under the GDPR (Arts. 15 to 22), you have the right of access, rectification, erasure, restriction of processing, portability, objection and not to be subject to decisions based solely on automated processing, as well as to be informed when we correct, erase or restrict data we have shared.
How to exercise them:
- Access and correction: directly in the app, in your profile and settings.
- Deletion: in the app, under Settings → Delete account. You cannot delete the account while you have active rides or bookings; cancel or complete those trips first.
- Portability, objection, review of automated decisions, withdrawal of consent, information about sharing and any other request: by email to support@tripcarr.com. There is no in-app data export yet; we send you your data in a structured format upon your request.
We respond within 15 days (LGPD) or within one month, extendable by two further months for complex or numerous requests, with notice to you (GDPR). We may ask you to confirm your identity before acting, so as not to hand your data to someone else.
You can also lodge a complaint with the Brazilian National Data Protection Authority (ANPD), at gov.br/anpd, or, if you live in the European Union or the European Economic Area, with the data protection authority of the country where you live.
10. Automated decisions
Some consequences are applied automatically by the system:
- Cancellation between 24 h and 2 h before departure: the account receives a last-minute cancellation record ("unreliable").
- Cancellation less than 2 h before departure: in addition to that record, the reliability score, which appears on your profile, is reduced.
- 3 reports within 30 days: the account is flagged for review by a person. The flag does not automatically suspend or ban the account; any measure depends on that review.
For passengers, these cancellation rules apply to bookings already accepted by the driver.
You can ask for a review by a person of any decision based solely on this automated processing, and ask for information about the criteria used (LGPD Art. 20; GDPR Art. 22). Write to support@tripcarr.com.
11. Minors
Tripcarr is only for people aged 18 or over. Age is self-declared through the date of birth given at sign-up; we do not check documents for this. Accounts we find to belong to people under 18 are removed.
12. Security incidents
If a security incident occurs that may cause you significant risk or harm, we will notify the ANPD and the affected people within 3 working days, in accordance with ANPD Resolution CD/ANPD 15/2024.
For users in the European Union, we will notify the competent data protection authority within 72 hours (GDPR Art. 33) and, where there is a high risk, the affected people without undue delay (GDPR Art. 34).
13. Changes and language
We may update this policy. We will announce material changes before they take effect (for example in the app or on this page), and the "Last updated" date at the top of this page will change.
This policy is available in Portuguese, English and German. In case of any discrepancy between the versions, the Portuguese version prevails.