Privacy Policy

2. What information we collect

We collect the data necessary to operate the service:

• Account info — name, email, phone (parents); name + phone (drivers, set by school admin). Parents may also upload a profile photo (avatar).
• Children data — child name, school grade, and gender, set by the parent. Parents may upload a photo of their child, which is stored on our servers.
• Subscription & invoice records — which routes a child rides, billing periods, and payment history.
• Payment claim references — when a parent reports paying offline (cash, bank transfer, bKash, Nagad, Rocket), we store the method and any reference number provided. We do not collect or store credit card numbers, bank account numbers, or mobile wallet PINs.
• Location (drivers only, while a trip is active) — the bus's GPS is broadcast to parents subscribed to the route. Tracking stops the moment the driver ends the trip.
• Live video & audio (drivers only, while broadcasting) — the driver can start an in-bus live camera + microphone broadcast that parents on the route can view in real time. Video and audio are streamed directly to parents and are not recorded or stored on our servers. Broadcasting stops when the driver ends the session.
• Messages — in-app chat between a parent and the driver of their child's route.
• Push tokens (FCM) — to send pickup/dropoff alerts and chat notifications.

3. How we use the data

• Show parents the live position of their child's bus during an active trip.
• Notify parents of pickup, dropoff, and arrival events.
• Generate monthly invoices and let parents submit payment claims for admin verification.
• Power the parent ↔ driver chat scoped to the route the child rides.

4. Who we share data with

We do not sell or share user data with advertisers or analytics vendors. We use the following service providers solely to operate the App, under their respective Data Processing Agreements:

• Supabase Inc. — database, auth, storage, edge functions (hosted in ap-south-1, Mumbai).
• Google Firebase — real-time bus location, push notifications, in-trip chat.
• Google Maps Platform — map rendering, place search, geocoding.
• Cloudflare — real-time video relay (SFU) for the in-bus live broadcast feature. Video and audio pass through Cloudflare servers and are not stored.
• Resend — transactional email (invoice receipts, approval emails).

5. Children

The App is intended for adult users (parents, school admins, drivers) and is not directed at children under 13. We do not knowingly collect data from children. A parent's tracking of their own child's school bus is the only mention of a minor's location and is mediated by the parent's own consent.

6. Data retention

• Subscription / invoice records: active subscription period plus 1 year after cancellation.
• Photos (child photos, parent avatars): retained while the account is active; deleted when the account is deleted.
• Live GPS frames: 90 days in Firestore, then automatically deleted.
• Live video & audio: not recorded or stored at any time.
• Chat messages: retained while the parent's subscription is active; deletable on request.
• Account data: retained until the user requests deletion.

7. Your rights

• View and edit your profile data inside the App.
• Cancel your subscription at any time.
• Request full account + data deletion by emailing us from the email address registered with your account. We act within 30 days.

8. Security

All traffic between the App and our backend is encrypted with TLS. Database rows are protected by row-level security so a parent can only read their own children's data and a driver can only read data for the route they are currently authenticated against.

9. Changes to this policy

If we change this policy materially, we will notify you in-app and by email before the new policy takes effect.

10. Contact

For questions or to exercise your rights: saidur.shawon@gmail.com