Privacy Policy

This Privacy Policy explains how THaF Riders Pvt. Ltd. (hereinafter "THaF", "we", "us", or "our") collects, uses, stores, shares, and protects information about you when you use the THaF mobile application.

By creating an account or using the Service, you acknowledge that you have read and understood this Privacy Policy. This policy is published in compliance with global standards including GDPR, CCPA/CPRA, and India's DPDPA 2023.

This policy covers all personal data processed through THaF applications, backend services, real-time trip-tracking servers, and media storage.

We collect identity data, extended profile data, authentication data, device data, and location data (collected only while you actively participate in a trip).

4.1 Identity & Account Data

4.2 Medical / SOS Card

THaF lets you store a medical card (blood group, allergies, In-Case-of-Emergency contacts). This card is stored encrypted and is visible only to:

• Emergency contacts you designate
• Lockscreen rescuers (when you explicitly enable lockscreen access)

4.3 Location Data

THaF offers an optional Live Trip Tracking feature. Location data is collected only while a trip is active and you are a participant.

• Latitude / longitude (GPS coordinates)
• Speed, bearing, and motion telemetry
• Trip group identifiers

We do not collect background location outside of active trip sessions.

We process your data based on:

• Performance of contract (providing core features)
• Consent (specifically for live tracking and optional profile fields)
• Legitimate interest (security, abuse prevention)
• Legal obligation (compliance with laws)

The only data we share is with the riders you have chosen — buddy-tracking is opt-in per trip. We use industry-standard sub-processors (cloud hosting, push notifications, crash analytics) under data-processing agreements.

• Encryption in transit via HTTPS/TLS
• End-to-end encryption for message content (Signal Protocol)
• Medical card stored encrypted at rest
• No user passwords stored (OAuth only)
• EXIF stripping on uploaded images

You have the right to access, rectify, erase, and port your data. You can also withdraw consent at any time. Account deletion is available in-app from Profile → Account → Delete.

The Service is not directed to children under 13 years of age. We do not knowingly collect personal data from children below the applicable age threshold.

We may update this policy from time to time. For material changes, we will give you reasonable advance notice via in-app banner or email.