Privacy notice
In short. We never keep your location history or your journeys. Your position is used only when you use it: as the start of a route, unless you pick another start, or as the place of a hazard you report. Ratings are linked to road segments. Other drivers never see who rated or reported a road. You can download or delete your data at any time from the app, under You, Privacy and your data.
Who we are
Rate The Road ("RTR", "we") is a community app that shows the condition of roads in Maharashtra, based on what drivers report. During the pilot it is run by DP Patil. Questions and complaints go to the Grievance Officer (see Contact). For your personal data, we are the data fiduciary under India's Digital Personal Data Protection Act, 2023.
Who can use RTR
During the pilot, RTR is only for people aged 18 or over. You confirm your age when you sign up. If we learn that an account belongs to someone under 18, we delete it.
What we collect, why, and for how long
| Data | Why | How long |
|---|---|---|
| Your Google account: email address, name, Google account ID and the link to your profile picture | Signing you in. We never see your Google password. | Until you delete your account |
| For each phone you are signed in on: when the session started and was last renewed, its IP address, and the app and phone details it reports (user agent) | Keeping you signed in. We look at it only to investigate misuse of your account | Until you sign out on that phone, or delete your account |
| Service logs at our database provider: the time, IP address and app and phone details of each request | Running the service and investigating faults and attacks | Deleted by Supabase after 1 day (sign-in events after 1 hour) |
| When you confirmed you are 18 or over, your app language, your account status | Running your account and showing the app in your language | Until you delete your account |
| Your consent choices: purpose, notice version, when you agreed and when you withdrew | Proof of what you agreed to | Until you delete your account, then 1 year |
| Ratings: the road segment, the 1 to 5 score, road hazards you ticked (such as missing barriers), your vehicle type, the time | Calculating road scores | Only the last 180 days count in scores. Kept until you delete your account, then kept without any link to you |
| Stretch reports: the place names you choose, the road between them, the condition, the cause, the end date of road works, an optional comment | Showing stretches in poor condition and updating scores | Shown for 30 days (road works 14 days). Comments are deleted with your account; the rest is kept without any link to you |
| Hazard reports: the type, the point on the nearest road (not your own position), an optional comment | Warning other drivers | Shown for 6 hours to 30 days, depending on the type. Comments are deleted with your account; the rest is kept without any link to you |
| Feedback and complaints: the type, your message, our reply, and only if you choose, a screenshot, the app version, the phone model and the Android version | Fixing problems and handling complaints | Until you delete your account. Screenshots are deleted after 90 days |
| How often you used each feature in the last hour, and short-lived keys that stop a report being stored twice | Limits that stop abuse | 1 day for counts, 7 days for keys |
| Security events, such as refused requests or limits reached, with your internal account number (not your name or email) | Spotting misuse | 180 days |
| Actions by our staff on reports and accounts, with their reasons | Accountability | 2 years |
| Encrypted backups of the database | Recovering from a failure | 14 daily and 4 weekly copies, so nothing is kept longer than 4 weeks |
On your phone only
- Your current position, when you tap Locate. It is used on the phone and not stored by us. A hazard report starts at your current position and sends only the point you choose, and we keep only the nearest point on the road.
- Your sign-in, encrypted with a key held by Android.
- Reports waiting to be sent while you are offline, for at most 7 days. They are deleted when you sign out.
Sent to others, not stored by us
- The start and end of a route go to openrouteservice to find routes. The text you search for is first looked up in our own list of Maharashtra's towns and villages, and goes to openrouteservice only if it isn't there. When you ask for a route, your current position is used as its start, unless you pick another start. It is also used when you choose "Use my location" for the destination. It goes at full precision, through our server, and is not stored. A search sends only an approximate area (about 1 km), never your exact position.
What we do not collect
In this version we do not collect location history, trips, photos, phone sensor data, contacts or your advertising ID. We do not show ads and we do not sell or share your data for marketing. If a later version adds trip recording, photos, road alerts or crash reports, the app asks for your consent to each one separately before it starts, and you can say no.
Who can see your data
- Other drivers see road scores, stretches and hazards, never who reported them.
- Our staff (moderators and the Grievance Officer) see your internal account number, your account status and your reports, so they can remove false or harmful content. They do not see your email address or your name in the staff console. Every staff action is logged.
- Service providers that run RTR for us, listed below. They process data only on our instructions.
Service providers and where data is stored
| Provider | What it does | Where |
|---|---|---|
| Supabase | Database, sign-in and file storage | Singapore (AWS ap-southeast-1) |
| Cloudflare | Encrypted backups (R2) and this website | Backups: Asia-Pacific. Website: Cloudflare's global network |
| Google sign-in, and Google Play to install the app | Google's global data centres | |
| openrouteservice (HeiGIT gGmbH) | Routes and place search | Germany |
| GitHub | Runs the nightly backup job; the backup is encrypted before it leaves the job | United States |
How we protect your data
- All connections are encrypted (TLS). Data is encrypted at rest by our providers.
- The database refuses every request that is not allowed by a rule for that table, so one user cannot read another user's data.
- Backups are encrypted again before upload, with a key kept offline.
- Staff accounts need 2-step verification, and the staff console sits behind a separate login.
- If a breach affects your personal data, we tell the Data Protection Board of India and you, as the law requires.
Your rights
- See and download your data. In the app: You, Privacy and your data, Download my data. You get one file with everything we hold about you.
- Withdraw consent. Optional consents have a switch in the same place, and turning one off is as easy as turning it on. Withdrawing the account consent means deleting your account.
- Correct your data. Change your language in the app. For anything else, write to the Grievance Officer.
- Delete your account. In the app: You, Privacy and your data, Delete my account. Your account, sign-in and feedback are deleted at once, and every device is signed out within a minute. Your ratings and reports stay in road scores, without your name or comments, so the map stays accurate. Copies in backups are gone within 4 weeks. How to delete without the app.
- Nominate someone to use these rights for you if you die or cannot act yourself. Write to the Grievance Officer.
- Complain. Write to the Grievance Officer first. If you are not satisfied with the answer, you can complain to the Data Protection Board of India.
Changes to this notice
Each version has a date. If a change affects what we collect or why, the app asks you again before the change applies to you.
Contact
Grievance Officer: DP Patil
Email: ratetheroad1@gmail.com
We acknowledge every complaint within 24 hours and resolve it within 15 days. You can also send a complaint from the app: You, Send feedback, Complaint. See Complaints and takedown requests.