Privacy policy
Effective 11 November 2026 · Version 1.0
Who we are
Ride Along (by Basic Lab's) is made by Shreyas Rao ("we", "us"), India. Ride Along is an independent, non-commercial beta and is not affiliated with, endorsed by, or connected to Yezdi, Jawa, Classic Legends, or any motorcycle manufacturer. We are the Data Fiduciary for personal data processed through Ride Along under the Digital Personal Data Protection Act, 2023 ("DPDP Act"). Questions or complaints: use Profile → Privacy & data → Contact the privacy team in the app; we reply within 7 days and resolve grievances within 30 days.
What stays on your phone
Never uploaded by us. Stored in the app's private storage, encrypted with AES-256-GCM using a key held in the Android Keystore:
- Your profile (name, phone, email, city, bike details)
- Recorded rides: GPS tracks, speed, lean angle, bike data
- Emergency contacts, blood group and medical notes
- Fuel, service and document records in the Garage
- Recent destinations
App backup is disabled, so this data isn't copied to cloud backups. Uninstalling the app deletes it.
What goes to our servers, and why
Our servers are Google Firebase (Firestore in Mumbai, India; Realtime Database in Singapore). Google acts as our Data Processor under its data-processing terms. You're identified by a random account ID created on your phone, not by your phone number or email.
| Data | When | Purpose | Kept for |
|---|---|---|---|
| First name, bike model | When you use Crew features | Show who posted or who is in a ride | Until you delete your account |
| Posts, comments, likes, RSVPs, spots | When you post | Community forum and Explore | Until you or we delete them; hazards expire in hours |
| Route attached to a post | Only if you attach one | Show the route | With the post. The first and last part are hidden by your privacy zone. |
| Live location, speed, heading | Only while you're in a group ride | Show your group where you are | Deleted when you leave, close the app or lose connection |
| Group pings, SOS | When sent | Alert your group | Deleted when the leader ends the group ride; groups stop working after 7 days |
| Family live link: name, location, speed, crash/SOS flag | Only while you share it | Let people you send the link to follow your ride | Deleted when you stop sharing or close the app. If your phone dies first, it's deleted the next time you open Ride Along, and the page stops showing it after 2 hours without updates |
| Reports and privacy messages | When you send them | Moderation, answering you | Up to 1 year |
What goes to other services
- OpenStreetMap map tiles and the Overpass API (Explore): your phone's IP address, and the area you search rounded to about 1 km.
- Google Maps: when you tap navigate, the destination is handed to the Google Maps app under Google's own privacy policy. Ride Along reads Maps' navigation notification only to show turns on your cluster; it isn't stored or uploaded.
- SMS: if crash detection fires and you enabled it, an SMS with your location and medical notes is sent from your own SIM to the contacts you chose.
- Pillion intercom: audio goes phone-to-phone over Bluetooth/Wi-Fi (Google Nearby Connections). It is not recorded and never passes through our servers.
Permissions
| Permission | Used for |
|---|---|
| Location | Ride recording, map, group rides, family link, crash location |
| Bluetooth / nearby devices | Your bike's cluster, pillion intercom |
| Microphone | Pillion intercom only, while it's on |
| Phone state, answer calls | Show calls on the cluster; answer from the cockpit |
| Notification access | Read Google Maps turn instructions and the playing song |
| SMS | Crash/SOS messages to your emergency contacts only |
| Motion sensors | Lean angle and crash detection, processed on the phone |
Ride Along runs only while the app is open. When you close it, everything stops: bike link, GPS, sharing, intercom. Nothing starts at boot.
Your rights (DPDP Act)
- Access and portability: Profile → Privacy & data → Download my data.
- Correction: edit your profile, posts and spots in the app.
- Erasure: Profile → Privacy & data → Delete my account removes your server data (posts, comments, spots, likes, live data and account) immediately.
- Withdraw consent at any time by turning a feature off. Anything you already shared is removed when you delete it or your account.
- Grievance redressal through the in-app contact. If unresolved, you can approach the Data Protection Board of India.
- Nominate someone to exercise these rights if you die or become incapacitated, by writing to us.
Children
Ride Along is for riders aged 18 and over. We don't knowingly process children's data. If you believe a child is using it, contact us and we'll delete the account.
Security
- All traffic is HTTPS/TLS. The app refuses unencrypted connections and user-installed certificates.
- Server access is limited by strict security rules: you can only change your own data, and group data is visible only to that group's members.
- Family links use a 20-character random token. Pages are never indexed, and the link never leaks through referrers.
- Optional app lock with fingerprint/face/PIN. Medical screens can't be screenshotted or shown in the app switcher.
- Release builds are code-shrunk and obfuscated. No debug logs.
No system is perfectly secure. If a breach affects you, we'll tell you and the Data Protection Board as the DPDP Act requires.
Changes
We'll show material changes in the app before they take effect. The version and date are at the top of this page.