Privacy Policy
Last updated: 2026-09-10
This policy describes what personal data we process in the Trips app and on this website, for what purposes and on what legal bases, to whom the data is disclosed, how long it is kept, and what rights you have. Because Trips users meet in real life, a separate Section 5 sets out exactly which of your information other users can see.
1. Data Controller
The data controller for the “Trips” app and this website is [[juridinio asmens pavadinimas, kodas, buveinės adresas]]. For any data-related questions, write to support@tripsapp.lt or to [[korespondencijos adresas]]. We have not appointed a separate data protection officer; requests are handled through the same contacts.
2. When this policy applies
It applies to the Trips app and website. The policy does not apply to communication outside our platform: if you contact another user by phone, through another app, or on a social network, that communication is governed by the rules of the respective services.
3. What data we process
3.1. What you provide yourself
- Phone number or email address: to create an account and sign in with a one-time code. The service does not work without one of them.
- Name and profile photo: shown to other users so they know whom they will be travelling with.
- Optional profile information: a description about yourself and the languages you speak.
- Gender (optional): used only for the “women only” ride filter. It is not shown on your public profile and is not accessible to other users.
- Vehicle details (for drivers): make, model, colour, number of seats, photo, and licence plate. The licence plate is shown only to passengers whose booking has been confirmed.
- Ride data: route, stops, date and time, number of seats, price, preferences (smoking, pets, luggage, etc.), notes, and meeting point.
- Messages and their attachments: chat text, sent photos, and location points (coordinates with a label you provide).
- Reviews: a star rating and text about another user.
- Abuse reports and blocks: the content of the report, the reason, and the person it concerns.
- Contacting us: the content of your emails and the correspondence history.
3.2. What arises from using the service
- Bookings: the ride segment, date, number of seats, price, status (submitted, confirmed, cancelled, boarded, completed) and the timestamps.
- Boarding code: generated when a booking is confirmed; visible only to that booking’s passenger and driver.
- Rating: the average and the number of reviews, calculated from published reviews.
- Searches: route, date, flexibility setting, and the number of results found. Used to assess demand for the service. When you browse without signing in, the search is recorded without any link to a person.
- Safety flags: driver cancellations less than 24 hours before departure, restrictions, and the fact of account removal. They are not shown to other users.
- Message read receipts: so a chat shows whether a message has been read.
- Consent and declaration records: the time you accepted the terms, the time you declared that you are 18 or older, and (for drivers) the time you attested that you meet the driver requirements. Only these timestamps are stored; we do not ask for or store a birth date.
3.3. Device data
- Precise location (only at your initiative). Location is read in two cases: when you choose “Current location” in a chat and when you tap the suggestion in the search field to find the nearest city. Location is not tracked in the background; permission is requested only when you take one of these actions.
- Notification token: a device identifier that allows notifications about bookings, messages, and route alerts to be delivered.
- Technical data: IP address, device type, operating system and app version, and language setting. Our infrastructure providers see them in request logs; they are used to ensure security and to investigate failures.
3.4. Data stored only on your device
This data is not transmitted to our servers and is removed together with the app: your last searched routes, an unfinished ride-posting draft, your language and dark or light mode choice, the statistics toggle state, and the sign-in session key (stored in the device’s storage).
4. Why we process data and on what legal basis
| Purpose | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Account creation and sign-in | Phone number or email, one-time code, name | Performance of a contract (Art. 6(1)(b)) |
| Posting, searching, and booking rides | Profile, vehicle, rides, bookings, boarding codes | Performance of a contract (Art. 6(1)(b)) |
| Messaging between travellers | Messages, photos, location points, read receipts | Performance of a contract (Art. 6(1)(b)) |
| Notifications about bookings, messages, and route alerts | Notification token | Performance of a contract (Art. 6(1)(b)); where the device platform requires it, consent (point (a)) |
| Sending your location in a chat and suggesting the nearest city | Precise location | Consent (Art. 6(1)(a)), withdrawable in device settings |
| “Women only” ride filter | Gender you provide | Consent (Art. 6(1)(a)); the field is optional and can be deleted at any time |
| Trust system: reviews and ratings | Reviews, stars, average rating | Performance of a contract (point (b)) and a legitimate interest in maintaining a working trust system (point (f)) |
| Security, moderation, fraud and abuse prevention | Reports, blocks, filter triggers, cancellation flags, technical data | Legitimate interest in protecting users and the platform (Art. 6(1)(f)) |
| Service performance and demand statistics | Search routes, dates, and result counts (without identity when browsing signed out) | Legitimate interest in assessing demand for the service (Art. 6(1)(f)) |
| Product analytics (PostHog) | Event names (“search performed”, “ride posted”) and a user identifier | Consent (Art. 6(1)(a)), controlled by a toggle in the app settings |
| Keeping evidence of the consents and declarations you have given (terms acceptance, 18+ declaration, driver attestation) | The timestamps of those actions | Legal obligation to demonstrate consent (Art. 6(1)(c) together with Art. 7(1)) |
| Handling inquiries and complaints | Correspondence, case-related records | Legitimate interest (point (f)); legal obligation where applicable (point (c)) |
| Establishing and defending legal claims | Dispute-related records | Legitimate interest (Art. 6(1)(f)) |
Where we rely on legitimate interest, we have assessed that it does not override your rights: we process only minimal data, and you have the right to object to such processing (Section 12).
5. What others see about you
This table reflects the actual access rules enforced on the server, not only what the app’s screens display.
| Data | Who sees it |
|---|---|
| Route, time, price, available seats | Everyone, including signed-out website visitors |
| Name, photo, description, languages, rating, published reviews, member since | Signed-in users |
| Vehicle make, model, colour | Signed-in users |
| Licence plate | Only passengers with a confirmed booking |
| Boarding code, precise meeting point | Only that booking's passenger and driver |
| Messages, photos, location points | Only the participants of that chat |
| Phone number, email address | No users |
| Gender | No users; used only for the filter |
| Cancellation flags, restrictions, account status | Only us |
| Abuse reports you submit | Only us; the person you reported does not see your identity |
Public ride pages on the website show only the route, time, and price, without the driver’s name, photo, or other personal data. Such pages may be indexed by search engines.
Please note that we cannot retract a sent message, photo, or location point from the recipient’s device.
6. To whom data is transferred
We do not sell data and do not use it for advertising. It is processed only by the providers essential to the service, bound by data processing agreements:
| Provider | What it does | Where processed |
|---|---|---|
| Supabase | Database, file storage, authentication, server functions | European Union ([[Supabase projekto regionas, pvz. eu-central-1 (Frankfurtas)]]) |
| Twilio | SMS with the sign-in code | USA / global infrastructure |
| Expo, Apple (APNs), Google (FCM) | Delivery of notifications to the device | USA / global infrastructure |
| PostHog Cloud EU | Product analytics, unless you have turned it off | European Union |
| MapTiler (MapTiler AG) | Static map images for location messages; the provider sees your IP address but not your identity | Switzerland (EU adequacy decision) |
| Apple App Store, Google Play | App distribution and crash reports | USA / EU |
In addition, we may disclose data to law enforcement or other authorities when required by law or when necessary to prevent a real threat to a person’s life or health. In a business transfer, data may pass to the acquirer; we notify you of this in advance.
7. Transfers outside the European Economic Area
The core data (accounts, rides, messages, photos) is stored in the European Union. Some providers (SMS and notification delivery) also operate outside the EEA. In such cases the transfer is based on the standard contractual clauses approved by the European Commission and on additional safeguards. Only what is necessary to provide the service is transferred: the SMS provider receives the phone number and code, and the notification provider receives the device token and the message text.
8. Consents and how to withdraw them
- Location: revoke the permission in your device settings; all other features keep working.
- Notifications: turned off in device settings.
- Product analytics: a toggle in the app settings. Once turned off, events are no longer sent.
- Gender: the field is optional; you can delete it in profile editing.
Withdrawing consent applies going forward and does not affect processing that took place before it.
9. How long we keep data
| Data | Retention period |
|---|---|
| Account, profile, vehicles | As long as you have an account |
| Rides, bookings, boarding codes | As long as you have an account |
| Messages and their attachments | As long as you have an account; photos are removed from storage together with them |
| Reviews | As long as you have an account; when you delete your account, the reviews you wrote are removed and other users' ratings are recalculated |
| Search statistics | Up to 24 months; when you delete your account, the link to you is removed, leaving only an anonymous record |
| Product analytics (PostHog) | Up to 12 months |
| Reports of violations you committed | Up to 12 months after account deletion, de-identified (without profile data), for the purpose of security and preventing repeat violations |
| Correspondence with us | Up to 24 months from the resolution of the matter |
| Server and security logs | For as long as the infrastructure provider keeps them (usually up to 7 days) |
10. How to delete your account
In the app: Profile → Delete account. It is deleted immediately and irreversibly. Removed: your profile and photo, vehicles, the rides you posted, bookings, chats with messages and photos, the reviews you wrote, route alerts, and the notification token. People whose upcoming rides or bookings are cancelled as a result receive a notification.
What remains: de-identified reports of violations you committed (Section 9) and anonymous search statistics from which the link to you is removed. A review written about you by another person belongs to their account and remains in their history.
11. Automated processing
Three things operate automatically: an offensive-content filter (which prevents posting a message, review, or description containing forbidden words), sending-rate limits, and driver-enabled instant booking (a booking is confirmed without human involvement).
We do not make decisions producing legal effects by automated means alone: restricting or removing an account is always decided by a human, we notify you of the decision, and it can be appealed (Section 14 of the Terms).
12. Your rights
- Access the data we process and receive a copy of it.
- Rectify inaccurate data: you can change most of it yourself in your profile.
- Erase data (“the right to be forgotten”): the simplest way is to delete your account.
- Restrict processing while your request or dispute is being examined.
- Port your data: receive it in a common, machine-readable format.
- Object to processing based on legitimate interest (the point (f) rows of Section 4).
- Withdraw consent at any time (Section 8).
Contact us at support@tripsapp.lt. We respond within one month; in complex cases we may extend the deadline by a further two months, with notice. Requests are free unless they are manifestly unfounded or excessive. To ensure that data is not disclosed to an unauthorised person, we may ask you to sign in to your account or otherwise verify your identity.
If you believe we have violated your rights, you may lodge a complaint with the Valstybinė duomenų apsaugos inspekcija (State Data Protection Inspectorate, vdai.lrv.lt) or the supervisory authority of your country of residence.
13. Security
- All communication between the app and the servers is encrypted (TLS).
- Access to data is limited by row-level rules running server-side: another person’s chat or booking data cannot be reached even by bypassing the app.
- Chat photos are kept in private storage and accessible only through short-lived links issued to that chat’s participants.
- Sensitive profile fields (gender, safety flags) are not accessible to clients even through database queries.
- Administrative access is held only by the people who need it to handle reports.
In the event of a serious data security breach, we inform the supervisory authority within 72 hours and, where the risk to you is high, we notify you as well.
14. Cookies
This website does not use advertising or tracking cookies; only technically necessary items, without which the page would not work, are used. The app does not use cookies; instead, data is kept in the device’s memory (Section 3.4).
15. Children’s data
The service is intended only for persons 18 years of age or older; creating an account requires an explicit declaration that you are at least 18. We do not knowingly collect minors’ data, and if we learn that an account belongs to a minor, we remove it. If you notice such a case, please write to support@tripsapp.lt.
16. Changes to this policy
We may update this policy. We notify you of material changes in the app or by email before they take effect. The current version, with its update date, is always published at this address.
Related document: Terms of Use.