Privacy Policy

Our Privacy Officer is accountable for how Commovi handles personal information. Write to Privacy Officer, Cascade Layer, at privacy@commovi.com with any question, request or complaint.

• Your account: your mobile phone number, name and home city, which are required; and, if you add them, your home area, a photo and an email address.
• Your vehicle, if you drive: make, model, colour, seats and any notes you add.
• What you do in Commovi: the rides you offer and request, bookings, messages with other members, reviews, the reliability record (for example a no-show), and reports you make or that name you.
• Your choices: notification settings, and whether you agreed to text alerts, with when and how you agreed.
• What you accepted: which version of the Terms of Service and of this policy you accepted, and when.
• Technical data: IP addresses, used to limit abuse such as repeated sign-in attempts, and error reports when something breaks, with personal details removed where we can.

On your device, Commovi keeps the sign-in cookie that keeps you signed in, copies of the screens you opened so they work offline (deleted when you log out), and, if you turn on notifications, the push token for that browser or app.

• To sign you in, and to change your number: a one-time code is texted to the number.
• To run the service: matching rides and requests, bookings, messages, reminders and notifications.
• To keep the community safe: reviews, reliability, reports and the actions community admins take.
• To keep Commovi working and secure: limits on abuse, and fixing errors.

We don't sell personal information and we don't use it for advertising. We use it only for the purposes above, or as the law requires. Before we use it for anything new, we will ask for your consent.

• Other members of your community see your name, photo, rating, home city and the rides you post. Your phone number is shown to the other member only once a booking between you is confirmed. A conversation is between the two of you.
• Your community's admins can see your phone number, in the members list, so they can check who is asking to join; it is logged each time they open that list, and they can't change your number. Admins of any other community never see it. They also see your reliability score, memberships and reports. When a booking is reported, they can read its messages, and each time they do, it is logged. Only your community's admins see a report, and the member reported isn't told who reported them.
• Authorised Cascade Layer staff can access data when that's needed to run, support or protect the service. Access through our admin tools is logged.
• Our service providers handle data only to provide their service to us (below).
• When the law requires it, for example a court order, we may have to disclose information.

Commovi has no public profiles: people outside your community can't look you up.

• One-time codes: when you ask to sign in, or to change your number in Settings, Twilio Verify texts a one-time code to the number you entered, from Twilio's own numbers.
• Ride alerts: only if you agree to them, with a separate, optional checkbox when you join or the Text alerts switch in Notification settings. You can use Commovi without them. Reply STOP to any alert to stop them; to turn them back on, reply START to a Commovi ride alert (the number your alerts come from). The Terms of Service describe the program.

We don't share your mobile number or text-message consent with third parties or affiliates for marketing purposes.

We use these companies to run Commovi. They process personal information only on our instructions, to provide their service to us.

• Render: our servers, and the database and its backups, in Virginia, United States.
• Cloudflare: photo storage (R2), in the United States, and our domain name service.
• Vercel: hosts the web app, in its United States region.
• Twilio: sends the codes to sign in or to change your number, and text alerts.
• Google Firebase: delivers push notifications, through Apple's push service on iPhone and iPad.
• Sentry: error reports, in its United States region.
• Grafana: checks that the service is up, from the United States.

All the above categories exclude text messaging originator opt-in data and consent; this information won't be shared with any third parties.

Some providers also handle data in other countries to do their job: Cloudflare's network, Google and Apple to deliver push notifications, and Twilio and phone carriers to deliver texts. Wherever it is stored or handled, information may be accessible to the courts, law enforcement and national security authorities of that country.

• Rides, bookings and reviews: 2 years after the trip date (reviews: 2 years after they were published). A rating counts the reviews of the last 2 years.
• Messages: 12 months after the trip date, or longer while a report about that booking is open.
• Reports: while open, and 2 years after they're closed.
• The reliability record: 2 years.
• Memberships you left or were removed from: 2 years after.
• Notifications: 90 days.
• A sign-up never finished (a number entered on the join screen whose code was never entered, with nothing else attached to it): 7 days.
• Audit log (who did or looked at what, for safety and disputes): 2 years.
• App logs and error reports: 30 days, or less where the provider keeps them for less.
• Profile photos: until you replace or remove them, or delete your account; the old file is deleted at once.
• Text alert consent records (your number, and when and how you agreed or stopped): 4 years after your texts stop or you delete your account, as proof of consent.
• Which Terms and policy you accepted: while you have an account, and 2 years after you delete it.
• Removed members: if a community's admin removed you and you then change your phone number or delete your account, we keep a scrambled form of the number you had then, and of each one after it if you change it again. It's a keyed hash, which can't be turned back into the number, kept for 2 years after the removal, only to recognise the number if it joins that community again. A new account with it then waits for an admin's approval.
• Deleted accounts: removed at once when you delete your account; what's left over (such as the text of messages under a report still open) within 30 days.
• Backups: the database's backups are kept for up to 7 days, so deleted information leaves them within 7 days. If we ever restore one, we delete again every account deleted since it was made.

• See and correct: your profile, vehicle and settings are in the app. To get a copy of the personal information we hold about you, write to privacy@commovi.com. We answer within 30 days.
• Challenge a record: if you think something recorded about you is wrong, such as a no-show, ask your community's admin or write to privacy@commovi.com. A person reviews it; nothing is reversed automatically.
• Withdraw consent: turn off push notifications and text alerts in Notification settings, or reply STOP to a text alert.
• Delete your account: in Profile, tap Delete account. It happens at once: your upcoming rides and seats are cancelled, and your name, phone number, photo, home area, vehicles and the text of your messages are removed. Records other members rely on, such as a past trip with them, stay but show you as "Deleted member". You can also write to privacy@commovi.com and we'll confirm it's you first.

What deletion doesn't remove, and why:

• text alert consent records, for 4 years, as proof of consent;
• which Terms and policy you accepted, for 2 years;
• a report that is still open, and the messages it is about, until it is resolved, so it can be handled fairly;
• if an admin had removed you, the scrambled phone numbers described above, for 2 years;
• the audit log, for 2 years, for safety and disputes;
• backups, until they expire within 7 days.

Data is encrypted in transit. Photos are in private storage and shown only through links that expire. Staff access needs a password and a second factor, and access through our admin tools is logged. If a breach puts you at real risk of significant harm, we will tell you and the Office of the Privacy Commissioner of Canada as PIPEDA requires.

Commovi accounts are for people 18 and older. Children may ride with a parent or guardian who books for them (see the Terms of Service); we don't collect information about them.

If we change this policy, we'll update the date at the top, and tell you in the app before an important change takes effect. A new use of your information needs your consent first.

Write to privacy@commovi.com first, and we'll try to resolve it. If you're not satisfied, you can complain to the Office of the Privacy Commissioner of Canada.