Privacy policy

1. What we collect

• Account: your phone number (verified by one-time code), your name, and — if you sign in with Google — the name and email on your Google account.
• Listings (hosts): the space's location pin, the address text you choose to show drivers, photos, prices, and availability.
• Bookings: booking times, amounts, extensions, penalties, passes, service orders, and problem reports you file.
• Payment: your card is sent directly from our server to Tranzila, our payment processor, which returns a reference token. We keep the token and enough to show you which card is on file — never the full card number.
• Notifications: a push subscription, if you turn notifications on.
• Technical: standard request logs (such as IP address and user agent) kept by our hosting provider for security and reliability.

2. How we use it

To run the marketplace: showing listings, taking bookings, charging and refunding cards server-side, enforcing overstay penalties, resolving problem reports, sending the notifications you've enabled, preventing fraud and abuse, and meeting legal obligations. That's it — we don't sell your data and we don't run third-party advertising.

3. What other users can see

• Drivers see what a host puts on the listing — including the address text the host chooses to display.
• A host sees the booking details of drivers who book their space, including the driver's name.
• Balances, cards, and contact verification details are never shown to other users.

4. Services we rely on

Each provider receives only what its job needs:

• Supabase — database and authentication (account, listings, bookings).
• Twilio Verify — delivers your one-time login codes by SMS or WhatsApp.
• Tranzila — payment processing; holds the vaulted card.
• Google — optional Google sign-in; maps when configured.
• OpenStreetMap / Nominatim — address search and reverse geocoding.
• Cloudflare — hosts the site, app, and API.

5. Retention

Account data is kept while your account is active. Booking and charge records are kept as long as needed for accounting, dispute, and legal purposes. Ask us to delete your account and we'll remove what we're not legally required to keep.

6. Security

Everything travels over encrypted connections. Charging is server-authoritative — amounts are computed and executed on our servers, never trusted from the browser. Card numbers live with the payment processor, not with us. Secrets are held server-side only.

7. Your rights

You can ask to access, correct, or delete your personal data. Use Report a problem in the app and tell us what you need — a person reviews every request.

8. Changes

If this policy changes materially we'll flag it in the app; the date above always reflects the current version.