Privacy Policy

Last updated: 12 September 2026

OGRA matches university students travelling the same way at the same time so they can share one ride and split the fare. Doing that requires knowing where you are and where you are going. This policy explains exactly what we collect, why, who sees it, and how long we keep it.

The data controller is [OGRA — replace with the registered legal entity and address]. For any question about your data, or to exercise any right described below, write to [privacy@ogra.app — replace with the monitored address].

Location — read this part

OGRA collects precise location. Specifically:

• When you set a pickup or destination, we use your device's location to place the pin and to find riders whose route overlaps yours.
• Continuously while a ride is running, the lead rider's location is collected and shown live to the other riders on that trip, so they can see the car approaching. It stops when the ride ends.
• When someone reports a no-show, we record the reporter's coordinates at that moment. This is evidence: it is what a dispute is decided on, and it is shown to our support team, not to the other rider.

The app requests location only while it is in use. It does not collect your location in the background when you have no active ride, and it does not track you between trips.

Everything else we collect

• Account — your mobile number (used to sign you in by one-time code), name, email, username, and your university.
• Rides — pickup and destination, times, distance, the fare and how it was split, who you travelled with, and cancellations including the reason you give.
• Money — your wallet balance and every movement in and out of it, including matching fees, penalties and refunds.
• Messages — the chat between riders on a trip, and any photo you send in it, including photos of the fare meter.
• Ratings — the score and review you leave for a co-rider, and those they leave for you.
• Device — a push notification token, your app version, and the IP address and approximate location of each sign-in, kept for security.
• Crash reports — when the app crashes we receive the technical details of the failure so we can fix it.

Who else sees it

• The rider you match with sees your first name, your rating, your pickup and drop-off points, your share of the fare, and — while the trip is running — the lead rider's live location. They do not see your phone number, your email or your wallet.
• Google receives the coordinates we need routed, in order to return a route and place names (Google Maps Platform).
• Google Firebase delivers push notifications and receives crash reports.
• Twilio receives your mobile number in order to send your one-time sign-in code by SMS or WhatsApp.
• Our payment provider receives what it needs to take a payment when you add money. We never see or store your full card number.
• Authorities, where we are legally required to disclose.

We do not sell your data, and we do not share it with advertisers.

How long we keep it

• Ride and payment records: seven years, because they are financial records.
• Live location during a ride: retained with the ride record; the live feed itself stops at the end of the trip.
• No-show coordinates: kept while a dispute can still be raised, then with the ride record.
• Chat messages: for the life of the ride record.
• Sign-in history: twelve months.
• If you delete your account we remove your profile, and anonymise the ride and financial records we are required to keep.

Your rights

You can ask us for a copy of your data, ask us to correct it, or ask us to delete it. You can delete your account from inside the app — Menu, then Delete Account — and that removes your profile as described above. You can withdraw location permission at any time in your phone's settings, though the app cannot match or run a ride without it. Write to [privacy@ogra.app — replace with the monitored address] to exercise any of these, and we will respond within 30 days.

Children

OGRA is for university students. It is not intended for anyone under 16, and we do not knowingly create accounts for them. If you believe a child has an account, write to [privacy@ogra.app — replace with the monitored address] and we will remove it.

Security

Traffic between the app and our servers is encrypted in transit. Access to production data is limited to staff who need it. No system is perfectly secure; if a breach affects your data we will tell you and the regulator as the law requires.

Changes

If we change what we collect or who we share it with, we will update this page and the date at the top, and tell you in the app before the change takes effect.